Kočner v EUROPOL (Appeal - Europol - Protection of personal data - Europol - Opinion) [2023] EUECJ C-755/21P_O

1.

By his appeal, Mr Marián Kočner (‘the appellant’) asks the Court of Justice to set aside the judgment of the General Court of 29 September 2021, Kočner v Europol (T‑528/20, not published, the judgment under appeal, EU:T:2021:631), by which the General Court dismissed his action seeking compensation for the non-material damage which he claims to have suffered on account of the infringement of his right to respect for private and family life resulting, in essence, from data processing operations by the European Union Agency for Law Enforcement Cooperation (Europol) in the context of a criminal investigation initiated in respect of him by the Slovak authorities following the murder of a journalist and the journalist’s fiancée.

2.

This appeal affords the Court its first opportunity to rule, among other things, on the nature of Europol’s non-contractual liability under Articles 49 and 50 of Regulation (EU) 2016/794, ( 2 ) interpreted in the light of recital 57 of that regulation, and, specifically, on the existence of the special system of joint and several liability between Europol and the Member State in which damage has occurred as a result of incorrect data processing by Europol or that Member State.

3.

Recitals 56, 57 and 65 of the Europol Regulation state:

…

4.

Under Article 17(1) of the Europol Regulation, Europol is only to process information that has been provided to it, inter alia, by Member States in accordance with their national law and Article 7 of that regulation. Under Article 17(2), Europol may directly retrieve and process information, including personal data, from publicly available sources, including the internet and public data.

5.

Article 32 of that regulation, entitled ‘Security of processing’, provides in paragraph 1:

‘Europol shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, accidental loss or unauthorised disclosure, alteration and access or any other unauthorised form of processing.’

6.

Article 49 of the Europol Regulation, entitled ‘General provisions on liability and the right to compensation’, provides in paragraph 3:

‘Without prejudice to Article 49, [ ( 4 )] in the case of non-contractual liability, Europol shall, in accordance with the general principles common to the laws of the Member States, make good any damage caused by its departments or by its staff in the performance of their duties.’

7.

Article 50 of that regulation, entitled ‘Liability for incorrect personal data processing and the right to compensation’, provides:

‘1.   Any individual who has suffered damage as a result of an unlawful data processing operation shall have the right to receive compensation for damage suffered, either from Europol in accordance with Article 340 TFEU or from the Member State in which the event that gave rise to the damage occurred, in accordance with its national law. The individual shall bring an action against Europol before the Court of Justice of the European Union, or against the Member State before a competent national court of that Member State.

2.   Any dispute between Europol and Member States over the ultimate responsibility for compensation awarded to an individual in accordance with paragraph 1 shall be referred to the Management Board, which shall decide by a majority of two-thirds of its members, without prejudice to the right to challenge that decision in accordance with Article 263 TFEU.’

8.

In the course of an investigation conducted by the Slovak criminal authorities following the murder in Slovakia, on 21 February 2018, of a journalist and his fiancée, Europol, at the request of the Národná kriminálna agentúra (National Crime Agency, Slovakia; ‘NAKA’), took possession, on 10 October 2018, of two mobile telephones allegedly belonging to the appellant and, on 17 October 2018, of a USB storage device.

9.

With regard to the mobile telephones, on 21 June 2019, Europol forwarded to NAKA the final scientific reports on the operations carried out on those telephones. According to Europol, the forwarding of those reports was preceded, first, by the delivery to NAKA of a hard drive containing the encrypted data retrieved from the telephones, certified by an official record of 23 October 2018 (‘the official record of 23 October 2018’), and, second, by the return of the telephones in question to NAKA, certified by a receipt/delivery of evidence form of 13 February 2019. ( 5 )

10.

Information concerning the appellant originating from those mobile telephones, including transcripts of private conversations, were made available to the public as a result of a number of articles published in the press and one item published on a website in May 2019.

11.

With regard to the USB storage device, in its report of 13 January 2019 sent to NAKA on 14 February 2019, Europol stated that the appellant had been in custody since 20 June 2018 for suspected financial crime and that his name was, inter alia, directly linked to the ‘so-called mafia lists’ and the ‘Panama Papers’. ( 6 )

12.

