Court of Justice of the European Communities (including Court of First Instance Decisions)

OPINION OF ADVOCATE GENERAL

HOGAN

delivered on 15 April 2021 (1)

Case C‑650/19 P

Vialto Consulting Kft.

v

European Commission

(Appeal – Action for damages – Non-contractual liability – Pre-Accession Assistance Instrument – Decentralised management – Investigation of the European Anti-Fraud Office (OLAF) – On-the-spot checks – Regulation (Euratom, EC) No 2185/96 – Article 7 – Access to computer data – Digital forensic operation – Legitimate expectations – Right to be heard – Non-material damage)

I.      Introduction

1.        By its appeal, Vialto Consulting Kft. (‘Vialto’ or ‘the appellant’) seeks the setting aside of the judgment of the General Court of the European Union of 26 June 2019, Vialto Consulting v Commission (T‑617/17, not published, EU:T:2019:446; ‘the judgment under appeal’). In that judgment, the General Court dismissed its action seeking compensation for the damage it had allegedly suffered as a result of allegedly unlawful conduct on the part of the European Commission and the European Anti-Fraud Office (OLAF) in connection with its exclusion from the contract for the provision of services bearing the reference TR2010/0311.01-02/001.

2.        This appeal raises an important question in relation to the way in which OLAF carries out its external investigations and, more specifically, the limits of digital forensic operations. It also provides an opportunity to clarify the impact of commitments given by OLAF at the beginning of an on-the-spot check in the light of the principle of legitimate expectations and the scope of the right to be heard in proceedings involving several authorities, such as OLAF, the Commission and a national authority.

3.        The importance of the Court’s judgment in the present appeal proceedings for OLAF’s future administrative practice when conducting external investigations should therefore not be underestimated. Before examining the legal issues thereby presented on this appeal, it is first necessary, however, to address the relevant legal context.

II.    Legal context

A.      Regulation (Euratom, EC) No 2185/96

4.        Article 4 of Council Regulation (Euratom, EC) No 2185/96 of 11 November 1996 concerning on-the-spot checks and inspections carried out by the Commission in order to protect the European Communities’ financial interests against fraud and other irregularities (2) states that:

‘On-the-spot checks and inspections shall be prepared and conducted by the Commission in close cooperation with the competent authorities of the Member State concerned, which shall be notified in good time of the object, purpose and legal basis of the checks and inspections, so that they can provide all the requisite help. To that end, the officials of the Member State concerned may participate in the on-the-spot checks and inspections.

In addition, if the Member State concerned so wishes, the on-the-spot checks and inspections may be carried out jointly by the Commission and the Member State’s competent authorities’.

5.        Article 7 of Regulation No 2185/96 specifies what Commission inspectors may do in the context of on-the-spot checks and inspections they carry out. According to that provision:

‘1.      Commission inspectors shall have access, under the same conditions as national administrative inspectors and in compliance with national legislation, to all the information and documentation on the operations concerned which are required for the proper conduct of the on-the-spot checks and inspections. They may avail themselves of the same inspection facilities as national administrative inspectors and in particular copy relevant documents.

On-the-spot checks and inspections may concern, in particular:

–        professional books and documents such as invoices, lists of terms and conditions, pay slips, statements of materials used and work done, and bank statements held by economic operators,

–        computer data,

–        production, packaging and dispatching systems and methods,

–        physical checks as to the nature and quantity of goods or completed operations,

–        the taking and checking of samples,

–        the progress of works and investments for which financing has been provided, and the use made of completed investments,

–        budgetary and accounting documents,

–        the financial and technical implementation of subsidised projects.

2.      Where necessary, it shall be for the Member States, at the Commission’s request, to take the appropriate precautionary measures under national law, in particular in order to safeguard evidence.’

B.      Regulation (EC) No 718/2007

6.        Article 10(1) of Commission Regulation (EC) No 718/2007 of 12 June 2007 implementing Council Regulation (EC) No 1085/2006 establishing an instrument for pre-accession assistance (IPA) (3) states that:

‘Unless otherwise provided for in paragraph 2, 3 and 4, decentralised management, where the Commission confers the management of certain actions on the beneficiary country, while retaining overall final responsibility for general budget execution in accordance with Article 53c of [Council] Regulation (EC, Euratom) No 1605/2002 [of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities (OJ 2002 L 248, p. 1)] and the relevant provisions of the EC Treaties, shall apply to the implementation of assistance under the IPA Regulation.’

7.        Article 21(1) of that regulation provides:

‘The beneficiary country shall designate the following different bodies and authorities:

…

(f)      an operating structure by IPA component or programme,

…’

8.        Article 28(1) and (2) of Regulation No 718/2007, entitled ‘Functions and responsibilities of the operating structure’, provides:

‘1.      For each IPA component or programme, an operating structure shall be established to deal with the management and implementation of assistance under the IPA Regulation.

The operating structure shall be a body or a collection of bodies within the administration of the beneficiary country.

2.      The operating structure shall be responsible for managing and implementing the programme or programmes concerned in accordance with the principle of sound financial management. …’

C.      Regulation (EU, Euratom) No 883/2013

9.        Article 3 of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (4) concerns external investigations made by OLAF. It states that:

‘1.      [OLAF] shall exercise the power conferred on the Commission by [Regulation No 2185/96] to carry out on-the-spot checks and inspections in the Member States and, in accordance with the cooperation and mutual assistance agreements and any other legal instrument in force, in third countries and on the premises of international organisations.

…

2.      With a view to establishing whether there has been fraud, corruption or any other illegal activity affecting the financial interests of the Union in connection with a grant agreement or decision or a contract concerning Union funding, [OLAF] may, in accordance with the provisions and procedures laid down by [Regulation No 2185/96], conduct on-the-spot checks and inspections on economic operators.

3.      During on-the-spot checks and inspections, the staff of the Office shall act, subject to the Union law applicable, in compliance with the rules and practices of the Member State concerned and with the procedural guarantees provided for in this Regulation.

At the request of [OLAF], the competent authority of the Member State concerned shall provide the staff of [OLAF] with the assistance needed in order to carry out their tasks effectively, as specified in the written authorisation referred to in Article 7(2). If that assistance requires authorisation from a judicial authority in accordance with national rules, such authorisation shall be applied for.

The Member State concerned shall ensure, in accordance with [Regulation No 2185/96], that the staff of [OLAF] are allowed access, under the same terms and conditions as its competent authorities and in compliance with its national law, to all information and documents relating to the matter under investigation which prove necessary in order for the on-the-spot checks and inspections to be carried out effectively and efficiently.

…’

D.      Guidelines on Digital Forensic Procedures for OLAF Staff

10.      The OLAF Guidelines on Digital Forensic Procedures for OLAF Staff (‘the Guidelines on Digital Forensic Procedures’) are internal rules adopted by OLAF which are to be followed by OLAF staff with respect to the identification, acquisition, imaging, collection, analysis and preservation of digital evidence. They are designed to implement, inter alia, Article 7(1) of Regulation No 2185/96 and are available on the OLAF website.

11.      Article 4 of the Guidelines on Digital Forensic Procedures is entitled ‘Conducting a digital forensic operation – general procedure’. It provides:

‘…

4.3.      At the start of the digital forensic operation, the DES [(Digital Evidence Specialist of OLAF staff)] shall: (1) document and take photographs of all digital media which shall be subject to the forensic operation, as well as the physical surroundings and layout; (2) make an inventory of the digital media. The inventory should be included in the “Digital Forensic Operation Report”, and the photographs attached to it.

4.4.      In general, the DES should conduct a full digital forensic acquisition of the devices referred to in 4.3. If feasible, the DES and the investigator should together preview those devices to determine whether they may contain data potentially relevant for the investigation and whether a partial forensic acquisition would be appropriate. If so, the DES may instead conduct a partial forensic acquisition of the data. A short description of the contents and the case reference number added by the DES shall be recorded during the acquisition of the digital forensic image.

…’

12.      Article 8 of the Guidelines on Digital Forensic Procedures is entitled ‘Examination of data gathered during a digital forensic operation’. According to that provision:

‘8.1. Immediately after the return from the digital forensic operation, the DES shall create two back-up copies of the digital forensic image on tape, and place them in sealed envelopes with unique identification numbers. …

8.2      The DES shall transfer the digital forensic image to the forensic file server in the forensic laboratory. The file thus transferred becomes the forensic work file. The DES should inform the investigator as soon as the forensic work file is ready.

…

8.4      When the forensic work file is available, the investigator shall launch written requests through the CMS Intelligence Request Module to index the forensic work file and as appropriate obtain the assistance of the DES or operational analyst to identify data relevant for the investigation. The latter request should describe the aim of the search and what type of evidence and/or proof the investigator is searching for. In response to the investigator’s written request and in conjunction with the investigator the DES shall extract data matching the search criteria from the digital forensic work file for read-only access by the investigator.

8.5      Searching for potential evidence is a dynamic process, and may involve several successive iterations. The search process could include looking for traces of deleted data in unallocated space, specifying keywords to be searched, or making more complex searches such as special expression or timeline searches.

