I. Introduction

Throughout its 25 years of existence, OLAF has been operating under a composite legal framework.¹ The EU legislator not only vested OLAF with far-reaching investigative powers, but also gradually framed them by requiring OLAF to conduct its investigations in accordance with the provisions of EU primary and secondary law and with full respect for fundamental rights and procedural guarantees.²

The protection of fundamental rights and procedural guarantees applicable to OLAF’s investigations has evolved significantly during this time, from Regulation 1073/1999³ – the first regulation governing the conduct of OLAF investigations being almost silent in this respect – to the current Regulation 883/2013. The latter actually codified the applicable fundamental rights and procedural guarantees, and introduced, following its last amendment in 2020, a dedicated mechanism aimed at enforcing them.⁴

The evolution of the fundamental rights and procedural guarantees applicable to OLAF investigations is also reflected in OLAF’s internal rules, which evolved alongside legislative changes. The current Guidelines on Investigation Procedures for OLAF Staff, adopted in 2021, reflect the changes introduced by the amended Regulation 883/2013, and replaced the Guidelines adopted in 2013.⁵ Prior to these, OLAF had adopted Instructions to Staff on Investigative Procedures, which replaced a former OLAF Manual (both were based on the former Regulation 1073/1999).

II. The Progressive Codification of Fundamental Rights and Procedural Guarantees

When looking at how fundamental rights and procedural guarantees applicable to OLAF investigations have evolved from the early days of OLAF to the present, it is undeniable that their protection has matured along with the Office itself. This happened in different ways: (1) from the codification of what can now be seen as a catalogue of fundamental rights and procedural guarantees, to (2) a move to align, up to a certain extent, the rights and procedural guarantees applicable to external and internal investigations, and (3) the extension of protection to different categories of persons involved⁶ in OLAF investigations.

1. An evolving catalogue of fundamental rights and procedural guarantees

The requirement to comply with fundamental rights has been anchored in the legislation governing the conduct of OLAF investigations since its creation in 1999. However, at the time, Regulation 1073/1999 merely referred to the principles which OLAF was required to respect in general terms and in a recital: the principle of fairness; the right of persons involved to express their views on the facts concerning them; and the principle that the conclusions of an investigation may be based solely on elements which have evidential value.⁷ These principles were not picked up specifically by concrete articles of the Regulation.

In addition, Regulation 1073/1999 defined some procedural guarantees – in relation to internal investigations only – by way of cross-references to the internal decisions adopted by each EU institution, body, office, and agency.⁸ Most of these internal decisions followed the model set out in the Interinstitutional Agreement of May 1999 between the European Parliament, the Council, and the Commission,⁹ which sought to ensure that investigations can be carried out under equivalent conditions in these three institutions and in all other EU bodies, offices, and agencies adhering to it. The internal decisions integrate a rather slim set of procedural guarantees, requiring OLAF to inform the persons concerned in internal investigations of the opening of the investigation, or of the closing of the investigation with no further action taken; and to enable the persons concerned to express their views on all the facts concerning them before drawing conclusions referring to them by name (unless this obligation could be deferred, in cases necessitating the maintenance of absolute secrecy for the purposes of the investigation and requiring the use of investigative procedures falling within the remit of a national judicial authority).

Regulation 1073/1999 also guaranteed the protection of the confidentiality of information forwarded or obtained in the course of investigations, and of personal data.¹⁰ Furthermore, the requirement to conduct investigations continuously over a period proportionate to the circumstances and complexity of the case was embedded in 1999¹¹ – and thus even before the right to have affairs handled within a reasonable period was enshrined in the Charter of Fundamental Rights of the European Union as a component of the right to good administration.¹²

These provisions were complemented by those set out in Regulation 2185/96. This Regulation has remained unchanged to date and forms the basis for on-the-spot checks and inspections by OLAF.¹³ It includes the requirement that on-the-spot checks and inspections be carried out with due regard to the fundamental rights of the persons concerned and to the rules on professional secrecy and the protection of personal data, yet without being very detailed in this regard.