By letter of 4 May 2020, the appellant claimed compensation from Europol, under Article 50(1) of the Europol Regulation, in the amount of EUR 100000 for the non-material damage which he claims to have suffered as a result of, first, the publication in the press and on the internet of personal data and, in particular, the publication of transcripts of conversations of a private and sexual nature, and, second, the inclusion of his name on the ‘mafia lists’, which was reported by the press after a series of leaks involving the case file in the national criminal proceedings for the murder mentioned in point 8 of this Opinion.

13.

Following the investigation carried out by the Slovak criminal authorities, referred to in point 8 of this Opinion, the appellant, who was prosecuted for complicity in murder for having ordered the killings, was acquitted at first instance by a judgment that was subsequently quashed by the Najvyšší súd Slovenskej republiky (Supreme Court of the Slovak Republic), which referred the case back to the first-instance court.

14.

By document lodged at the Court Registry on 18 August 2020, the appellant brought an action under Articles 268 and 340 TFEU and Article 50(1) of the Europol Regulation seeking compensation for the non-material damage which he claims to have suffered as a result of Europol’s conduct. He claimed compensation in the amount of EUR 50000 for the non-material damage allegedly suffered on account of the disclosure of personal data (first head of claim) and compensation in the same amount for the non-material damage allegedly suffered on account of being included on the ‘mafia lists’ (second head of claim).

15.

The General Court dismissed that action. It found, as regards the first head of claim, that the appellant had not proven that there was a causal link between the alleged damage and Europol’s conduct ( 7 ) and, as regards the second head of claim, that he had not adduced any evidence capable of establishing that the ‘mafia lists’ had been drawn up and held by an EU institution and in particular by Europol. ( 8 ) It also stated, concerning the two heads of claim, that those findings were not called into question by recital 57 or by Articles 49 or 50 of the Europol Regulation. ( 9 )

16.

On 8 December 2021, the appellant brought an appeal against the judgment under appeal. He claims that the Court of Justice should set aside the judgment under appeal, refer the case back to the General Court and issue a decision on costs.

17.

Europol, supported by the Slovak Republic as intervener, contends that the Court of Justice should dismiss the appeal and order the appellant to pay the costs.

18.

In support of his appeal, the appellant relies on six grounds of appeal. The first to fourth grounds concern the non-material damage suffered as a result of the disclosure to the public of personal data (first head of claim at first instance) and the fifth and sixth grounds concern the non-material damage suffered as a result of the inclusion of his name on the ‘mafia lists’ (second head of claim at first instance). ( 10 )

19.

Europol contends at the outset that the first and fifth grounds are inadmissible, which should be examined first of all.

20.

Europol contends, in essence, that the first and fifth grounds of appeal, alleging that the General Court erred in law in ruling out the joint and several liability of Europol and the Member State concerned for damage suffered as a result of unlawful data processing as a consequence of action by Europol or that Member State, were raised for the first time in the reply at first instance. They are therefore new grounds raised in the course of the proceedings and, thus, are inadmissible. ( 11 )

21.

The appellant counters by saying that he raised those arguments in his application at first instance, when he mentioned recital 57 and Article 50(1) and (2) of the Europol Regulation.

22.

In that regard, I note that, in his application, the appellant claimed that Europol was responsible under Article 49(3) and Article 50 of the Europol Regulation and by reference to recital 57 of that regulation, which he cited in full. In his reply, the appellant subsequently substantiated that argument by stating that, even if it were not established that Europol was responsible for the conduct at issue, it would be jointly and severally liable for the damage caused together with the Member State concerned.

23.

In those circumstances, I consider that the appellant raised a plea relating, in essence, to Europol’s joint and several liability in his application at first instance and that, therefore, the first and fifth grounds of appeal are admissible.

24.

By his first ground of appeal, the appellant takes issue with the General Court, in essence, for having ruled out that Europol and the Member State concerned were jointly and severally liable for damage deriving from unlawful data processing, by disregarding the binding nature of recital 57 of the Europol Regulation.

25.

While acknowledging that the wording of Article 50(1) and (2) of the Europol Regulation does not expressly provide for the joint and several liability of Europol and the Member State concerned, the appellant submits that such liability nevertheless follows from that provision, interpreted in the light of recital 57 of that regulation.

26.

According to the appellant, first, Article 50(2) of the Europol Regulation, where it provides for the settlement of disputes between Europol and the Member State concerned through the Management Board of Europol, cannot be interpreted in any other way, short of depriving that provision of all meaning.

27.

Second, the existence of joint and several liability on the part of Europol in the present case is also supported by the objective of the rules in question, which derives in particular from recital 57 of the Europol Regulation and which consists in providing enhanced protection for injured parties. ( 12 )

28.