8.6      The investigator shall identify, under the guidance of the DES, potentially relevant information using the facilities of the forensic laboratory. The investigator may also request the DES to print or make an electronic copy of relevant files, which should be attached to the relevant CMS case file. Any such transfer of data from the forensics laboratory to the investigator must be recorded in the CMS Intelligence Request Module in order to protect the chain of evidence.

8.7      Upon completion of the examination of the digital forensic work file in relation to the Intelligence Request launched by the investigator, the DES shall prepare a “Digital Forensic Examination Report” summarising the results of the forensic actions undertaken, and listing the information provided to the investigator. This report must be attached to the relevant CMS case file.

8.8      Upon completion of the analysis, the operational analyst shall prepare an “Operational Analysis Report” of the data originating from the digital forensic work file and the results obtained. This report must be attached to the relevant CMS case file’.

III. Background to the dispute

13.      The background to the dispute has been set out in paragraphs 1 to 23 of the judgment under appeal. It can be summarised as follows.

14.      Vialto is a company incorporated under Hungarian law which provides advisory services to undertakings and entities belonging to the private and public sectors.

15.      On 22 April 2011, the European Commission concluded a financing agreement with the Republic of Turkey under the system of decentralised management with ex ante control, which formed part of the national programme for the Republic of Turkey under the component ‘Transition Assistance and Institution Building’ of the Instrument for Pre-Accession Assistance (IPA) provided for in Council Regulation (EC) No 1085/2006 of 17 July 2006 establishing an Instrument for Pre-Accession Assistance (IPA). (5) The designated operating structure, within the meaning of Article 21 of Regulation No 718/2007, was the Central Finance and Contracts Unit (CFCU).

16.      On 17 December 2013, a call for competition for a contract to be awarded by restricted procedure for the supply of external quality control services in the context of project TR2010/0311.01 ‘Digitization of Land Parcel Identification System’ (‘the project at issue’) was published in the Supplement to the Official Journal of the European Union (OJ 2013/S 244-423607) under reference EuropeAid/132338/D/SER/TR. The purpose of the call for competition was to conclude an initial contract for an initial period of 26 months and for a maximum budget of EUR 4 500 000. The contracting authority designated in the call for competition was the CFCU.

17.      On 19 September 2014, the contract corresponding to the call for competition at issue was awarded to a consortium coordinated by Agrotec SpA (‘the consortium’) composed of five participants, including the appellant. The consortium signed the contract with the CFCU for the provision of services under reference TR2010/0311.01-02/001 (‘the contract in question’).

18.      Following the opening of an investigation on account of suspected acts of corruption or fraud committed in the context of the project at issue, on the basis of Article 3 of Regulation No 883/2013, OLAF decided to carry out checks and inspections at the premises of the appellant (the ‘on-the-spot check’).

19.      On 7 April 2016, OLAF issued two mandates designating the officials responsible for carrying out the on-the-spot check and a digital forensic technical operation. Under the terms of those mandates, the purpose of the on-the-spot check was to gather the evidence held by the appellant of its possible involvement in the acts of corruption and fraud alleged to have been committed in connection with the project in question. The purpose of the digital forensic operation was to obtain, inter alia, the forensic copy of all the appellant’s digital assets used for the management of the project in question, such as desktops, laptops, tablets, external or portable storage devices, mobile phones and all other devices which could be relevant for the purposes of the investigation, data exchange servers and file exchange servers, the email correspondence of the appellant and the appellant’s employees, as well as the functional mailboxes that could be used for the purposes of the investigation.

20.      The on-the-spot check and the digital forensic operation were carried out from 12 to 14 April 2016. A report of each inspection day was drawn up by OLAF. It was noted in the report of 14 April 2016 that the appellant had refused to provide OLAF with certain information. The appellant signed each of the reports and, where necessary, made comments.

21.      By letter of 6 May 2016, the appellant lodged a complaint with OLAF in which it disputed and commented on certain information contained in those reports. In particular, it stated that it was required to cooperate with OLAF only within the limits of the subject matter of the investigation conducted by OLAF, namely, the financing of the project at issue, and that, consequently, it was required to make available to OLAF only information relating to the subject matter of that investigation. In addition, it requested OLAF to take the appropriate measures in the light of the breaches of procedural safeguards committed by its agents during the on-the-spot check. OLAF acknowledged receipt of that complaint on 18 May 2016.

22.      By letter of 8 July 2016, OLAF replied to the appellant’s complaint. After summarising the appellant’s complaints and restating the scope of its investigative powers, it claimed that its investigators had the right to make digital forensic images of the appellant’s hard disks and that it had put an end to the on-the-spot check on account of the appellant’s failure to cooperate. The appellant, on the one hand, had not authorised it to take away a copy of the pre-selected information or, consequently, digital forensic images made and, on the other hand, had not provided the financial information requested. OLAF added that Article 339 TFEU and Article 10(1) of Regulation No 883/2013 ensured that the information collected was confidential. It concluded that, first, its officials had conducted the on-the-spot check within the limits of their powers and, second, the protection of the appellant’s business secrets did not constitute a legitimate reason capable of hindering their investigations. It concluded that no infringement of the appellant’s procedural rights had been committed during the on-the-spot inspection.

23.      By letter of 14 September 2016, OLAF informed the appellant that it was considered to be a person concerned for the purposes of the investigation into the suspicions of corruption or fraud in respect of the project at issue. OLAF then invited it to submit its observations within a period of ten days.

24.      By letter of 23 September 2016, the appellant submitted its observations to OLAF and stated that it had acted in accordance with the applicable rules and complied with all the conditions for legitimate access by OLAF to its data. It said that it was prepared to continue to cooperate with OLAF and to grant it access to any relevant data that could be collected for the purposes of OLAF’s investigation.

25.      By letter of 29 September 2016, the CFCU informed Agrotec of the on-the-spot check at the appellant’s premises and of the fact that it had not consented to granting OLAF access to certain information requested by the latter to carry out its investigation. It added that OLAF considered that, by its conduct, the appellant had infringed Article 25 of the general conditions applicable to the contract at issue (‘the general conditions’) and that it examined the situation with the relevant departments of the Commission. Finally, claiming that, according to the general conditions, Agrotec was its sole interlocutor for all the contractual and financial issues, the CFCU informed that company that, as a result, it was suspending payment of the invoices submitted by it, at least until the closure of OLAF’s investigation.

26.      On 30 September 2016, Agrotec sent the appellant the CFCU’s letter which it had received the day before. It asked Vialto to clarify immediately with OLAF the situation in which it found itself and, secondly, to inform Agrotec, as well as the other members of the consortium, of any failure on its part that led to the opening of OLAF’s investigation. Agrotec added that it reserved the right to adopt the necessary measures, in particular through the CFCU, to protect its interests from acts incompatible with their partnership which the appellant had allegedly committed.

27.      By letter of 4 October 2016, the appellant informed Agrotec of the progress of OLAF’s investigation concerning it and sent Agrotec the correspondence which it had exchanged with OLAF. In addition, the appellant informed Agrotec of the reasons why it considered that the CFCU was not justified, in the light of the general conditions, in deciding to suspend the payments relating to the contract at issue.

28.      By letter of 6 October 2016, the CFCU informed Agrotec that OLAF had informed it of the investigation which it was conducting and that, since the measures to be taken in respect of the appellant had not yet been adopted, the Commission had recommended that CFCU suspend all payments to the consortium until the end of the OLAF investigation.

29.      By letter of 13 October 2016, the Commission’s Directorate-General for European Neighbourhood and Enlargement Negotiations (‘DG Enlargement’) informed the CFCU of the appellant’s refusal, contrary to Article 25 of the general conditions, to cooperate in the investigation carried out by OLAF and requested it to take the necessary measures pursuant to those general conditions and, in that regard, to consider as one of the possible measures the suspension of the execution of the contract in question or the part executed by the appellant, on the basis of Article 25 and 35 of the general conditions. It added that it considered that the amounts paid to the appellant under the contract at issue were not eligible for funding from the EU budget and asked the CFCU to determine precisely those amounts.

30.      By letter of 9 November 2016, OLAF informed the appellant that its investigation had been closed, that its final investigation report had been forwarded to DG Enlargement and of the recommendations it had made to that DG to take appropriate measures to ensure the application of the procedures and sanctions resulting from the serious breach by the appellant of the general conditions.

31.      By letter of 11 November 2016, the CFCU informed Agrotec of the closure of OLAF’s investigation and of the latter’s conclusion that the appellant had infringed Article 25 of the general conditions. The CFCU also informed Agrotec of its decision to exclude the appellant from the contract at issue, in all respects, and to continue to perform that contract, instead of suspending it completely as DG Enlargement had recommended as one of the possible measures. Consequently, the CFCU requested that Agrotec terminate the appellant’s activities immediately as from 11 November 2016 and to take the necessary steps to exclude it from the consortium, namely, by drafting an addendum to the contract at issue.