In parallel, and despite the scarcity of legal provisions in Regulations 1073/1999 and 2185/96, the EU Courts have progressively developed a catalogue of fundamental rights and procedural guarantees that OLAF must respect, based on the general principles of EU law. Indeed, fundamental rights are part of general principles of EU law and are also enshrined in the Charter of Fundamental Rights, which forms part of primary EU law that OLAF must comply with. Since the very first cases challenging the conduct of OLAF investigations,¹⁴ the Courts have defined the conditions of application – in the specific context of OLAF investigations – of the rights of the defence and the right to be heard, the right of access to the file, the presumption of innocence, the right to an impartial investigation, and the reasonable-time requirement.

Regulation 883/2013 represented a major step forward in improving the protection of persons involved in OLAF investigations by codifying the fundamental rights and procedural guarantees applicable.¹⁵

Art. 9 of the Regulation – entitled “Procedural guarantees” – requires OLAF to seek evidence for and against the person concerned, and to conduct investigations objectively and impartially and in accordance with the principle of the presumption of innocence. Art. 9 also lays down safeguards applicable in the context of interviews, benefitting persons concerned and witnesses: the right to avoid self-incrimination, the right to be informed of the opening of an investigation, guarantees regarding the notice period and the record of the interview, the right to be assisted by a person of choice, and language rights. Furthermore, Art. 9 provides for the right to be heard, in the form that the person concerned has the opportunity to comment on facts concerning him or her before OLAF draws up conclusions referring to that person by name.

Additional provisions protecting rights and procedural guarantees at different stages of the investigation complement this article: Art. 10 reinforces the confidentiality and data protection requirements applicable throughout the entire lifecycle of OLAF investigations; Art. 11 provides, with some limitations, for the right of the persons concerned to be informed about the closure of an investigation when no evidence has been found against them, and for the right of informants to be informed of the closure of an investigation.

The amendments to Regulation 883/2013 (by Regulation 2020/2223)¹⁶ further extended the existing catalogue of fundamental rights and procedural guarantees applicable to OLAF investigations. Its major innovation was the introduction, in the context of administrative OLAF investigations, of procedural guarantees applicable to criminal investigations. When the Office carries out, within its mandate, supporting measures requested by the European Public Prosecutor’s Office (EPPO), it must ensure, in close cooperation with the EPPO, that the applicable procedural safeguards of Chapter VI of the EPPO Regulation are observed.¹⁷ The amended Regulation also introduced, for the first time, in cases in which OLAF recommends a judicial follow-up, a right for the persons concerned to request from OLAF a copy of the final report.¹⁸

2. The progressive yet partial alignment of fundamental rights and procedural guarantees in internal and external investigations

While Regulation 1073/1999 required OLAF to conduct its investigations “with full respect for human rights and fundamental freedoms”,¹⁹ the few provisions protecting the rights and procedural guarantees of the persons concerned explicitly listed were limited to internal investigations, without any mention of persons concerned in external investigations. Over the years, both the EU legislator and the General Court have bridged this gap.

Conversely, Regulation 883/2013 laid down the principle that the procedural guarantees and fundamental rights of persons concerned and of witnesses should be respected without discrimination at all times and at all stages of both external and internal investigations²⁰ from the outset.

As such, most of the fundamental rights and procedural guarantees set out in Art. 9 therefore apply, without distinction, to both external and internal investigations. A notable exception concerns the right to be informed of the opening of an OLAF investigation. While Art. 9(3) provides for an EU official, other servant, member of an institution or body, head of office or agency, or staff member to be informed as soon as an OLAF investigation reveals that they may be persons concerned, there is no similar obligation for persons concerned in external investigations.

