On 1 October 2025, the General Court (GC) ruled in favour of a Greek academic researcher seeking compensation for damage allegedly caused by a 5 May 2020 press release from the European Anti-Fraud Office (OLAF) that unlawfully processed her personal data and conveyed false information about her. The case is referred as T-384/20 RENV (OC v Commission).

Facts of the case and background

OLAF had opened an investigation into possible irregularities or fraud in an EU-funded research project led by a scientist at a Greek university. In its 5 May 2020 press release (also reported in eucrim), OLAF stated it had found evidence of fraud, forgery, and use of forged documents by the lead scientist, recommended that the European Research Council Executive Agency (the managing authority of the funds in the case at issue) recover unduly received funds, and urged national judicial authorities to initiate criminal proceedings (→eucrim 2/2020, 81).

An initial action before the GC under Art. 268 TFEU for non-material damages was dismissed on 4 May 2022 (judgment of 4 May 2022, OC v Commission (T-384/20), with the Court finding no unlawful conduct by OLAF.

On 7 March 2024, the Court of Justice (ECJ) set aside that judgment, holding that the GC had erred in law by finding that the applicant was not identified or identifiable in the press release and that the information contained therein did not constitute “personal data”. The case was remitted (Case C-479/22 P, OC v Commission).

Ruling of the General Court

Upon remittal, the GC affirmed that the three cumulative conditions for non-contractual liability of the EU are fulfilled in the present case, namely: (1) the unlawfulness of the conduct of which the EU institutions are accused, (2) the fact of damage and (3) the existence of a causal link between that conduct and the damage complained of.

The Court identified three unlawful aspects of OLAF's press release:

• Unlawful processing of personal data and breach of purpose limitation under Regulation 2018/1725 that establishes data protection rules for the processing of personal data by EU institutions: Although the name of the applicant was not explicitly mentioned, the press release included information on age, nationality, gender, father's employment at the Greek university, and the amount of the grant that enabled indirect identification. Except for the grant amount, these details were unnecessary for informing the public about OLAF's activities in the fight against fraud. Publishing the press release constituted "further processing of data" for a purpose different from the original data collection and breached Art. 6(c), (d), and (e) of Regulation 2018/1725, including insufficient consideration of the data's identifiability and the potential consequences for the applicant.
• Violation of the presumption of innocence: The wording implied the applicant's guilt before judicial adjudication, notably by characterising her actions as “fraud”, exceeding a purely factual presentation of the conclusions of OLAF's final report.
• Breach of neutrality and impartiality under Art. 10(5) of Regulation No 883/2013 and Art. 41(1) CFR: By using the term "fraud" in the press release, OLAF conducted a classification in law of the facts implying guilt; this represented an infringement of principles enshrined in the right to good administration.

On damage and causation, the Court found the applicant had sufficiently established non-material damage to honour and reputation, prejudice to her professional career, and harm linked to deteriorated health. It confirmed a causal link to OLAF's (serious) breaches and ordered the Commission to pay €50,000.

Comment

The OC rulings are important for EU data protection and the presumption of innocence:

• Personal data and identifiability: Information enabling indirect identification (even without a name) constitutes personal data under Art. 3(1) of Regulation 2018/1725. This reasoning extends to the GDPR and the Law Enforcement Data Protection Directive. Apparent anonymity does not exempt processing from data protection principles; identifiability depends on the totality of factual circumstances (such as personal relationships, job description, workplace, etc).
• Communication by law enforcement: EU and national bodies (including OLAF, Europol, and Eurojust) must exercise care, neutrality, and proportionality when communicating about individual cases. As the GC stressed, wording should be balanced, measured, and essentially factual. As Joris Deene put it in her short analysis of the judgment: "Communication services must carefully weigh the necessity and proportionality of each communication. Using sensational details to attract media attention is unlawful and can lead to liability." The ruling also informs the interpretation of Directive 2016/343 on the strengthening of certain aspects of the presumption of innocence and of the right to be present at the trial in criminal proceedings. Art. 4 of that Directive includes an explicit provision on public references to guilt.