32.      On 17 November 2016, Agrotec and the members of the consortium, with the exception of the appellant, signed an addendum to the cooperation agreement concluded between them, the purpose of which was to establish a new division of work between those members. By letter of 5 December 2016 addressed to the CFCU, the appellant challenged its exclusion from the contract at issue. The CFCU rejected the appellant’s arguments by letter of 10 January 2017. On 13 December 2016, an addendum to the contract at issue was signed by the CFCU and Agrotec in order to remove the appellant from the list of members of the consortium and to draw the appropriate consequences, particularly from the financial point of view.

33.      By letter of 6 January 2017, the CFCU informed Agrotec that the amount corresponding to the appellant’s participation in the performance of the contract at issue amounted to EUR 182 350.75 and that that amount was ineligible for funding from the European Union budget, on account of the appellant’s breach of its contractual obligations.

IV.    The procedure before the General Court and the judgment under appeal

34.      By application lodged at the Registry of the General Court on 7 September 2017, Vialto brought an action for an order that the Commission pay it compensation of EUR 320 944.56 for material damages and EUR 150 000 for non-material damages, together with interest, allegedly caused by the unlawful conduct of the Commission and OLAF in connection with its exclusion from the contract in question.

35.      In support of that application, Vialto raised two pleas relating to the unlawfulness of OLAF’s conduct, alleging, first, an infringement of Article 7(1) of Regulation No 2185/96 and, second, a breach of the right to sound administration, of the principle of non-discrimination, of the principle of proportionality and of the principle of the protection of legitimate expectations. In addition, Vialto submitted a complaint concerning the unlawfulness of the Commission’s conduct, alleging infringement of the right to be heard.

36.      During the hearing which took place before the General Court, Vialto waived its claim for compensation for the material damage and reduced the sum sought in compensation for the non-material damage allegedly suffered to EUR 25 000, together with interest.

37.      By the judgment under appeal, the General Court, having held that the Commission had wrongly contested its jurisdiction and, on that ground, the admissibility of the action, dismissed all the complaints raised by Vialto concerning the unlawfulness of the conduct of OLAF and the Commission and, consequently, the action as a whole.

38.      The General Court held, first of all, that the data to which the OLAF agents requested access in the present case could be regarded as relevant to the OLAF investigation and that the production of a digital forensic image falls within the powers conferred on the Commission by Article 7(1) of Regulation No 2185/96. It then held that by requesting from Vialto access to those data for analysis, OLAF agents did not commit any violation of that provision.

39.      The General Court then rejected Vialto’s arguments relating to the infringement by OLAF of the right to good administration, the principle of non-discrimination, the principle of proportionality and the principle of the protection of legitimate expectations. As regards the latter principle, after recalling the conditions which must be satisfied for a person to rely on it, the General Court found that, in the present case, it was following Vialto’s refusal to grant the lawful requests for the collection of data from OLAF agents that the latter agreed to derogate from the procedure laid down by the Guidelines on Digital Forensic Procedures as regards the place where the data were obtained and processed and the medium used for that purpose.

40.      Finally, the General Court dismissed Vialto’s complaint relating to the Commission’s infringement of its right to be heard, finding, first, that Vialto had submitted its observations on the on-the-spot check by letters addressed to OLAF and, second, that the decision to exclude Vialto from the contract at issue had been taken by the CFCU, without the latter having been bound by a statement to that effect from DG Enlargement.

V.      Forms of order sought and procedure before the Court of Justice

41.      By its appeal, Vialto claims that the Court should:

–        set aside the judgment under appeal;

–        order the Commission to pay the costs of the present proceedings and of the proceedings before the General Court.

42.      Vialto specifies that, in the event that the Court were to set aside the judgment under appeal, it would leave it to the Court’s discretion to decide whether to refer the case back to the General Court for judgment.

43.      The Commission contends that the Court should:

–        dismiss the appeal as unfounded;

–        order Vialto to pay the costs.

VI.    The appeal

44.      The appellant raises three grounds in support of its appeal.

45.      First of all, by its first ground of appeal, Vialto alleges that the General Court committed several distortions of the facts and errors in law in its application of Article 7(1) of Regulation No 2185/96. Then, by its second ground of appeal, Vialto submits that the General Court erred in law and gave insufficient reasoning for its judgment as regards the alleged breach of the principle of the protection of legitimate expectations. Finally, by its third ground of appeal, Vialto alleges a distortion of the facts and errors in law in relation to the violation of the right to be heard. I propose now to consider each of those grounds in turn.

A.      First ground of appeal relating to the distortion and errors in law as regards the alleged violation of Article 7(1) of Regulation No 2185/96 by OLAF

1.      Arguments of the parties

46.      By its first ground of appeal, the appellant refers to paragraphs 74, 75, 77, 79, 80 and 83 of the judgment under appeal and claims that those paragraphs are vitiated by several distortions of fact and errors in law in that the General Court held that OLAF has not violated Article 7(1) of Regulation No 2185/96. This first ground of appeal is divided, in essence, into three parts.

(a)    First part (paragraph 80 of the judgment under appeal)

47.      By the first part of the first ground of appeal, the appellant submits that the General Court distorted the facts in two ways and thereby committed an error of law.

48.      First, it contends the proceedings brought against the Commission did not concern the validity of OLAF’s request for access to the data listed by the General Court in paragraph 71 of the judgment under appeal, but the validity of OLAF’s request to be authorised to collect, that is to say, to remove and take away, items unconnected with the investigation. The General Court therefore wrongly assessed the facts and ruled on a question never raised in the context of this case, namely the right to carry out an investigation into the data of the undertaking under investigation instead of examining the right to collect data unconnected with the matter under investigation. Second, the appellant further argues that that confusion led to an error of law since the General Court should have interpreted Article 7(1) of Regulation No 2185/96 not as conferring an extensive right of investigation applying to all data covered by that provision, but rather one confined only to a right of collection restricted to data connected with the matter under investigation. Third, contrary to what is stated in paragraph 80 of the judgment under appeal, Vialto effectively granted OLAF access – that is to say the right to investigate – to the seven categories of data listed in paragraph 71 of that same judgment.

49.      The Commission agrees with the reasoning of the General Court and considers that it follows from the wording of Article 7(1) of Regulation No 2185/96, which expressly provides for access to and copying of data, that the production and transport of digital forensic images on OLAF’s premises falls within the Commission’s powers.

50.      The Commission maintains that the General Court fully understood the subject matter of the dispute and has considered whether OLAF had lawfully requested the collection of the disputed data for the purposes of its investigation. First, it takes the view that Vialto makes an arbitrary distinction between access to and collection of data. In the context of digital forensic analysis, such a distinction is impossible and erroneous. Indeed, in order to have a useful effect, such access requires the collection of the data concerned with a view to their processing by means of specific software. It is only after those different steps that OLAF controllers can have effective access to the data concerned. Second, the use by the General Court of the words ‘access to the data’ in paragraph 80 of the judgment under appeal cannot be regarded as misrepresenting the facts. Such access would have been requested directly for certain data, such as transactions, and indirectly for others, namely, in order to produce a digital forensic image. However, Vialto allegedly prevented effective access to the data concerned.

(b)    Second part (paragraphs 74, 75 and 83 of the judgment under appeal)

51.      In the context of the second part of the first ground of appeal, the appellant sets out a series of arguments seeking to establish errors by the General Court in relation to OLAF’s power to collect data.

52.      First, it says that the General Court erred in law by not justifying the finding, made in paragraph 74 of the judgment under appeal, that the data which OLAF requested to be collected were related to the operations concerned and were necessary for the proper conduct of the on-the-spot check within the meaning of Article 7(1) of Regulation No 2185/96. Secondly, such a finding would be arbitrary and, therefore, vitiated by an error of law, since it cannot be considered, prior to a keyword search, that all the data requested by OLAF were related to the operations concerned by the investigation and were necessary for that investigation. Third, the General Court distorted the facts by finding, in paragraph 75 of the judgment under appeal, that Vialto merely objected to the collection of those data on media to be taken to OLAF’s premises. From the outset and in general terms, Vialto opposed the collection of data unrelated to the project under review.

53.      For its part, the Commission agrees with the reasoning of the General Court and considers that the collection of the data requested was necessary for the proper conduct of the on-the-spot check.

54.      First, the finding in paragraph 74 of the judgment under appeal is based on the nature of digital forensic operations and is therefore in no way arbitrary. Second, the request for the collection of data by OLAF did not relate to all of Vialto’s data, but only to elements defined on the basis of objective criteria rationae personae and rationae temporis. Vialto misunderstands the nature of digital forensic operations when it takes the view that a keyword search is required prior to data collection. Moreover, the General Court has confirmed in its judgment of 12 July 2018, Nexans France and Nexans v Commission (T‑449/14, EU:T:2018:456), the validity of the methodology in question in the context of the Commission’s competition inspections under Article 20 of Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation of the rules on competition laid down in Articles [101 and 102 TFEU]. (6) Third, the General Court merely referred, in paragraph 75 of the judgment under appeal, to Vialto’s opposition to the storage of the data on media which would then be transported to OLAF’s premises, which Vialto did not deny.