However, the General Court extended this obligation, by analogy, to external investigations. ²¹ Its approach is based on the general principle of respect of the rights of the defence. On the one hand, the Court noted that neither Regulation 2185/96 nor Regulation 1073/1999 contained an obligation – applicable at the time of the case before the Court – to inform a natural person as part of external OLAF investigations; on the other hand, it ruled that observance of the rights of the defence is sufficiently guaranteed in external investigations if, in line with what is provided for in relation to internal investigations, the person is promptly informed of the possibility of personal involvement in acts of fraud, corruption, or illegal activities detrimental to the interests of the Union, provided that information does not interfere with the investigation. Later on, the General Court extended this protection to legal persons concerned in external OLAF investigations.²²

Therefore, both the legislative modifications and the case law developments indicate a clear move to align the rights and procedural guarantees applicable to external and internal investigations and thus to reinforce the protection of the persons concerned.

That said, it is also clear that such an alignment can never be comprehensive, as external and internal investigations follow, in part, distinct rules.²³ The most obvious example is the distinction made with regard to language rights of persons interviewed by OLAF in external and internal investigations. In the context of interviews, persons concerned in external investigations are entitled to use any of the official languages of the institutions of the Union, while EU officials or other servants who are persons concerned in internal investigations may be requested to use an official language of the institutions of the Union of which they have a thorough knowledge.²⁴ Likewise, the conditions for deferring the opportunity to comment provided to persons concerned before drawing conclusions (see above 1.) are different for external and internal investigations. In internal investigations, the deferral requires the prior consent of the Secretary-General or the equivalent authority of the institution, body, office, or agency to which the member or official concerned belongs,²⁵ whereas such a requirement does not exist in external investigations.

3. A gradual extension of the categories of persons protected

The few procedural guarantees included in Regulation 1073/1999 were originally designed to protect persons concerned only. The Regulation did not cover other categories of persons involved in OLAF investigations and their rights and procedural guarantees.

Regulation 883/2013 remedied this gap by including, for the first time, a requirement for OLAF to respect the procedural guarantees and fundamental rights of witnesses.²⁶ Witness rights encompass the right to avoid self-incrimination during an interview, safeguards taking effect when, in the course of an interview, evidence emerges that a witness may be a person concerned, rules on the notice period for the invitation to an interview, and procedural guarantees linked to the interview record (i.e., the possibility to have access to it in order to either approve the record or add observations).²⁷

In addition, the initial version of Regulation 883/2013 referred, for the first time, to sources of information. It included the obligation for the Office to inform EU whistle-blowers (i.e., EU staff members or members of an EU institution, body, office, or agency who act in accordance with Art. 22a of the Staff Regulations) of the decision whether or not to open an investigation.²⁸ The Regulation also provided that, in cases where no internal investigation was opened but information was sent to the institution, body, office, or agency concerned, OLAF was to agree with that institution, body, office, or agency, on suitable measures to protect the confidentiality of the source of that information, where appropriate.²⁹ Lastly, another noteworthy reference was the mention of the protection of journalistic sources, even though it was relegated to a recital.³⁰

Despite these improvements, the protection afforded to sources of information seemed to be rather rudimentary in the initial version of the Regulation. This is why the amended Regulation 883/2013 (see above) represents a significant legislative step forward in the protection of sources of information, in various ways. The most notable one is the reinforced protection granted to whistle-blowers by means of including an explicit reference to the 2019 “Whistleblowing Directive”.³¹ The Directive applies to the reporting of fraud, corruption, and any other illegal activity affecting the financial interests of the Union and the protection of persons reporting such breaches.³² The protection afforded by the Directive thus complements the protection already granted to EU whistle-blowers, which remained unchanged in the amended Regulation 883/2013.

