On 5 March 2024, the Grand Chamber of the Court of Justice issued its judgement in C‑755/21 P, involving the appeal of Mr Marián Kočner against Europol. In his appeal, Mr Kočner sought to set aside the judgment of the General Court of the EU of 29 September 2021 (case T-528/20 → eucrim 3/2021, 146)

Background of the dispute

In 2018, following the murder of Slovak journalist J. Kuciak and his fiancée M. Kušnírová, the Slovak authorities conducted extensive investigations in which, at the request of the Slovak authorities, Europol secured and transferred data stored on two cell phones (suspected to belong to Mr Kočner) and on a USB storage device. In May 2019, the Slovak press published extensive information, in particular transcripts of private conversations that originated, among other things, from the cell phones in question. In consequence, Mr. Kočner brought an action before the General Court claiming that Europol had breached its data protection obligations by disclosing the information at issue to the public before the reports had even been communicated to the Slovak authorities. For this reason, Mr Kočner sought compensation for the damage he allegedly suffered as a result of the disclosure by Europol of personal data and the inclusion by Europol of his name on the "Mafia lists".

The General Court's judgment

In its judgement of 29 September 2021, the General Court explained that the EU can only have non-contractual liability for damage allegedly caused by EU agencies if three cumulative conditions are fulfilled, namely (1) the unlawfulness of the conduct alleged against the agency, (2) the fact of damage, and (3) the existence of a causal link between said conduct and the damage being complained about. The General Court dismissed Mr. Kočner’s application on the grounds that no evidence could be found that the disclosure of the transcriptions could be imputable to Europol. The same was held true in relation to the inclusion of Mr. Kočner’s name in the "Mafia lists".

The appeal judgment

In its appeal judgement of 5 March 2024, the Court of Justice set aside the judgment of the General Court in the following point: The Court of Justice held that EU law lays down rules under which Europol and the Member State (in which the damage resulting from unlawful data processing occurred) are jointly and severally liable in the context of cooperation between them. For such joint and several liability to be assumed, the individual concerned must show only that unlawful data processing causing him or her to suffer damage has been carried out in the course of cooperation between Europol and the Member State concerned. Contrary to what the General Court previously held, there is no need for the data subject to establish additionally to which of these two entities that unlawful processing is attributable.

With regard to the dispute itself, the Court of Justice acknowledged that the disclosure to unauthorised persons of data relating to intimate conversations of Mr Kočner triggered liability. This infringed Mr Kočner’s right to respect for his private and family life and his communications and adversely affected his honour and reputation, which caused him non-material damage. The Court of Justice granted Mr Kočner compensation in the amount of €2000 as reparation for that damage.