(c)    Third part (paragraphs 77 and 79 of the judgment under appeal)

55.      By the third part of its first ground of appeal, the appellant submits that the General Court erred in law by dismissing as irrelevant Vialto’s arguments based on respect for professional secrecy and on the clauses of contracts concluded with its commercial partners which it had relied on in order to engage the non-contractual liability of the Union. Such arguments would be relevant to establish a violation by OLAF of Article 7(1) of Regulation No 2185/96, as they would demonstrate that the reservations made by Vialto with regard to the collection of data unrelated to the investigation were justified. However, under the Court’s case-law, Vialto would have been required to prove that the formulation of such reservations did not constitute an abuse of rights. It adds that the General Court distorted the facts by holding that OLAF could not be regarded as having compelled it to breach its professional secrecy or the terms of the contracts concluded with its commercial partners, since it did not claim in any way that it had been compelled by OLAF to act in that way.

56.      On the other hand, the Commission concludes that the third part of the first plea in law must be rejected, since it is ineffective and, in any event, unfounded.

57.      First, the arguments based on professional secrecy and the related contractual clauses in connection with proof of possible abuse of rights on its part are a new allegation and are therefore inadmissible. In any event, the General Court rightly held, in paragraph 78 of the judgment under appeal, that the invocation of confidentiality clauses in contracts concluded with its commercial partners was irrelevant by reason of the duty of discretion incumbent on OLAF’s agents. Second, as regards the General Court’s finding that OLAF did not compel Vialto to provide confidential information, Vialto misinterpreted the judgment under appeal, since such a finding would merely lead to the conclusion that further examination of the confidentiality clauses was superfluous.

2.      Analysis

58.      The third part of the first ground of appeal relates to a specific question. In essence, however, the first two parts of this ground of appeal revolve around the same issue – namely, the extent of the powers of OLAF in the context of a digital forensic operation under Article 7(1) of Regulation No 2185/96 – and can conveniently be dealt with together.

(a)    First two parts

59.      Before analysing the core of the appellant’s argumentation developed in the context of the first two parts of its first ground of appeal, I wish to address, in order to reject them, the arguments based on the distortion of facts and the lack of reasoning alleged in those first two parts.

(1)    Distortion of facts and lack of reasoning

60.      First, referring to paragraph 80 of the judgment under appeal, the appellant argues that the General Court wrongly assessed the facts and ruled on a question never raised in the context of this case, namely, the right to carry out an investigation into the data of Vialto instead of examining the right to collect data unconnected with the matter under investigation.

61.      For my part, I do think that that reading of paragraph 80 of the judgment under appeal can properly be upheld in the light of what is stated in paragraphs 62 and 75 of the same judgment. On the one hand, the General Court states, in paragraph 62 of the judgment under appeal, that the appellant complains that OLAF requested the possibility of collecting data unconnected with the investigation in question in breach of Article 7(1) of Regulation No 2185/96. On the other hand, the General Court also adds in paragraph 75 of the judgment under appeal that the appellant claimed that it had permitted OLAF investigators to have access to all the data requested but that it had objected to the collection of that data. It is therefore clear from those two paragraphs that the General Court had understood perfectly what the appellant’s contentions in respect of OLAF actually were and, therefore, the subject matter of the action brought before it.

62.      Second, paragraph 75 of the judgment under appeal seems to have been misinterpreted by the appellant. Indeed, in that paragraph, the General Court merely notes Vialto’s opposition to the collection of data on a medium which was ‘to be taken away from its premises’, which Vialto does not contest. That point does not, however, concern the question of whether the medium used belongs to Vialto.

63.      Third, it must be noted that paragraph 80 of the judgment under appeal constitutes the General Court’s conclusion as to its interpretation of Article 7 of Regulation No 2185/96. Contrary to what is alleged by the appellant, it contains no reference, express or implied, to Vialto’s conduct. There is therefore no indication in paragraph 80 of the judgment under appeal that the appellant did not give access to the categories of data listed in paragraph 71 of the judgment under appeal. Nor, moreover, can such a finding be inferred from the preceding paragraphs of the judgment under appeal.

64.      Fourth, the appellant criticises the lack of reasoning in support of the finding made by the General Court in paragraph 74 of the judgment under appeal – according to which the data which OLAF requested to collect should be considered as relating to the operations concerned and necessary for the proper conduct of the on-the-spot check within the meaning of Article 7(1) of Regulation No 2185/96.

65.      Yet, as indicated by the words ‘Ως εκ τούτου’ in the procedural language of the judgment under appeal – which may be translated as ‘hence’ or ‘therefore’ – that paragraph is an intermediate conclusion based on the prior observations of the General Court, and more specifically those made from paragraphs 66 to 73. The statement in paragraph 74 of the judgment under appeal is therefore perfectly understandable and sufficiently reasoned.

(2)    Errors of law in the interpretation of Article 7(1) of Regulation No 2185/96

66.      By two distinct pleas, the appellant criticises the interpretation of Article 7(1) of Regulation No 2185/96 made by the General Court in the judgment under appeal in the specific context of a digital forensic operation. First of all, contrary to the interpretation adopted, the General Court should have interpreted that provision as not covering a broad right of investigation applying to all data covered by that provision, but only to a right of collection restricted to data connected with the matter under investigation. Then, the interpretation thus adopted would also be arbitrary because it could be not assumed that, since a keyword search did not take place, all the data requested by OLAF were related to the operations concerned by the investigation and could therefore be collected.

67.      One might usefully here recall that Article 7(1) of Regulation No 2185/96 provides that Commission inspectors must, on the one hand, ‘have access, under the same conditions as national administrative inspectors and in compliance with national legislation, to all the information and documentation on the operations concerned which are required for the proper conduct of the on-the-spot checks and inspections [and, on the other hand,] they may … copy relevant documents’. (7)

68.      It is beyond dispute that digital forensic operations carried out by OLAF under Article 7(1) of Regulation No 2185/96 are problematic. (8) One need only look at the Commission’s proposal for a Regulation of the European Parliament and of the Council amending [Regulation No 883/2013] as regards cooperation with the European Public Prosecutor’s Office and the effectiveness of OLAF investigations (9) and to the evaluation of the application of Regulation No 883/2013 which preceded it. (10)

69.      Indeed, that evaluation concludes, inter alia, that there is a lack of clarity and specificity surrounding OLAF’s powers to conduct digital forensic operations. According to the Final report of the evaluation of the application of Regulation No 883/2013, those shortcomings are due to two factors. The first is that OLAF’s powers to conduct digital forensic operations during external investigations are dependent on national rules and practices, which vary from Member State to Member State, and are either unclear or are non-existent. (11)

70.      The problem identified in that part of the evaluation of the application of Regulation No 883/2013 is therefore, in reality, the interaction between, on the one hand, Regulation No 2185/96 and Regulation No 883/2013 and, on the other hand, the national legislative framework in which the digital forensic operation takes place.

71.      However, in the present case, it appears from the report on the on-the-spot check of Vialto of 12 April 2016 that a representative of the Hungarian Anti-Fraud Coordination Structure (AFCOS) was present on this first day of the control. Furthermore, it is not alleged that the digital forensic operation as defined in the authorisation issued to the OLAF investigators by the Director-General of OLAF infringed applicable national rules or was carried out against the opinion of the national official present. In these circumstances, the question which arises is therefore limited to determining what type of digital forensic search is permitted on the exclusive basis of Article 7(1) of Regulation No 2185/96.

72.      If we look at the wording of Article 7(1) of Regulation No 2185/96, we learn two things. First of all, the second subparagraph of that provision expressly specifies that on-the-spot checks and inspections may concern computer data. Next, it follows from the first subparagraph of the same provision that this necessarily implies access to all the information and documents contained in the computer data relating to the operations concerned which are required for the proper conduct of the on-the-spot checks and inspections and the right to take copies of the relevant documents. The text therefore suggests a difference between a right of access, which of practical necessity must be broad, and a right to copy, which on the contrary, is limited to relevant data only. This is consistent: in order to find the relevant information, it is necessary to search everywhere where this information can be found.

73.      Such an interpretation is confirmed by the context in which the on-the-spot check takes place and by its purpose. Indeed, as provided for by Article 8(3) of Regulation No 2185/96, a report account of the on-the-spot check or the inspection must be drawn up and ‘the material and supporting documents as referred to in Article 7’ of Regulation No 2185/96 must be annexed to it. Reports drawn up in this way constitute admissible evidence in administrative or judicial proceedings of the Member State in which their use proves necessary. However, only documents relating to the infringement which is the subject of an administrative or judicial procedure – in other words, relevant for these procedures – are, by definition, likely to constitute admissible evidence.

74.      In the context of a digital forensic operation, that implies that OLAF must have access to all computer data contained in the devices covered by the authorisation given by the OLAF Director-General in order to be able to establish which of these data are related to the operation concerned. This identification is only made possible by the acquisition of a ‘digital forensic image’ defined in the Guidelines on Digital Forensic Procedures as ‘the forensic (bitwise) copy of original data contained on a digital storage medium … stored in binary format with a unique hash value’. (12) This data collection by means of a ‘copy-image’ should therefore not be confused with copies of documents as referred to in Article 7(1) of Regulation No 2185/96. This digital forensic image is indispensable from an information technology perspective because it is this image which enables keyword searches to be made, using specific forensic computer software, which will identify the data relating to the project at issue. It is only after this step in the process – namely, after the software has identified certain documents as potentially relevant – that OLAF investigators are authorised to access their contents and thus identify the relevant information within the meaning of Article 7(1) of Regulation No 2185/96. (13) They may then, if necessary, make a copy of it to be attached to the report. In other words, the ‘copy-image’ is initially taken purely for examination purposes.