In addition, while the amended Regulation now stipulates that a person concerned may request from OLAF a copy of a final report drawn up in cases where it recommended a judicial follow-up, it also limits the extent to which OLAF can provide such a copy. The exercise of this right by the persons concerned is subject to, among other conditions, respect of the confidentiality rights of whistle-blowers and informants.³³ Likewise, the extent to which the Director-General of OLAF reports to the European Parliament, the Council, the Commission, and the European Court of Auditors on OLAF investigations is also limited by the requirement to respect the rights of informants.³⁴

Finally, yet importantly, the amended Regulation added an obligation for OLAF to notify an informant, who has provided the Office with information that led to an investigation, of the closure of that investigation.³⁵

III. The Reinforcement of Mechanisms to Ensure Compliance with Fundamental Rights and Procedural Guarantees Applicable to OLAF Investigations

In addition to codifying the fundamental rights and procedural guarantees applicable to OLAF investigations, Regulation 883/2013 significantly reinforced their protection by improving the mechanisms designed to ensure that OLAF complies with them.

First, unlike its predecessor (Regulation 1073/1999), Regulation 883/2013 introduced a new internal advisory and control procedure, including an internal legality check relating to, inter alia, the respect for procedural guarantees and fundamental rights of persons concerned.³⁶ This legality check is performed by a review team dedicated to the task, both during and after the closure of the investigation, which verifies the legality, necessity, and proportionality of the activities undertaken during the investigation, and the respect of the rights of the persons concerned throughout the investigative procedure.³⁷

Second, Regulation 883/2013 also formalised and clarified the role of the Supervisory Committee to monitor developments related to the application of procedural guarantees and the duration of OLAF investigations.³⁸

Third, and most notably, the amended Regulation 883/2013 complemented the existing external avenues of judicial and non-judicial review available to all persons alleging a violation of their procedural rights by OLAF.

Judicial review may be sought directly before the EU Courts, via actions for annulment³⁹ or actions for damages⁴⁰, or indirectly, particularly via the preliminary reference procedure⁴¹. In addition, complaints concerning the protection of personal data can be brought before the European Data Protection Supervisor⁴² while complaints concerning maladministration by OLAF can be brought before the European Ombudsperson⁴³. Nevertheless, the absence, in both Regulation 1073/1999 and the initial version of Regulation 883/2013, of a formal procedure for handling individual complaints by persons concerned had long cast doubt on whether the existing mechanisms were indeed sufficient to safeguard fundamental rights and procedural guarantees in all circumstances.⁴⁴ After a long legislative journey,⁴⁵ the gaps identified were finally addressed by the latest amendments introduced through Regulation 2020/2223,⁴⁶ which established a new Controller of procedural guarantees and a complaints mechanism dedicated to it.

1. A new Controller of procedural guarantees

Pursuant to the new Art. 9a of the amended Regulation 883/2013, “[a] Controller of procedural guarantees shall be appointed by the Commission”. Accordingly, on 3 May 2022, the European Commission appointed Julia Laffranque as the first Controller of procedural guarantees for a non-renewable term of five years. The Controller took office in September 2022 and subsequently adopted the first Implementing Provisions for the handling of complaints in November 2022.⁴⁷

The Controller handles individual complaints lodged by persons concerned regarding OLAF’s compliance with the procedural guarantees referred to in Art. 9 of Regulation 883/2013, as well as on the grounds of an infringement of the rules applicable to OLAF investigations,⁴⁸ in particular infringements of procedural requirements and fundamental rights. Of specific importance is the fact that the Controller cannot interfere with the conduct of an ongoing investigation, as such actions would constitute a breach of OLAF’s independence.⁴⁹ Nor does the Controller seek to substitute her own assessment for that of OLAF. For instance, he or she may not interfere with the Director-General’s decision on whether to open an investigation, the choice of investigative measures, the assessment of evidence, or the conclusions reached.⁵⁰ Instead, through actions suggesting how to resolve complaints and, ultimately, recommendations to the Director-General of OLAF, the Controller aims to resolve the issues raised by the complaint and, in a forward-looking manner, to improve OLAF’s administrative and investigative practices.⁵¹ For these reasons, the lodging of a complaint is deprived of any suspensive effect on the conduct of the OLAF investigation in question.⁵²