Third, the general principles of EU law make it possible, in any event, for joint and several liability to be inferred even in the absence of express provision, having regard to Article 340 TFEU.

29.

Europol, supported by the Slovak Republic, states, as a preliminary point, that the joint and several liability of the European Union and the Member State concerned, where they act together, is not recognised, in principle, under the second paragraph of Article 340 TFEU, but requires an express reference to that effect by the EU legislature.

30.

In the first place, Article 50 of the Europol Regulation is not applicable to the data processing at issue in the present case, since it applies exclusively to data processing carried out in the course of Europol’s operations and tasks.

31.

In the second place, that provision applies only to damage caused jointly by the European Union and a Member State and cannot be applied in the absence of any unlawful conduct on the part of Europol and without proof of a causal link.

32.

In the third place, first of all, although recital 57 of the Europol Regulation refers to joint and several liability, that recital is not binding and does not apply in the present case. Next, the concept of joint and several liability is based on the premiss that more than one entity is liable for the same damage, not that an entity whose liability has not been proven must pay compensation. Lastly, the appellant has not even brought an action for damages against the Member State concerned. ( 13 )

33.

I would point out that, in the judgment under appeal, the General Court held that Articles 49(3) and 50(1) of the Europol Regulation merely state that Europol must make good any damage caused by its departments or by its staff in the performance of their duties, in accordance with the conditions laid down in Article 340 TFEU, and that the condition relating to the existence of a causal link was not satisfied. ( 14 ) In that regard, although recital 57 of that regulation envisages a solidarity mechanism, there is no concrete expression of or basis for it in the provisions of the regulation. ( 15 )

34.

Concerning the non-contractual liability of the European Union, it should be noted that the second paragraph of Article 340 TFEU provides that ‘in the case of non-contractual liability, the Union shall, in accordance with the general principles common to the laws of the Member States, make good any damage caused by its institutions or by its servants in the performance of their duties’. ( 16 ) The Court has consistently held that the non-contractual liability of the European Union under that provision depends on the fulfilment of a number of conditions as regards the unlawfulness of the acts alleged against the institution, the fact of damage and the existence of a causal link between the wrongful act and the damaged complained of. ( 17 ) The cumulative nature of those conditions means that, where one of them is not satisfied, the non-contractual liability of the European Union cannot be incurred. ( 18 )

35.

As regards, more specifically, the possible joint and several liability of Europol under Article 50 of the Europol Regulation, I note that, in principle, non-contractual joint and several liability means that, if the harmful act is attributable to several persons, they are jointly and severally liable to pay compensation for the damage. ( 19 )

36.

In accordance with equally settled case-law of the Court, the interpretation of a provision of EU law requires account to be taken not only of its wording, but also of the context in which it occurs, as well as the objectives and purpose pursued by the act of which it forms part. Furthermore, the legislative history of a provision of EU law may also reveal elements that are relevant to its interpretation. ( 20 )

37.

In the first place, concerning the wording of Article 50(1) of the Europol Regulation, that provision states, in essence, that any individual who has suffered damage as a result of an unlawful data processing operation is to have the right to receive compensation for the damage suffered, either from Europol, in accordance with Article 340 TFEU (before the EU Courts), or from the Member State in which the event that gave rise to the damage occurred, in accordance with its national law (before the national court with jurisdiction).

38.

It seems to me that Article 50(1) of the Europol Regulation is not, on its wording alone, amenable to an unambiguous interpretation as to the nature of the liability in question.

39.

The use of the expression ‘either … or’ is not conclusive in that regard. ( 21 ) That expression could just as easily indicate that Europol’s liability is an alternative to the liability of the Member State concerned or that the injured party may make a claim against either the institution concerned or the Member State concerned for the entire damage.

40.

Furthermore, the reference in that provision to Article 340 TFEU is not conclusive either and, in the light of the reference in the latter provision to the ‘general principles common to the laws of the Member States’, calls for a comparative interpretation, which I will carry out below in the context of the teleological interpretation of the provision in question. ( 22 )

41.