75.      Moreover, the indexation of data using forensic computer software and the subsequent sifting of the indexed data can take considerable time, especially since undertakings now store substantial quantities of data electronically. This peculiarity of the informational technology environment also explains why OLAF relies on a copy of the data for the purpose of conducting its examination. This benefits both OLAF and the undertaking concerned, which can thus continue to use the original data and the media on which they are stored. The interference in the functioning of the undertaking caused by the inspection of OLAF is consequently reduced. (14) On the contrary, a general prohibition on copying data without a prior examination would appear to be an inappropriate and thus an unjustified obstacle to the exercise of OLAF powers of inspection which would exceed what is necessary to protect the rights of the undertakings concerned. Such a prohibition would therefore unduly restrict the effectiveness of investigations as a necessary tool to enable OLAF to exercise its role in the fight against fraud, corruption or any other illegal activity affecting the financial interests of the Union. (15)

76.      In those circumstances, I see no reason why OLAF could not decide, depending on the circumstances, to examine the data contained on the digital data carrier of the undertaking under inspection not by reference to the original, but by reference to a ‘copy-image’ of that data. Indeed, as the Court recently ruled for a similar procedure conducted by the Commission under Regulation No 1/2003, ‘the Commission subjects the same data to examination, both where the original data is examined and where the copy of such data is examined.’ (16)

77.      It is true that, contrary to Article 7 of Regulation No 2185/96 and Article 3(3) of Regulation No 883/2013, Article 20(2) of Regulation No 1/2003 does not refer to national legislation when the Commission is called upon to implement its powers of inspection in competition matters. However, as I have already indicated, on the one hand, it is not alleged, in the present case, that the applicable national law has been infringed and, on the other hand, the very principle of access to computer data of a controlled undertaking is expressly authorised in Article 7(1) of Regulation No 2185/96.

78.      Thus, contrary to the appellant’s submissions and adopting the Court’s analysis in the judgment of 16 July 2020, Nexans France and Nexans v Commission (C‑606/18 P, EU:C:2020:571, paragraph 63), OLAF’s right to access sets of emails, the hard drive of a laptop or the data stored on the server of the controlled company, and to make a copy-image (that is to say a ‘digital forensic image’), constitutes an intermediate step in the examination of the data contained in those sets and on those media. Under such an approach, documents constituting possible evidence are separated from the remaining data in sifting operations which follows the making of the digital forensic image. (17) Such ‘copying’ for sifting purposes does not therefore constitute any greater intervention than the sifting itself. This does not, as such, constitute an additional power granted to OLAF, but, as the General Court correctly stated in paragraph 73 of the judgment under appeal, falls within the power of examination which Article 7(1) of Regulation No 2185/96 makes available to OLAF and may be necessary for the proper conduct of the on-the-spot check in question.

79.      Naturally, such copying of data without prior examination should be permitted if OLAF then assesses whether the data are relevant to the subject matter of the inspection, in strict compliance with the rights of defence of the undertaking concerned, before those documents found to be relevant are placed in the file and the remainder of the copied data is deleted. (18)

80.      When questioned about the latter guarantee at the hearing of 10 February 2021, the Commission expressly confirmed that the irrelevant data were indeed destroyed after a certain period of time, although this was disputed by the appellant’s representatives. It is true that there is no express rule in that regard in the Guidelines on Digital Forensic Procedures. It may be noted, however, that the Digital Forensic Operations Information Leaflet of OLAF states that OLAF will retain the data for a maximum of 15 years after the closure of the investigation. Furthermore, it follows from Article 10 of the Guidelines on Digital Forensic Procedures that, if the investigation unit of OLAF wishes to re-acquire a digital forensic image acquired in the context of a different investigation, it must submit a new request for the Director-General’s authorisation in accordance with the same criteria as those required for authorising a digital forensic operation within inspections of premises or on-the-spot checks and in compliance with full information of the person or economic operator concerned. These are important – and necessary – safeguards.

81.      It is important to emphasise that those investigatory powers have been conferred on OLAF by reason of the specific nature of modern, advanced technological devices which are capable of storing vast amounts of data. That very technological capacity requires access in principle to everything, so that the search can then be refined by reference, for example, to appropriate keywords. It is important to be clear about this: while OLAF must of necessity have access in principle to everything for the purpose of a data search, it must also respect the legitimate interests of the undertaking concerned so far as the privacy and confidentiality of non-relevant documentation is concerned. Any abuse of those powers – such as, for example, the improper disclosure of data so gathered to third parties – would represent a very grave breach of the rights of defence of the person concerned and would be likely to have exceptionally serious consequences for both OLAF and its officials. In fairness, it is only proper to acknowledge in the present case that nothing of the kind has been alleged. In those circumstances, for the reasons I have just given, I would propose that the first two parts of the first ground of appeal be dismissed.

(b)    Third part

82.      By the third part of its first plea in law, Vialto challenges the statements made by the General Court in paragraphs 77 and 79 of the judgment under appeal, according to which, first, its arguments based on respect for professional secrecy and on the clauses of contracts concluded with its commercial partners are irrelevant for the purposes of the Union’s non-contractual liability and, second, OLAF cannot be regarded as having compelled it to infringe that secrecy or those clauses.

83.      First of all, contrary to the Commission’s submission, I do not think that the first complaint in support of the third part of the first ground of appeal constitutes a new plea in law and, as such, should be rejected as inadmissible.

84.      It is true that, in an appeal, the Court’s jurisdiction is, as a general rule, confined to a review of the assessment by the General Court of the pleas argued before it. However, an argument which was not raised at first instance does not constitute a new plea that is inadmissible at the appeal stage if it is simply an amplification of an argument already developed in the context of a plea set out in the application before the General Court. (19)

85.      However, it is apparent from paragraph 77 of the judgment under appeal that, from the outset, the appellant relied on the argument related to professional secrecy and the clauses of contracts concluded with its commercial partners to justify its refusal to communicate some of the data requested by OLAF. In that context, it is obvious that the ‘reformulation’ of that argument under the concept of abuse of right is only an amplification of an argument already developed before the General Court. As the General Court would have incorrectly assessed it, such a ground of appeal is merely a continuation of an argument already developed in a plea in law in the application before the General Court. That part of the first ground of appeal must therefore be declared admissible.

86.      Nevertheless, the argument seems to me to be ineffective. Indeed, it forms part of the more general argument that Vialto suffered damage as a result of OLAF’s infringement of Article 7(1) of Regulation No 2185/96 by collecting information unrelated to the inspection. For my part, I consider that the General Court did not commit any error of law when it upheld the exercise by OLAF of its powers of inspection. Furthermore, it is apparent from the file that OLAF had proposed, in the context of that inspection, to apply in respect of the appellant’s data the special procedure reserved for data of a legally privileged nature. (20) In those circumstances, it appears to me that, in any event, the appellant’s argument based on professional secrecy and on its contractual clauses could not have led to a finding of sufficiently serious breach of a rule of law intended to confer rights on it. Consequently, that argument is ineffective.

87.      The second complaint alleged by the appellant in the third part of the first ground of appeal is also ineffective. With that complaint, Vialto submits that, contrary to what the General Court held in paragraph 79 of the judgment under appeal, it never maintained that OLAF had compelled it to infringe professional secrecy and certain contractual clauses. According to the appellant, the General Court ruled on an argument which was not put forward and the paragraph of the judgment under appeal at issue should, for that reason alone, be annulled. However, the complaint must be considered to be ineffective, since in paragraph 79 of the judgment under appeal, the General Court rejected an argument that would not have been put forward. Furthermore, it follows from the use, in that paragraph of the judgment under appeal, of the expression ‘in any event’, that the assessment made by the Court in that paragraph was made from an abundance of caution, in the event that it were to be held that Vialto could rely on the argument of professional secrecy and on the clauses of its contracts to justify its refusal to grant access to certain information.

88.      Consequently, the first ground of appeal must be dismissed as, in part, unfounded and, in part, ineffective.

B.      Second ground of appeal alleging breach of the principle of the protection of legitimate expectations

1.      Arguments of the parties

89.      By its second ground of appeal, Vialto submits that the General Court erred in law and that it furnished insufficient reasons for its judgment as regards the alleged breach of the principle of the protection of legitimate expectations.

90.      First, the judgment under appeal suffers from an inadequate statement of reasons, in that it does not explain which of the three conditions necessary to rely on the principle of legitimate expectations would not be met in the present case and, moreover, does not examine any of the three conditions.

