AH v Eurofound

Facts

Both cases originated from the same events which are as follows:

The applicant (AH) (a contract agent at Eurofound) discovered a file on Eurofound’s servers (‘hrlink’), accessible to all members of staff, that contained sensitive information related to, inter alia, an administrative complaint which the applicant had lodged on 8 September 2017 against a decision refusing him a retroactive reclassification of his function group. The ‘hrlink’ file included communications between two members of staff [identity withheld] regarding said administrative complaint, where they discussed the possibility of initiating disciplinary proceedings against the applicant in view of the false allegations he had made in his complaint of 8 September 2017.

On 2 February 2018, the applicant submitted through his lawyer an email to the Executive Director and the Head of Human Resources at Eurofound requesting assistance so that Eurofound could investigate the serious breaches of duty on the part of his hierarchy which had been uncovered on reading the ‘hrlink’ file, concerning, in particular, the disclosure of his personal data on the one hand, and the remarks made by the members of staff in communication, on the other, and, secondly, a request for compensation, seeking payment of EUR 60 000 provisionally in respect of the damage suffered by virtue of those failings.

Both internal complaints having been rejected by Eurofound, the applicant subsequently lodged two complaints before the General Court of the Court of Justice of the European Union. The first case regarded the disclosure of personal data (T-52/19) and the second one concerned alleged psychological harassment (T-630/19). The initial complaint lodged by the applicant against the refusal of reclassification was never subject to a complaint before the Court.

Case T-52/19

This case focussed on Eurofound’s refusal to provide compensation and to provide assistance by conducting an investigation into the potential breaches of duty of hierarchy as requested by the applicant as a result of the disclosure of personal data. The Court held Eurofound to have breached its duty of care, ordered the annulment of Eurofound’s decision but did not award pecuniary damages to the applicant.

Summary

The applicant received a response to the email of 2 February 2018 (above) from an external law firm speaking on behalf of Eurofound, informing him that the request for compensation was rejected insofar as the personal data had not been divulged intentionally. Recognising that the sensitive files were not secure, the law firm informed the applicant that Eurofound has decided to open an internal investigation to identify the breach.
The applicant requested that Eurofound annul its decision not to accept his initial request (the contested decision) and, before rejecting his claim for compensation, proceed with the investigation he had requested. The compensation request was changed to EUR 30 000 for moral damages. Eurofound, through the law firm, refused. The applicant lodged a formal appeal which was also rejected through the law firm. The applicant at this point lodged a claim with the Court. 

Outcome

In support of his claim, the applicant identified seven reasons for requesting an annulment of the contested decision [para. 41]. However, only the first two were the ones that the Court considered necessary to examine. These were:

1.    Lack of competence of the author of the harmful act
2.    Breach of duty of care

1) Lack of competence of the author of the harmful act:

The applicant submitted that the contested decision and the decision rejecting his complaint were vitiated by lack of competence, since they were adopted by the external law firm, which cannot be regarded as an authority within the meaning of the Staff Regulations.

The law firm was not considered by the Court as having been properly invested with the competence to draft and sign the contested decision, thus compromising the decision itself. [Para. 68].

The Court held that Eurofound violated the principle of good administration by failing to clearly define the role of the external law firm which had been tasked with drafting and signing the contested decision. Furthermore, the leading role that was assigned to the law firm impeded a serene communication between the parties from the outset, creating an obstacle to a possible friendly resolution of the controversy. [Paras 58, 60].

2) Breach of duty of care:

The Court found that, despite the efforts made by enacting those measures to contain the effects of the security flaw in the 'hrlink' file, no administrative investigation proper was carried out to ascertain whether the applicant himself had in fact suffered a disclosure of his personal data as a result of the security flaw in the 'hrlink' file [Para. 79].

Despite the Court’s annulment of Eurofound’s decision, the Court decided not to award damages to the applicant. The annulment in itself was considered adequate compensation for any moral damage that could have been caused. The Court also noted that a parallel investigation by the European Data Protection Board had been suspended during the pending Court proceedings, and that the Court could not prejudge the outcomes of that investigation or the measures taken in execution of the judgment.

In its judgement, the Court held that Eurofound was to bear its own costs as well as those incurred by the applicant.

Case T-630/19

This case focussed on the applicant’s dissatisfaction with Eurofound’s investigation into alleged psychological harassment resulting from the events that occurred and in particular the remarks made by members of staff in relation to the administrative complaint he had submitted on 8 September 2017 (see facts above). The action was dismissed in its entirety.

Summary
In response to the applicant’s email of 2 February 2018 (above), the Deputy Director of Eurofound ("the Deputy Director") informed the applicant that Eurofound wished to open an ex officio administrative investigation into harassment. An external investigation was conducted, and the findings communicated to the applicant. The investigation report concluded that the persons who were the subject of that investigation had not infringed the Staff Regulations and that, consequently, no decision would be taken by Eurofound in respect of them (the contested decision).

The applicant, through his lawyer, wrote to the Deputy Director, contested the conclusions of the investigation report and the lack of a decision by the latter on the request for assistance in respect of psychological harassment, stating that the email should be regarded as a complaint in the event that a decision had already been taken. The Board Committee on Staff Matters of Eurofound rejected the complaint.

The applicant sought annulment of the contested decision and compensation of EUR 30 000 for non-material damages suffered.

Outcome 
In support of his claims for annulment, the applicant relied on eight pleas in law. All were dismissed, as was the action in its entirety. For more detail, see list in Annex below (the first plea was dealt with last).

In its judgement, the Court held that the applicant would bear, in addition to his own costs, those incurred by Eurofound.