In the second place, concerning the context of which Article 50(1) of the Europol Regulation forms part, I note, first, that recital 56 of the Europol Regulation states that Europol is to be subject to the general rules on contractual and non-contractual liability applicable to Union institutions, agencies and bodies, ‘save as regards the rules on liability for unlawful data processing’. As regards such unlawful data processing, recital 57 of that regulation could not be more explicit where it states that ‘Europol and the Member State in which the event that gave rise to the damage occurred should … be jointly and severally liable’, on the ground that ‘it may be unclear for the individual concerned whether damage suffered as a result of unlawful data processing is a consequence of action by Europol or by a Member State’.

42.

It is indeed true, as Europol points out, that the preamble to an EU act has no binding legal force and cannot be relied on either as a ground for derogating from the actual provisions of the act in question or for interpreting those provisions in a manner clearly contrary to their wording. ( 23 ) Nevertheless, beyond those limits, the recitals constitute important elements for the purposes of interpretation, which may clarify the intentions of the author of that act. ( 24 )

43.

Therefore, since the EU legislature’s intention, clearly expressed in recital 57 of the Europol Regulation, to favour injured parties by making Europol and the Member State concerned jointly and severally liable does not conflict with the wording of Article 50 of that regulation, I conclude that that article may (and must) be interpreted in the light of that recital.

44.

That conclusion is confirmed by Article 50(2) of the Europol Regulation, under which any dispute between Europol and Member States over the ultimate responsibility for compensation awarded to an individual in accordance with Article 50(1) is to be referred to the Management Board.

45.

As regards, second, Europol’s argument that, in essence, its activities of taking possession of and decrypting the appellant’s mobile telephones are not covered by the concept of ‘personal data processing’ within the meaning of Article 50 of the Europol Regulation, I do not see why – and Europol offers no explanation in that regard – the decryption activities carried out by Europol in the present case do not fall within the definition set out in Article 88(2)(a) TFEU, under which Europol’s tasks may include ‘the collection, storage, processing, analysis and exchange of information, in particular that forwarded by the authorities of the Member States or third countries or bodies’. ( 25 )

46.

In the third place, it seems clear to me that one of the objectives of the Europol Regulation, as is apparent from recital 57 thereof, is to make it easier, by means of the joint and several liability of Europol and the Member State concerned, for persons who have suffered damage as a result of incorrect data processing to bring an action for damages. That view is borne out by the legislative history of the provision in question and by a comparative interpretation of that provision in the light of the general principles common to the laws of the Member States.

47.

In that regard, concerning, first, the legislative history of Article 50 of the Europol Regulation, I note that the wording of that article and of recital 57 was taken directly from the Commission’s initial proposal, ( 26 ) which supports the view that that article transposes the EU legislature’s intention, as expressed in that recital, to introduce a form of joint and several liability between Europol and the Member State concerned. ( 27 )

48.

Furthermore, contrary to Europol’s submissions, the application of that provision cannot be limited to the situation of damage caused jointly by the European Union and a Member State since, in such a situation, it would, in my view, be for the court having jurisdiction to rule on the respective liability of the entities or persons who caused the damage. ( 28 )

49.

Concerning, second, the comparative interpretation of Article 50(1) of the Europol Regulation, I would point out that, under that provision, the injured party may sue Europol ‘in accordance with Article 340 TFEU’, the second paragraph of which refers to the general principles common to the laws of the Member States. ( 29 )

50.

In that connection, it seems to me that Member States’ legal systems overlap somewhat as regards the existence of joint and several liability in situations in which the same damage is attributable to several persons. ( 30 ) Moreover, the Principles of European Tort Law point in the same direction. ( 31 )

51.

I also note that the joint and several liability mechanism is not alien to EU law on data processing since, in particular, Article 82(4) of Regulation 2016/679 introduces such liability where more than one controller is involved in the same processing. ( 32 )

52.

That conclusion is not called into question by the case-law principle that, in situations of concurrent liability of the European Union and a Member State, individuals who have allegedly suffered damage must first bring legal proceedings before the national courts. ( 33 ) While that principle applies to situations of joint liability, its application to situations of joint and several liability would deprive it of all practical effect.

53.

To conclude, I consider that the General Court erred in law in ruling out that Article 50(1) of the Europol Regulation, interpreted in the light of recital 57 thereof, introduced a system of joint and several liability between Europol and the Member State concerned for damage suffered as a result of unlawful data processing as a consequence of action by Europol or that Member State.

54.

I therefore propose that the first ground of appeal be upheld.

55.

Accordingly, the judgment under appeal should be set aside in so far as it ruled out any causal link between the damage alleged by the appellant and possible conduct on the part of Europol solely because, for a certain period of time, both Europol and the Slovak authorities had been in possession of the data contained in the mobile telephones in question.