91.      Secondly, paragraph 118 of the judgment under appeal is allegedly vitiated by an error of law, since it disregards the case-law prohibiting the retroactive withdrawal of an administrative act – whether lawful or unlawful – which confers individual rights or similar benefits. Yet, the assurances given by OLAF investigators on the first day of the inspection concerning the procedure for carrying out the inspection would have been lawful. Therefore, OLAF agents could not have revoked those assurances a posteriori and demanded that the on-the-spot check be carried out as if such assurances had never been given.

92.      Third, the appellant argues that the General Court erred in law by holding, at the same paragraph in the judgment under appeal, that Vialto cannot rely on a breach of legitimate expectations placed in the application of a practice derogating from a rule in its favour where it acted in bad faith. However, the appellant considers that OLAF’s requests were contrary to Article 7(1) of Regulation No 2185//96, that it had already stated its position from the first day of the inspection and that, if OLAF agents had considered that it was unlawfully obstructing their investigation, they should have sought the assistance of the national authorities in accordance with Article 9 of that regulation. In those circumstances, Vialo considers that no bad faith could have been shown on its part.

93.      The Commission concludes that the second ground of appeal must be rejected.

94.      First, the General Court gave sufficient reasons for its conclusion that there had been no breach of the principle of the protection of legitimate expectations. Second, the appellant does not explain what the assurances allegedly given by OLAF were about and, in any case, the confidence alleged by Vialto was undermined by its own conduct. Third, the invocation of the principles relating to the revocation of administrative acts in the present case is ineffective and, in any event, unfounded since the carrying out of an on-the-spot check by OLAF would not constitute an administrative act or, in any event, an administrative act conferring individual rights or similar benefits.

2.      Analysis

95.      In support of its second ground of appeal, Vialto presents three arguments: first, a failure by the General Court to state reasons in its assessment of the argumentation related to the principle of the protection of legitimate expectations; second, the prohibition on withdrawing a lawful administrative act conferring individual rights or similar benefits; and third, an error of law in its assertion that Vialto cannot rely on a breach of legitimate expectations placed in the application of a practice derogating from the usual inspection procedure by reason of its refusal to accede to the legal request from OLAF.

96.      I propose to deal with those arguments together as they are all intrinsically linked to the preliminary question of the existence of a ‘legitimate expectation’ on the part of Vialto. As the General Court correctly pointed out at paragraph 114 of the judgment under appeal, the right to rely on the principle of the protection of legitimate expectations presupposes that precise, unconditional and consistent assurances originating from authorised, reliable sources have been given to the person concerned by the competent authorities of the European Union. By contrast, a person may not plead a breach of that principle unless he or she has been given those assurances. (21) Furthermore, those assurances must be such as to give rise to a legitimate expectation (‘attente légitime’) on the part of the person to whom they are given. (22)

97.      Likewise, the prohibition to withdraw an administrative act is justified by the need to meet the legitimate expectations of the beneficiary of the measure concerned. (23) In other words, the revocation of an administrative act is barred only if the person in favour of whom the decision was made had a legitimate expectation that the decision finally settled the matter. (24)

98.      Accordingly, if it were to appear that that condition was not met in the present case – which I believe it was – the last two arguments put forward by the appellant in support of its second ground of appeal would be unfounded. Any failure by the General Court to state reasons would then have no effect on the soundness of its rejection of Vialto’s argument relating to the principle of protection of legitimate expectations and would therefore be ineffective.

99.      First of all, it must be recalled that the right to rely on the principle of the protection of legitimate expectations extends, as a corollary of the principle of legal certainty, to any individual in a situation where European Union authorities have caused him or her to entertain legitimate expectations (‘espérances fondées’). In whatever form it is given, information which is precise, unconditional and consistent and comes from authorised and reliable sources constitutes assurances capable of giving rise to such expectations. However, a person may not rely upon a breach of the principle unless he or she has been given precise assurances by the administration. (25)

100. It is therefore essential to determine what legitimate expectations were given by OLAF to Vialto in the present case. In other words, what precise, unconditional and consistent assurances did Vialto receive from OLAF in relation to the disputed digital forensic operation?

101. In its appeal, Vialto itself states that the General Court mentioned, in paragraph 116 of the judgment under appeal, what the assurances given by the OLAF investigators were about. However, according to that paragraph, OLAF investigators agreed, in order to meet concerns expressed by the appellant, to derogate from the procedure laid down in the Guidelines on Digital Forensic Procedures as regards, first, the place of obtaining and processing of the digital medium containing the digital forensic images produced and, second, in respect of the said medium itself.

102. This is confirmed by the reports on the on-the-spot check of Vialto on 12 and 13 April 2016 and their summary in paragraphs 52 and 53 of the judgment under appeal, which are undisputed by the appellant. While precise, unconditional and consistent assurances were therefore given by OLAF investigators, it must be said that their scope was strictly limited to the place where the processing of data by keywords and the medium used for this indexing and searching process would be carried out. At no time did OLAF investigators imply that they agreed to comply with the appellant’s wish to separate beforehand the data relating to the project at issue from those that were not. On the contrary, it results clearly from the abovementioned reports – signed by one of the managing directors of Vialto – that the first step in the process would be to perform digital forensic copies of the hard disk drives and preselected folders from the server, without any limitations being specified in this respect.

103. In those circumstances, the argument that OLAF breached the legitimate expectations of Vialto by deciding to terminate the digital forensic operation after Vialto refused to cooperate fully with the investigation by refusing, inter alia, to provide financial information relevant for the investigation cannot be sustained. Indeed, the protection of legitimate expectations is simply designed to ensure that public authorities honour lawful commitments that they have made and behave in accordance with the expectations they have raised, (26) no more and no less. In this respect, giving effect (where appropriate) to the principle of legitimate expectations is no more than the practical effectuation of the guarantee of good administration in Article 41 of the Charter of Fundamental Rights of the European Union (‘the Charter’). In the present case, however, those expectations could not legitimately relate to anything other than the taking of the first digital forensic copies on the undertaking’s premises, the indexing and sorting of data on those same premises and in this context, using the equipment provided by Vialto.

104. The General Court therefore did not err in law when it held, in paragraph 118 of the judgment under appeal, that Vialto cannot rely on a sufficiently serious breach of the principle of the protection of legitimate expectations which it had placed in the application of a practice derogating in its favour, despite its refusal to accede to the requests made in accordance with Article 7(1) of Regulation No 2185/96 and with the Guidelines on Digital Forensic Procedures, made by the agents of OLAF.

105. Furthermore, while that paragraph of the judgment under appeal is not perhaps a model of clarity, it is nonetheless soundly based on references to the conditions governing the principle of the protection of legitimate expectations and a clear description of what might be termed the derogation proposal made by OLAF. It can thus be understood that the argument relating to the protection of legitimate expectations invoked by Vialto was rejected by the General Court in the absence of Vialto having received precise assurances on the limitation of the digital forensic operation sensu stricto.

106. Any failure to state reasons in that regard would in any event have no bearing on the merits of its rejection of the argument and, therefore, on the operative part of the judgment under appeal. The alleged failure to state reasons should therefore be regarded as ineffective. (27)

107. Consequently, I am of the view that the second ground of appeal must be rejected.

C.      Third ground of appeal alleging breach of the right to be heard

1.      Arguments of the parties

108. By its third ground of appeal, the appellant puts forward a series of arguments criticising the General Court’s reasoning on the right to be heard.

109. First, the findings in paragraph 121 of the judgment under appeal, concerning the fact that it was allegedly heard by OLAF, are not relevant to the examination of the question whether its right to be heard was infringed by DG Enlargement. Second, the General Court distorted the facts by stating, in paragraphs 94 and 122 of the judgment under appeal, that the position taken by DG Enlargement was not binding on the CFCU. As the General Court admitted in paragraph 93 of the judgment under appeal, it appears from the file that that DG had addressed a request to the CFCU inviting it to adopt the necessary measures with regard to Vialto on account of the latter’s breach of its contractual obligations. Such a request would have been binding on the CFCU. Such a distortion of the facts would have led to an incorrect application of the law by the General Court. The General Court should have concluded that DG Enlargement was under an obligation to hear Vialto before applying to the CFCU for the adoption of the necessary measures provided for in the contract in question in view of Vialto’s breach of its contractual obligations. Third, the right to be heard of Vialto should also have been respected by DG Enlargement in the context of its recommendation to suspend the performance of the contract in question or the part of the contract performed by Vialto. Indeed, relying on the judgment of 4 April 2019, OZ v EIB (C‑558/17 P, EU:C:2019:289), the appellant argues that the right to be heard should also be respected where an EU institution makes non-binding recommendations.

110. The Commission agrees with the approach to the right to be heard adopted by the General Court and submits that the third plea in law should be rejected.

2.      Analysis

111. By its third ground of appeal, the appellant invokes a series of arguments which are not clearly intertwined, under the guise of errors of law and distortion of the facts. Three arguments have in substance been advanced. First, Vialto contests the relevance given by the General Court, in considering whether its right to be heard was infringed by DG Enlargement, to the fact that it had been heard by OLAF. Second, it criticises the General Court for distorting the facts by stating that the position of DG Enlargement on the measures to be taken vis-à-vis Vialto and communicated to the CFCU was not binding on it, which would have led to an incorrect application of the law. Third, Vialto argues that its right to be heard has not been respected by DG Enlargement also in the context of its invitation to suspend the execution of the contract in question or the part of the contract executed by Vialto.

