CJEU - T‑384/20 RENV - OC v Commission

Summary

The General Court of the European Union has ordered the European Commission to pay €50,000 in damages to a data subject. This ruling stems from a press release that detailed the results of an anti-fraud investigation, which the court found contained unnecessary and inaccurate personal data. The Commission's unlawful processing of this information led to the penalty.

Full text

Help CJEU - T‑384/20 RENV - OC v Commission: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 12:15, 16 July 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators228 editsTag: Visual edit← Older edit Latest revision as of 13:14, 29 July 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators522 editsm Tag: Visual edit Line 47: Line 47: |Initial_Contributor=ap|Initial_Contributor=ap || |EU_Law_Name_3=Article 6(c) Regulation (EU) 2018/1725|EU_Law_Link_3=https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng|EU_Law_Name_4=Article 6(3) Regulation (EU) 2018/1725|EU_Law_Link_4=https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng|EU_Law_Name_5=Article 41 CFR|EU_Law_Link_5=https://www.europarl.europa.eu/charter/pdf/text_en.pdf}}|EU_Law_Name_3=Article 6(c) Regulation (EU) 2018/1725|EU_Law_Link_3=https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng|EU_Law_Name_4=Article 6(3) Regulation (EU) 2018/1725|EU_Law_Link_4=https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng|EU_Law_Name_5=Article 41 CFR|EU_Law_Link_5=http://data.europa.eu/eli/treaty/char_2012/oj}} The General Court ruled that the European Commission must pay a data subject €50,000 in damages following a press release detailing the results of an anti-fraud investigation. The Court held that the Commission processed the data unlawfully by including unnecessary personal data and inaccurate information. The General Court ruled that the European Commission must pay a data subject €50,000 in damages following a press release detailing the results of an anti-fraud investigation. The Court held that the Commission processed the data unlawfully by including unnecessary personal data and inaccurate information. Latest revision as of 13:14, 29 July 2026 CJEU - T‑384/20 RENV OC v Commission Court: CJEU Jurisdiction: European Union Relevant Law: Articles 4(1)(a) Regulation (EU) 2018/1725Article 5(1)(a) Regulation (EU) 2018/1725Article 6(c) Regulation (EU) 2018/1725Article 6(3) Regulation (EU) 2018/1725Article 41 CFRArticles 9(1) Regulation (EU) 883/2013Article 10 Regulation (EU) 883/2013 Decided: 01.10.2025 Parties: European Commission European Research Council Executive Agency (ERCEA) European Anti-Fraud Office (OLAF) Case Number/Name: T‑384/20 RENV OC v Commission European Case Law Identifier: ECLI:EU:T:2025:925 Reference from: Language: 24 EU Languages Original Source: Judgement Initial Contributor: ap The General Court ruled that the European Commission must pay a data subject €50,000 in damages following a press release detailing the results of an anti-fraud investigation. The Court held that the Commission processed the data unlawfully by including unnecessary personal data and inaccurate information. Contents 1 English Summary 1.1 Facts 1.2 Holding 1.2.1 Sufficient breach of law 1.2.2 Damage to the data subject and causal link 1.2.2.1 Damage to the data subject’s reputation 1.2.2.2 Damage to the data subject’s professional career 1.2.2.3 Damage to the data subject’s health 2 Comment 3 Further Resources English Summary Facts An academic researcher (the data subject) received EU funding for a project. The European Commission was initially a party to the funding agreement, but was later replaced by the European Research Council Executive Agency (ERCEA). The ERCEA later carried out a financial audit and informed the European Anti-Fraud Office (OLAF) of the results. OLAF alleged that the data subject had fraudulently claimed part of the funding for personal expenses, and published a press release on its website. The data subject brought an action to the General Court, requesting compensation from the Commission for the damage caused by the press release. The General Court dismissed the action, and stated that there was no violation of the data subject’s rights. According to the General Court, whether the data subject is identifiable depends on the ‘means reasonably likely to be used’ to identify the applicant as well as whether the ‘average or likely reader’ of said press release would be able to identify them. The General Court did not take into account the journalist that identified the data subject, as it did not fall under the definition of "average reader"[1]. The data subject appealed the decision to the CJEU. The CJEU held that the General Court had misinterpreted the EUDPR and GDPR; the CJEU dismissed the General Court’s reasoning of the “average reader”, and stated that the information in the press release (such as the data subject’s gender, nationality, grant amount and father’s occupation) allow the data subject to be identifiable.[2] The CJEU referred the case back to the General Court. The Commission argued that the press release is anonymous, does not disclose any personal data of the data subject and does not contain inaccurate data. Therefore, the press release cannot cause the data subject any harm. Holding The Court first clarified that there are three cumulative conditions for the EU to incur non-contractual liability: a sufficiently serious breach of law, damage to the data subject, and a causal link between them. Sufficient breach of law The Court first held that OLAF had processed the data subject’s data unlawfully, in accordance with Articles 4(1)(a), 5(1)(a), and 6(c) to (e) EUDPR. The Court considered that including information beyond the funding granted was unnecessary. Furthermore, the purpose of including the data in the press release was incompatible with the initial purpose of investigating fraud. Second, the Court held that OLAF violated the principle of the presumption of innocence in accordance with Articles 9(1) and 10 of Regulation 883/2013. This is because OLAF used the term “fraud” in its press release, which implied guilt of the data subject even if national proceedings were ongoing. Finally, the Court held that OLAF violated the right to good administration under Article 41 of the EU Charter of Fundamental Rights (CFREU), and Article 10(5) of Regulation 883/2013. Under Article 10(5) Regulation 883/3013, OLAF has the obligation to provide information to the public in a neutral and impartial manner. This is also linked to the duty to act diligently. OLAF did not meet these requirements, as it also included inaccurate information in its press release. Furthermore, the use of the term “fraud” was not neutral, as it implied guilt of the data subject. The Court considered the violations above sufficiently serious breaches capable of giving rise to liability. Damage to the data subject and causal link The Court then assessed the damage to the data subject, and the causal link with the serious breaches of OLAF’s obligations. The Court first referred to CJEU case C‑300/21 (Österreichische Post) to state that the mere infringement of the EUDPR is not sufficient to confer a right to compensation. The Court divided the non-material damage into three groups, and assessed the link to the OLAF violations separately: damage to the data subject’s honour and reputation, damage to the data subject’s professional career, and damage linked to the data subject’s health. Damage to the data subject’s reputation The Court first stated that OLAF damaged the data subject's reputation due to the unlawful processing, the use of the term "fraud", and the inaccuracies of the press release. The Court then noted a specific requirement for reputation damages; the right to compensation does not depend on the data subject's standing, however, a person's reputation may only be taken into account if disclosing the information (particularly through the press) has a greater impact compared to an ordinary citizen. The data subject had a distinguished academic career and international reputation. The Court concluded that there was a causal link between the press release and the damage to the data subject's reputation. This was the case even if thir

Entities