56.

That said, I note that if Europol is to be held jointly and severally liable for the alleged damage, it will still be necessary to establish, among other things, the existence of a causal link between the alleged conduct and that damage. ( 34 ) Indeed, in order for joint and several liability to exist, the various events giving rise to damage must be capable of causing the alleged damage, irrespective of which infringement was the immediate and decisive cause of the event. ( 35 )

57.

It is true that the existence of that causal link in the present case is the common thread running through the arguments put forward in the second to fourth and sixth grounds of appeal.

58.

However, given that, in the judgment under appeal, the General Court essentially confined itself to ruling on the absence of an ‘exclusive’ causal link between Europol’s conduct and the alleged damage, and since that analysis does not make it possible to assess whether a causal link exists as is required in a situation of joint and several liability, I consider that, if the Court of Justice endorses my proposal to uphold the first ground of appeal, the judgment under appeal should be set aside and the case referred back to the General Court, as regards the first head of claim at first instance, so that the General Court can rule on the question of the causal link in the context of joint and several liability and, where appropriate, on the other conditions to which the non-contractual liability of the European Union and its institutions or bodies is subject. ( 36 )

59.

However, if the Court does not agree with my suggested approach, the other grounds of appeal are examined below. ( 37 )

60.

By his second ground of appeal, the appellant claims that, contrary to the national rules specifying what investigation files should contain, ( 38 ) the official record of 23 October 2018 was not part of the investigation file concerning him, which therefore affects its reliability.

61.

In the judgment under appeal, the General Court took account of the official record of 23 October 2018 in order to find that, from that date onwards, Europol was not the only entity in possession of the data contained in the mobile telephones in question, since the Slovak authorities held those data too. ( 39 )

62.

In response to the appellant’s assertion that the official record was not authentic, the Court held that any failure to include that document in the criminal proceedings file could not, in itself, affect its authenticity and that the appellant had in no way claimed that that record had been altered. ( 40 )

63.

In that regard, it seems to me that the appellant’s argument concerning the possible infringement of the national rules governing the content of the file – which, moreover, do not concern the authenticity of the documents on the file – is ineffective, in that it is not sufficient to demonstrate that the General Court erred in its assessment of the validity of the official record of 23 October 2018 and far less that it distorted that item of evidence by failing to take account of the national legislation relied on by the appellant at first instance. A distinction should be drawn between, on the one hand, the possible non-conformity of that record with the national rules governing the content of the file, which might affect the record’s validity as a part of that file, ( 41 ) and, on the other hand, the existence (and therefore the authenticity) of the official record itself and its potential probative value in the present case.

64.

Similarly, in the light of the patently irrelevant nature of the national legislation relied on by the appellant in order to undermine the probative value of the official record at issue, the argument alleging failure to state reasons in the judgment under appeal, also raised by the appellant, cannot succeed.

65.

I therefore propose that the second ground of appeal be rejected.

66.

By his third ground of appeal the appellant claims, in the first place, that the official record of 23 October 2018 (the authenticity of which is, moreover, disputed) demonstrates only that ‘preliminary results’ were forwarded in the form of data acquisitions and retrievals, which does not prove that the ‘communications’ at issue in the present proceedings were also provided. ( 42 )

67.

In that regard, I note that, in paragraph 68 of the judgment under appeal, the General Court found that, on the date of the abovementioned official record, Europol was no longer the only entity in possession of the data at issue, which were accessible to the Slovak authorities from that date. ( 43 )

68.

It seems to me that the doubts raised by the appellant concerning the precise content of the data forwarded by Europol to the Slovak authorities and his disagreement with the General Court’s interpretation of the term ‘preliminary results’ contained in the official record of 23 October 2018 are not sufficient to establish the existence of errors of fact or of assessment leading to a distortion of the evidence by the General Court.

69.

In the second place, the appellant submits that the General Court failed to establish that Europol never had access to the communications at issue in decrypted form, ( 44 ) that even a leak in encrypted form could have caused the alleged damage, after being decrypted by an unauthorised third party, ( 45 ) and that, in the present case, decryption would have been particularly easy given that Europol had already retrieved the files with their associated passwords.

70.