112. In relation to the second argument, it appears from the uncontested paragraph 89 of the judgment under appeal that, in its letter of 13 October 2016, DG Enlargement informed the CFCU that it considered that the appellant’s refusal to cooperate with OLAF’s investigation placed Vialto in breach of Article 25(2) and (3) of the general conditions and that, in this context, it invited the CFCU to take appropriate measures under the same general conditions in relation to the breach of the contract. It added, in that connection, that the CFCU could consider, as one of the practical possibilities, the suspension of the execution of the contract in question or of the part executed by the appellant.

113. As the appellant acknowledges in its appeal, it follows expressly from the correspondence of DG Enlargement of 13 October 2016 referred to above and also from the letter of the CFCU of 11 November 2016, that the Commission invited it to adopt appropriate measures in relation to the breach of the contract. More than a simple formula, these terms reflect the rules governing a contract concluded under an IPA and the division of competences between the intervening authorities.

114. While the Commission retains overall final responsibility for the general budget, it is the operating structure which is responsible for managing and implementing the programme concerned in accordance with the principle of sound financial management. (28) This has already been pointed out by the Court in its case-law. Indeed, ‘public contracts awarded by non-member countries and capable of benefiting from assistance under the IPA, subject to the principle of decentralised management, remain national contracts which only the national contracting authority responsible for following them through has the power to prepare, negotiate and conclude, the involvement of the Commission representatives in the procedure for the award of those contracts being confined solely to establishing whether or not the conditions for European Union financing are met. Moreover, the undertakings that submit tenders which are awarded the contract in question have legal relations only with the non-member country which is responsible for the contract and the measures adopted by representatives of the Commission cannot have the effect of substituting, in relation to them, a European Union decision for the decision of that non-member country’. (29)

115. In the light of the foregoing considerations, I find myself unable to conclude that there has been any distortion of facts or error of law in paragraphs 94 and 122 of the judgment under appeal, in which the General Court held that the decision to exclude the appellant from the contract in question was taken by the CFCU, without the CFCU being bound by a position adopted to that effect by DG Enlargement.

116. At the same time, irrespective of this absence of contractual relationship between the Commission and Vialto, the question as to whether the former should have heard the appellant before communicating its suggestions to the CFCU is nonetheless a separate one.

117. Article 41(2) of the Charter provides that the right to good administration includes, first, the right of every person to be heard before any individual measure which would affect him or her adversely is taken, second, the right of every person to have access to his or her file, while respecting the legitimate interests of confidentiality and of professional and business secrecy and, third, the obligation on the administration to give reasons for its decisions. In particular, the right to be heard guarantees every person the opportunity to make known his or her views effectively during an administrative procedure and before the adoption of any decision liable to affect his or her interests adversely. (30)

118. In the present case, irrespective of the fact that the decision to exclude Vialto from the contract in question was taken by the CFCU and not by the Commission, it can hardly be maintained that the invitation made by the Commission to the CFCU to adopt appropriate measures in respect of Vialto’s breach of the contract in question, together with its decision to consider that the amount paid for Vialto’s services within that contract as ineligible for EU funding, is not a decision liable to affect its interests adversely within the meaning of Article 41(2) of the Charter. It is perfectly clear that even if the actual decision was taken by the CFCU, the Commission’s intervention was an important – perhaps even a decisive – step in this process.

119. Furthermore, although it is indisputable that OLAF exercises its powers of investigation in complete independence from the Commission, any government or any other institution or body, (31) it nevertheless follows from Regulation No 883/2013 that, at the end of its investigations, OLAF enjoys only a power of recommendation. Indeed, according to Article 11(1) of Regulation No 883/2013, when it concludes an investigation, a report must be drawn up. That report is then accompanied by recommendations of the Director-General on whether or not action should be taken by the institutions, bodies, offices and agencies and by the competent authorities of the Member States concerned. In the case of an external investigation, Article 11(3) of Regulation No 883/2013 specifies that reports and recommendations must be sent to the competent authorities of the Member States concerned and, if necessary, to the competent Commission services.

120. In that legal framework, it is therefore clear that a person or undertaking under investigation by OLAF must, in principle, be heard both by OLAF and by the Union institution, body, office or agency or competent authority of a Member State to which the report and recommendations are addressed, since it is those institutions and Member State bodies which will eventually take the decision that would adversely affect them. (32)

121. Nevertheless, it should not be overlooked, on the one hand, that the infringement of the right to be heard – as for other rights of the defence – must be examined in relation to the specific circumstances of each particular case, (33) and, on the other hand, that this specific right has a dual purpose. First, it serves to investigate the case and, as such, promote the interests of good administration by ensuring that the administrative body concerned establishes the facts as accurately and correctly as possible. Second, it makes it possible to ensure effective protection of the person concerned. (34)

122. According to the Court, the purpose of the rule that the addressee of an adverse decision must be placed in a position to submit his or her observations before the decision is adopted is to enable the competent authority effectively to take into account all relevant information. In order to ensure that the person or undertaking concerned is in fact protected, the purpose of that rule is, inter alia, to enable them to correct an error or submit such information relating to their personal circumstances as will argue in favour of the adoption or non-adoption of the decision, or in favour of it having a specific content. (35)

123. In the present case, it follows from the judgment under appeal and from the appeal of Vialto that the Commission’s act in respect of which Vialto considers that it should have been heard before its adoption is the letter sent to the CFCU on 13 October 2016. (36) In that letter, DG Enlargement informed the CFCU that, despite the obligations provided for in Article 25 of the general conditions, Vialto did not consent to OLAF’s access to the information it needed to carry out its investigations by invoking certain confidentiality clauses and its own interpretation of the contract in question.

124. It is true that this factual information was already included in the on-the-spot check reports. In this regard, as the General Court correctly held in paragraph 121 of the judgment under appeal, the appellant was indeed given the opportunity to contest and comment on the elements contained in those reports by letter of 6 May 2016. Vialto was also able, by its letter of 23 September 2016, to submit its observations on OLAF’s letter of 14 September 2016 informing it that it was considered to be a person concerned by the investigation into the suspicions of corruption or fraud in respect of the project in question. However, it does not appear either from the judgment under appeal, or from the file submitted to the Court, or from the answers given by the Commission to the questions raised on this subject at the hearing of 10 February 2021, that DG Enlargement was aware of those documents or, a fortiori, of the defence arguments developed by the appellant therein when it sent the contested letter to the CFCU on 13 October 2016. In those specific circumstances, I am therefore obliged to find that it cannot be asserted that the Commission has had the opportunity effectively to take into account all relevant information relating to Vialto’s personal situation at the time it wrote to the CFCU inviting it to take certain contractual measures.

125. Consequently, I find myself obliged to conclude that the General Court erred in law in deciding in paragraph 122 of the judgment under appeal that Vialto could not rely on an obligation on the part of the Commission to hear it in its observations because the adoption of the decision excluding it from the contract in question had been taken by the CFCU and not by it.

126. I am therefore of the view that the third ground of appeal relied on by Vialto in support of its appeal must be upheld in so far as it alleges a breach of its right to be heard by the Commission. The appeal must be allowed and the judgment under appeal should be set aside in so far as it held that the appellant could not rely on an obligation on the part of the Commission to hear it in its observations before the decision of the CFCU excluding it from the contract in question was adopted.

VII. The action before the General Court

127. In accordance with Article 61 of the Statute of the Court of Justice of the European Union, if the appeal is well founded, the Court may, if it quashes the decision of the General Court, give final judgment in the action, where the state of the proceedings so permits.

128. That is the position in the present case.

129. Indeed, as correctly recalled by the General Court in paragraph 34 of the judgment under appeal, the European Union’s non-contractual liability under the second paragraph of Article 340 TFEU is subject to the satisfaction of a number of conditions, namely the unlawfulness of the conduct alleged against the EU institution, the establishment of actual damage and the existence of a causal link between the conduct of the institution and the damage complained of. (37)

130. This last condition relating to a causal link concerns a sufficiently direct causal nexus between the conduct of the EU institutions and the damage, the burden of proof of which rests on the applicant, so that the conduct complained of must be the determining cause of the damage. (38)

131. However, in the light of the foregoing considerations, given that I have come to the conclusion that the General Court did not distort the facts or err in law when it held that the decision to exclude the appellant from the contract in question had been taken by the CFCU, without the CFCU being bound by a position adopted to that effect by DG Enlargement, it cannot be held that the conduct of which the Commission is accused was the determining cause of the damage alleged by Vialto.

132. Consequently, since the Court has previously held that if any one of the conditions required for the European Union’s non-contractual liability to incur is not satisfied, the action must be dismissed in its entirety and it is unnecessary to consider the other conditions for non-contractual liability on the part of the European Union (39), it must be admitted that the claim for compensation brought by the appellant should, necessarily and in any event, be rejected.

VIII. Costs

133. Under Article 184(2) of the Rules of Procedure of the Court of Justice, where the appeal is well founded and the Court itself gives final judgment in the case, the Court is to make a decision as to costs.