Although the Controller is administratively attached to the Supervisory Committee of OLAF, he or she carries out his or her duties in full independence, including from the Supervisory Committee and OLAF, and shall neither seek nor take instructions from any party in the performance of his or her duties.⁵³ To assess complaints in a fair, independent, and impartial manner, the Controller is entrusted with information gathering powers, including through privileged access to the case file of the relevant OLAF investigation.⁵⁴ This direct access to OLAF case-related documents ensures that the Controller can thoroughly examine OLAF’s investigative activities. He or she is bound to ensure that all information and documents provided by OLAF are treated confidentially and to protect the confidentiality of OLAF investigations, even after their closure.⁵⁵

Lastly, yet again importantly, the Controller’s added value is further reinforced by his or her ability to provide tailored advisory opinions, upon request of the Director-General of OLAF,⁵⁶ and to inform the Supervisory Committee of any systemic issues revealed through the assessment of complaints.⁵⁷

2. A new complaints mechanism

The amended Regulation 883/2013 complemented the function of the Controller with the creation of a new complaints mechanism, established under Art. 9b. The mechanism comprises two distinct stages: (i) the assessment of the admissibility of the complaint and, if a complaint is admissible, (ii) the assessment of the substantive arguments raised by the complainant.

At the admissibility stage, the Controller assesses whether the complaint was lodged in compliance with the conditions set out in paragraphs 1 and 2 of Art. 9b of the amended Regulation 883/2013, as well as Arts. 5 and 6 of the Implementing Provisions (see above 1.). In particular, the complaint must be filed by a person concerned by an OLAF investigation,⁵⁸ alleging non-compliance by OLAF with the complainant’s procedural guarantees, fundamental rights, and/or the rules applicable to OLAF investigations. For the complaint to be admissible, it should be lodged within one month of the complainant becoming aware of the relevant facts that constitute an alleged infringement of the procedural guarantees or the rules on investigation, and in any event, no more than one month after the closure of the investigation that is the subject of the complaint. Complaints related to the notice period referred to in Art. 9(2) (invitation to an interview) and Art. 9(4) (invitation to persons concerned to comment on facts concerning them) of Regulation 883/2013 must be lodged before the expiry of the 10-day notice period referred to in those provisions.⁵⁹ Furthermore, the complaint must not be manifestly without merits, repetitive, or abusive, and the matter of the complaint must not be the subject of any legal proceedings before either an EU or a national court.⁶⁰ In all instances where complaints are deemed inadmissible, the Controller closes the file and promptly notifies both the complainant and the Director-General of OLAF, providing the reasons of her decision.

Following the admission of a complaint, the Controller proceeds with an assessment on the merits, ensuring full adherence to the adversarial principle.⁶¹ To this end, the Controller invites both OLAF and the complainant to present their arguments, to submit any supporting documentation, and to comment on each other’s submissions within a specified time frame.⁶² Additionally, the Controller may organise and conduct hearings with the participation of both OLAF and the complainant, with the aim of gathering relevant information and/or seeking a prompt resolution to the complaint.⁶³

This adversarial nature of the complaints mechanism is balanced against the need to maintain the confidentiality of the OLAF investigation. In this regard, the Controller may decide not to disclose certain information or materials to the complainant, if doing so is necessary to protect the confidentiality and efficiency of the OLAF investigation, while still respecting the adversarial principle. Similarly, the adversarial procedure cannot be used by the complainant as a means to obtain access to documents from the OLAF case file to which the complainant is not entitled under other legal provisions, or documents to which OLAF has already denied access.⁶⁴