Although it cannot be ruled out, as the appellant claims, that the data at issue could have been leaked even in encrypted form, the appellant has not submitted any information or evidence to suggest that such a leak occurred when Europol had access to the mobile telephones in question, ( 46 ) and far less to suggest that the General Court’s finding that the leak of the communications at issue did not originate from the encrypted data is vitiated by a distortion of the evidence. ( 47 )

71.

In the third place, the appellant restates his claim that the official record of 23 October 2018 was backdated – a claim rejected by the General Court as being entirely unsupported by evidence ( 48 ) – without providing additional information from which it could be inferred that the General Court distorted the facts. ( 49 )

72.

In the fourth place, the appellant adds that the mobile telephones in question had been handed over for the purposes of acquisition and retrieval without the prior consent of a court or an independent administrative body, which demonstrates the existence of a causal link.

73.

In that regard, I find it difficult to see how a possible infringement of the rules on acquisition and retrieval of the data at issue could, in itself, prove the existence of a link between that acquisition or that retrieval and the leak of those data to the public. ( 50 )

74.

The fact that the data at issue were forwarded by Europol to the Slovak authorities is sufficient, in my view, to break the ‘exclusive’ causal link between the leak of those data and Europol’s conduct, irrespective of whether Europol was also in possession of the data in encrypted or decrypted form and the level of possible decryption. ( 51 )

75.

I therefore propose that the third ground of appeal be rejected.

76.

By the first part of his fourth ground of appeal, the appellant takes issue with the General Court for having failed to state the reasons for its finding that Article 50(1) and (2) of the Europol Regulation cannot be regarded as establishing joint and several liability and for having infringed the rules on the burden of proof.

77.

It is clear from the analysis carried out in points 24 to 53 of this Opinion that the General Court’s reasoning enabled the appellant to understand the reasons for its view that Article 50 of the Europol Regulation did not establish joint and several liability and enabled him to formulate his arguments against those reasons. I believe it also enables the Court of Justice to carry out its judicial review.

78.

By the second part of his fourth ground of appeal, the appellant claims, in essence, that the General Court reversed the burden of proof by requiring him to demonstrate at first instance that the information leak had originated from Europol.

79.

In the judgment under appeal, the General Court found that the appellant had not adduced evidence of a causal link between the alleged damage and any conduct by Europol and that that was sufficient to exclude any liability on its part under Article 340 TFEU.

80.

In my view, the General Court’s assessment was, in principle, correctly carried out, in the light of settled case-law under which it is for the party seeking to establish the European Union’s non-contractual liability to adduce conclusive proof of the existence of a sufficiently direct causal nexus between the conduct of the institution in question and the damage alleged. ( 52 )

81.

By the third part of his fourth ground of appeal, the appellant complains that the General Court failed to consider as evidence the national criminal investigation file concerning him and the decree of the Slovak Ministry of Justice, ( 53 ) which specifies what that file is to contain. In essence, the appellant restates the argument put forward in the second ground of appeal, namely that the official record of 23 October 2018 should be included in the criminal investigation file concerning him, in accordance with the requirements laid down by that decree.

82.

In that regard, suffice it to note that, as I have pointed out in my analysis of the second ground of appeal, the appellant’s argument concerning the alleged infringement of the national rules governing the content of the file is irrelevant, since the possible non-conformity of that record with those national rules would not affect the probative value of the record in the present case. ( 54 )

83.

As regards the argument to the effect that the fact that Europol submitted only a photograph of the official record of 23 October 2018 demonstrates that Europol was not in possession of that record and obtained it from the Slovak authorities in the context of the judicial proceedings, it must be stated that, as the appellant makes clear, this is his lawyer’s ‘belief’, which is not supported by any evidence or information. ( 55 )

84.

By the fourth part of his fourth ground of appeal, the appellant complains that the General Court infringed his rights of the defence because he was unable to make known his views, at the hearing on 30 June 2021, on the backdating of the official record of 23 October 2018. Without expressly saying so, he is ostensibly claiming failure to observe the principle that the parties should be heard.

85.

However, the appellant does not indicate what arguments and evidence he could have relied on had his rights of the defence been respected, nor does he claim that, in the absence of the alleged failure to observe the principle that the parties should be heard, his arguments could have altered the outcome of the dispute. ( 56 )

86.

Furthermore, in paragraphs 74 to 78 of the judgment under appeal, the General Court ruled on the appellant’s arguments concerning the alleged backdating, noting in particular that they were entirely unsupported by evidence and that the appellant had not claimed, in the reply, that the official record of 23 October 2018 or the copy thereof had been altered.