134. Under Article 138(3) of the Rules of Procedure, which is also applicable to appeal proceedings by virtue of Article 184(1) thereof, where each party succeeds on some and fails on other heads, the parties are to bear their own costs. However, if it appears justified in the circumstances of the case, the Court of Justice may order that one party, in addition to bearing its own costs, to pay a proportion of the costs of the other party.

135. In the present instance, given that the judgment under appeal should be set aside in part but that the claim for compensation should be rejected, it seems to be appropriate to decide that the appellant and the Commission should each bear their own costs in relation to both proceedings at first instance and the appeal proceedings.

IX.    Conclusion

136. In the light of the foregoing considerations, I propose that the Court should:

–        set aside the judgment of the General Court of the European Union of 26 June 2019, Vialto Consulting v Commission (T‑617/17, not published, EU:T:2019:446) in so far as it held that the appellant could not rely on an obligation on the part of the Commission to hear it in its observations before the decision of the CFCU excluding it from the contract in question was adopted;

–        dismiss the appeal as to the remainder;

–        dismiss the action brought by Vialto Consulting seeking compensation for the damage allegedly suffered as a result of allegedly unlawful conduct on the part of the European Commission and the European Anti-Fraud Office (OLAF) in connection with its exclusion from the contract for the provision of services bearing the reference TR2010/0311.01-02/001

–        order Vialto Consulting and the European Commission to bear their own costs in relation to both the proceedings at first instance and the appeal proceedings.

1      Original language: English.

2      OJ 1996 L 292, p. 2.

3      OJ 2007 L 170, p. 1.

4      OJ 2013 L 248, p. 1.

5      OJ 2006 L 10, p. 82.

6      OJ 2003 L 1, p. 1.

7      Emphasis added.

8      While Regulation No 2185/96 refers to Commission inspectors, this competence is now exercised by OLAF in accordance with Article 2 of Commission Decision 1999/352 establishing the European Anti-Fraud Office (OLAF) (OJ 1999 L 136, p. 20) and Article 3(1) of Regulation No 883/2013.

9      COM(2018) 338 final.

10      Report from the Commission to the European Parliament and the Council entitled ‘Evaluation of the application of [Regulation No 883/2013]’ (COM(2017) 589 final).

11      See Final report of the evaluation of the application of Regulation No 883/2013, 4.2.2.4. Concluding remarks (p. 97 in the version in English). As a reminder, Article 3(2) of Regulation No 883/2013 expressly states that it is in accordance with the provisions and procedures laid down by Regulation No 2185/96, that OLAF may conduct on-the-spot checks and inspections on economic operators.

12      See Article 1.9 of the Guidelines on Digital Forensic Procedures.

13      According to Article 8.4 of the Guidelines on Digital Forensic Procedures, ‘When the forensic work file is available, the investigator shall launch written request through the CMS Intelligence Request Module to index the forensic work file … In response to the investigator’s written request and in conjunction with the investigator the [Digital Evidence Specialist of OLAF staff] shall extract data matching the search criteria from the digital forensic work file for read-only access by the investigator’.

14      See, to that effect, judgment of 16 July 2020, Nexans France and Nexans v Commission (C‑606/18 P, EU:C:2020:571, paragraph 66). Having said that, it must be noted that the possibility for OLAF to continue its examination of data related to the business of an undertaking outside of the premises of the latter is subject to the condition that such continuation does not give rise to any infringement of the rights of the defence and does not constitute an additional encroachment on the rights of the undertakings concerned which goes further than that inherent in an inspection at their premises. OLAF may act in this way when it can legitimately take the view that it is justified to do so in the interests of the effectiveness of the inspection or to avoid excessive interference in the operations of the undertaking concerned (see, to that effect, judgment of 16 July 2020, Nexans France and Nexans v Commission, C‑606/18 P, EU:C:2020:571, paragraphs 87 and 90).

15      See, by analogy (as regards the Commission’s power of investigation in competition matters under Regulation No 1/2003), Opinion of Advocate General Kokott in Nexans France and Nexans v Commission (C‑606/18 P, EU:C:2020:207, point 66).

16      Judgment of 16 July 2020, Nexans France and Nexans v Commission (C‑606/18 P, EU:C:2020:571, paragraph 62).

17      See Article 8.4 of the Guidelines on Digital Forensic Procedures quoted in footnote 13. The ‘Digital Forensic Operations Information Leaflet’ of OLAF also recalls that ‘any data relevant to the investigation will be identified by keyword searches and other search methods [and o]nly these data will be placed in the case file’.

18      See, to that effect, judgment of 16 July 2020, Nexans France and Nexans v Commission (C‑606/18 P, EU:C:2020:571, paragraph 64).

19      See, to that effect, judgment of 9 December 2020, Groupe Canal + v Commission (C‑132/19 P, EU:C:2020:1007, paragraph 28).

20      See Article 6.3 of the Guidelines on Digital Forensic Procedures.

21      Judgment of 16 July 2020, ADR Center v Commission (C‑584/17 P, EU:C:2020:576, paragraph 75 and the case-law cited).

22      See, to that effect, judgment of 25 March 2010, Sviluppo Italia Basilicata v Commission (C‑414/08 P, EU:C:2010:165, paragraph 107).

23      See, to that effect, judgments of 26 February 1987, Consorzio Cooperative d'Abruzzo v Commission (15/85, EU:C:1987:111, paragraph 12); and of 20 June 1991, Cargill v Commission (C‑248/89, EU:C:1991:264, paragraph 20 and the case-law cited).

24      Schønberg, S. J., ‘Legal Certainty and Revocation of Administrative Decisions: A Comparative Study of English, French and EC Law’, Yearbook of European Law, vol. 19, Issue 1, 1999, p. 257 to 298, esp. p. 291. See also Ragnemalm, H., ‘Confiance légitime et délai raisonnable’, in Mélanges en hommage à Fernand Schockweiler, Nomos Verlagsgesellschaft, Baden-Baden, 1999, p. 511 to 522, esp. p. 517 and 518.

25      Judgment of 3 December 2019, Czech Republic v Parliament and Council (C‑482/17, EU:C:2019:1035, paragraph 153).

26      See, to that effect, Gautron, J.-C., ‘Le principe de protection de la confiance légitime’, in Le droit de l’Union européenne en principes. Liber amicorum en l’honneur de Jean Raux, Apogée, Rennes, 2006, p. 199 to 218, esp. p. 210.

27      See, to that effect, judgment of 22 September 2020, Austria v Commission (C‑594/18 P, EU:C:2020:742, paragraphs 47 and 50).

28      See Articles 10(1) and 28(2) of Regulation No 718/2007.

29      Order of 4 July 2013, Diadikasia Symvouloi Epicheiriseon v Commission and Others (C‑520/12 P, not published, EU:C:2013:457, paragraph 34 and the case-law cited).

30      See, to that effect, judgments of 4 April 2019, OZ v EIB (C‑558/17 P, EU:C:2019:289, paragraphs 52 and 53); and of 25 June 2020, SatCen v KF (C‑14/19 P, EU:C:2020:492, paragraphs 116 and 117).

31      See Article 3 of Commission Decision 1999/352.

32      See, by analogy, within the context of a procedure which includes recommendations from an internal committee of an EU institution, judgment of 4 April 2019, OZ v EIB (C‑558/17 P, EU:C:2019:289, paragraph 56).

33      See, to that effect, judgment of 25 October 2011, Solvay v Commission (C‑110/10 P, EU:C:2011:687, paragraph 63).

34      See, to that effect, judgment of 4 June 2020, EEAS v De Loecker (C‑187/19 P, EU:C:2020:444, paragraph 69).

35      See, to that effect, judgment of 3 July 2014, Kamino International Logistics and Datema Hellmann Worldwide Logistics (C‑129/13 and C‑130/13, EU:C:2014:2041, paragraph 38).

36      See paragraph 89 of the judgment under appeal and paragraph 73 of Vialto’s appeal. The two other letters referred to in that paragraph are not Commission documents but a letter dated of 11 November 2016 sent by the CFCU to the consortium and a letter of 10 January 2017 sent by the CFCU to Vialto.

37      See, to that effect, judgments of 14 October 2014, Giordano v Commission (C‑611/12 P, EU:C:2014:2282, paragraph 35), and of 5 September 2019, European Union v Guardian Europe and Guardian Europe v European Union (C‑447/17 P and C‑479/17 P, EU:C:2019:672, paragraph 147).

38      See, to that effect, judgments of 13 December 2018, European Union v Gascogne Sack Deutschland and Gascogne (C‑138/17 P and C‑146/17 P, EU:C:2018:1013, paragraph 22), and of 5 September 2019, European Union v Guardian Europe and Guardian Europe v European Union (C‑447/17 P and C‑479/17 P, EU:C:2019:672, paragraph 32).

39      See, to that effect, judgment of 5 September 2019, European Union v Guardian Europe and Guardian Europe v European Union (C‑447/17 P and C‑479/17 P, EU:C:2019:672, paragraph 148).

© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.