Following the assessment of the collected information and evidence, the Controller either finds no breach of the complainant’s fundamental rights and/or procedural guarantees or the rules applicable to OLAF investigations and therefore closes the case, or concludes that OLAF did not comply with them. In the latter case, the Controller invites OLAF to take appropriate action to resolve the complaint and inform the Controller accordingly within 15 working days.⁶⁵ If the solution provided by OLAF is deemed unsatisfactory, or if no information is received within the 15-day time limit, the Controller shall issue a recommendation on how to resolve the complaint, after consulting the Supervisory Committee for its opinion.⁶⁶ The recommended actions may include, inter alia, the amendment or repeal of OLAF’s recommendations or reports, the repetition of investigative activities, or the introduction of improvements in OLAF’s procedures concerning the matters raised in the complaint.⁶⁷ The Director-General of OLAF may, however, decide not to follow the Controller’s recommendation, providing the main reasons for such decision.⁶⁸

Finally, it should be noted that the complaints mechanism described above is without prejudice to the means of redress available under the Treaties.⁶⁹

3. A two-year snapshot: early outcomes and key insights

During her first two years of operational activity (2022–2023)⁷⁰, the Controller received 31 complaints, 13 of which were already under OLAF's review, pending the Controller’s appointment. Most of the complaints were submitted in English. 19 complaints were lodged by individuals who were persons concerned in OLAF internal investigations, while 11 complaints concerned external investigations, and one complaint related to coordination activities. Out of the total of 31 complaints, 20 were deemed admissible, while 11 were deemed inadmissible, mostly due to non-compliance with the time limits set in Art. 9b(2) of the amended Regulation 883/2013. As to the result of the cases decided by the end of 2023, 13 complaints were closed with no breach of the complainants’ procedural guarantees found. In one instance, the Controller closed the case because the complainant had brought the same issues before a court, while two other cases were closed after OLAF accepted the Controller’s invitation to resolve the complaint. One further complaint was closed for lack of interest of the complainant to pursue the matter before the Controller.

In most cases, the complainants alleged violations of their procedural guarantees under Art. 9 of Regulation 883/2013, as well as infringements of their fundamental rights as outlined in the Charter of Fundamental Rights. The complaints primarily dealt with the following: (i) the right to be heard and the effective exercise of their right to submit observations on facts concerning them (Art. 9(4)); (ii) the right to be informed (Art. 9(3)); (iii) violations of the principles of fairness, objectivity, and impartiality in the conduct of investigations; (iv) the right to have their affairs handled within a reasonable time frame (Art. 41 of the Charter of Fundamental Rights); and (v) the language regime governing the investigations. Additionally, complainants raised concerns regarding the applicable rules governing OLAF investigations, particularly in relation to on-the-spot checks, interviews, and digital forensic operations.⁷¹

IV. Conclusion

The successive modifications of the legal framework governing the conduct of OLAF investigations have led to major improvements when it comes to the protection of fundamental rights and procedural guarantees of persons involved in such investigations. Regulation 883/2013, in its initial and amended versions, codified a number of fundamental rights already protected under the Charter of Fundamental Rights and the general principles of EU law, as interpreted by the Court of Justice of the EU, as well as procedural guarantees associated with specific investigative activities, such as interviews. Not only did it develop a catalogue comprising more rights and procedural guarantees than those foreseen when OLAF was created, but it also gradually extended the level of protection to all categories of persons involved in OLAF investigations.

From an enforcement perspective, the establishment of the Controller of procedural guarantees has also marked a pivotal development in protecting the rights and procedural guarantees of persons concerned in OLAF investigations. Operating through a structured and transparent complaints mechanism designed for dealing with individual complaints, the Controller not only safeguards the rights of those subject to OLAF investigations, but also enhances the overall integrity and credibility of OLAF’s investigative processes. This new mechanism serves as an additional layer of protection, designed to progressively achieve a fair and effective balance between OLAF’s operational efficiency and the robust protection of the procedural rights of persons concerned. Looking ahead, the Controller’s role holds clear potential for continuous improvement in the area of procedural safeguards, reflecting a strong commitment to upholding fundamental rights and fostering public trust in OLAF investigations.

Therefore, we can confidently say that, 25 years after its creation, OLAF has matured – and so has the protection of the fundamental rights and procedural guarantees of the persons involved in its investigations.