87.

The appellant merely states that, to date, the whereabouts of the original copy of the official record of 23 October 2018 are unknown, that it is not in the court file on the case from which it supposedly originates and that the documents from another criminal case show that there are at least two separate copies of that record.

88.

In that regard, it should be noted that, under the principle of the unfettered evaluation of evidence, enshrined in the case-law of the Court of Justice, the determination of the probative value of the evidence is left to the discretion of the General Court, ( 57 ) save where the evidence is distorted, which, as the Court of Justice has consistently held, must be obvious from the documents in the case file without there being any need to carry out a new assessment of the facts and the evidence. ( 58 ) That does not seem to me to be the case here.

89.

I therefore propose that the fourth ground of appeal be rejected.

90.

By his fifth ground of appeal, which refers entirely to the first ground, the appellant essentially takes issue with the General Court for having ruled out that Europol and the Member State concerned were jointly and severally liable for damage deriving from unlawful data processing, by disregarding the binding nature of recital 57 of the Europol Regulation.

91.

As is apparent from my analysis of the first ground of appeal, ( 59 ) the General Court erred in law in holding that Article 50(1) of the Europol Regulation, interpreted in the light of recital 57 thereof, did not introduce a system of joint and several liability between Europol and the Member State concerned for damage suffered as a result of unlawful data processing by Europol or that Member State.

92.

That said, I note that, as regards the second head of claim, the General Court found, in paragraph 102 of the judgment under appeal, that the appellant had not adduced any evidence capable of establishing that the ‘mafia lists’ on which he had been included had been drawn up and held by an EU institution and, in particular, by Europol.

93.

In my view, the error of law committed by the General Court is not such as to challenge that finding, in so far as it is not called into question by the arguments put forward in the sixth ground of appeal, as I will examine below.

94.

In those circumstances, I propose that the fifth ground of appeal be rejected as ineffective.

95.

By his sixth ground of appeal, the appellant claims, in essence, that there was no basis for Europol establishing a link between him and the ‘mafia lists’.

96.

However, as the General Court pointed out, Europol, in its report of 13 January 2019, ( 60 ) merely stated that the appellant’s name was, inter alia, ‘directly linked to the so-called mafia lists and the Panama Papers’, without including him on any list, and had observed that articles published in the press prior to that report had already referred to the appellant’s possible mafia links. ( 61 )

97.

That conclusion is not called into question by the appellant’s arguments, which are essentially confined to claiming that Europol did not explain why it had established a link between the appellant and the ‘mafia lists’ and that, by that conduct, it had infringed the principle of proportionality, since the ‘right to keep mafia lists’ has no basis in national or EU law.

98.

By those arguments, the appellant starts from the unproven premiss that Europol actually included him on the ‘mafia lists’, without calling into question the General Court’s finding in paragraph 102 of the judgment under appeal that he had not adduced any evidence capable of establishing that the ‘mafia lists’ on which he had been included had been drawn up and held by an EU institution and, in particular, by Europol.

99.

I therefore propose that the sixth ground of appeal be rejected and, consequently, that the appeal be dismissed as regards the grounds relating to the second head of claim at first instance.

100.

As is apparent from the foregoing analysis, I propose that the judgment under appeal be set aside as regards the first head of claim at first instance and that the appeal be dismissed as regards the second head of claim at first instance.

101.

Under Article 61 of the Statute of the Court of Justice of the European Union, the Court of Justice may, where it sets aside the decision of the General Court, itself give final judgment in the matter, where the state of the proceedings so permits.

102.

I do not believe that to be the case here.

103.

I consider that the error of law committed by the General Court in declining to acknowledge the existence of joint and several liability between Europol and the Member State concerned for damage suffered as a result of unlawful data processing as a consequence of action by Europol or that Member State, means that a new factual assessment is to be carried out by the General Court concerning whether a causal link exists between Europol’s conduct and the damage alleged by the appellant ( 62 ) and, where appropriate, concerning the other conditions to which the non-contractual liability of the European Union and its institutions or bodies is subject. ( 63 )

104.

Given that I propose that the case be referred back to the General Court, the decision on the costs of the parties relating to the appeal proceedings should be reserved, in accordance with Article 137 of the Rules of Procedure of the Court of Justice, applicable to appeal proceedings by virtue of Article 184(1) of those rules.

105.

In the light of the foregoing, I propose that the Court should: