View source for CJEU - C‑755/21 P - Kočner v Europol

{{CJEUdecisionBOX

|Case_Number_Name=C‑755/21 P Kočner v Europol
|ECLI=ECLI:EU:C:2024:202

|Opinion_Link=
|Judgement_Link=https://curia.europa.eu/juris/document/document.jsf?docid=283444&doclang=en

|Date_Decided=05.03.2024
|Year=2024

|GDPR_Article_1=Article 82(4) GDPR
|GDPR_Article_Link_1=Article 82 GDPR#4
|GDPR_Article_2=Article 82(5) GDPR
|GDPR_Article_Link_2=Article 82 GDPR#5
|GDPR_Article_3=
|GDPR_Article_Link_3=
|GDPR_Article_4=
|GDPR_Article_Link_4=

|EU_Law_Name_1=Article 340 TFEU
|EU_Law_Link_1=https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12012E/TXT:en:PDF
|EU_Law_Name_2=Article 50(1) Regulation 2016/794
|EU_Law_Link_2=https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0794
|EU_Law_Name_3=
|EU_Law_Link_3=
|EU_Law_Name_4=
|EU_Law_Link_4=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=Marián Kočner
|Party_Link_1=https://en.wikipedia.org/wiki/Mari%25C3%25A1n_Ko%25C4%258Dner
|Party_Name_2=Europol
|Party_Link_2=https://www.europol.europa.eu/
|Party_Name_3=Slovak Republic
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=
|Party_Name_5=
|Party_Link_5=

|Reference_Body=
|Reference_Case_Number_Name=

|Initial_Contributor=im
|
}}

The CJEU found that Europol and the Slovak Republic are jointly liable for an unauthorized disclosure of intimate conversations between the data subject and his girlfriend, which were leaked to press. The data subject was granted €2,000 as a compensation for the non-material damage suffered.

==English Summary==

=== Facts ===
Following the murder of a Slovak journalist and his fiancée, Mr Ján Kuciak and Ms Martina Kušnírová, in Slovakia on 21 February 2018, the Slovak authorities (Národná kriminálna agentúra (National Crime Agency, Slovakia; ‘NAKA’)) conducted an extensive investigation. 
At the request of those authorities, the European Union Agency for Law Enforcement Cooperation (‘Europol’) extracted the data stored on two mobile telephones allegedly belonging to Mr Marian Kočner, the data subject, who was prosecuted as an accomplice to that murder for having ordered the killings, following the investigation. 

Europol sent its scientific reports to those authorities and delivered to them a hard disk containing the encrypted data it had extracted. In one of its reports, Europol stated that Mr Kočner had been detained on suspicion of a financial offence since 2018 and that his name was, inter alia, directly linked to the ‘so-called mafia lists’ and the ‘Panama Papers’.

In May 2019, the Slovak press and international network of investigative journalists published a large amount of information relating to Mr Kočner from his mobile telephones, including transcripts of intimate communications exchanged between him and his girlfriend. The conversation was carried by means of encrypted messaging service. 

For the reasons stated above, Mr Kočner sent a complaint to Europol seeking compensation in the amount of €100,000 as a reparation for the non-material damage on the bases of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0794 Article 50(1) Regulation 2016/794]. The sought compensation consisted of €50,000 for the unlawful disclosure of data subject's intimate conversation with his girlfriend and €50,000 for the inclusion of his name on the 'mafia list'.   

Europol and Slovak Republic contended that the arguments are unfounded as, firstly, Regulation 2016/794 (setting up the rules for the Europol) does not provide for such joint liability of Europol and the Member State. Secondly, Europol rejects any liability due to the absence of unlawful conduct on its part given that alleged harmful events occurred during storage of the national investigation file. As such, these circumstances do not constitute ‘unlawful data processing operations’ within the meaning of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0794 Article 50(1) Regulation 2016/794]. 

Lastly, Europol stated that even if joint liability was applicable, the absence of any unlawful conduct on its part and of a causal link between such conduct and the damage suffered could not give rise to a liability.

=== Holding ===
Firstly, the CJEU ruled that there is no need to establish additionally to which of these two entities - Europol or the Member State - that unlawful processing was attributable. In order for such joint and several liability to be incurred in the first stage, the individual concerned must show only that, in the course of cooperation between Europol and the Member State concerned, unlawful data processing that caused him or her to suffer damage has been carried out.

Secondly, concerning  specifically the leak of the 'so-called mafia list', the CJEU found that the data subject had failed to establish that the ‘mafia lists’ on which his name had allegedly been included had been drawn up and kept by Europol. The data subject's claim contradicted the evidence whereby it was apparent that the leaked Europol report containing Mr Kočner’s name on the ‘mafia list’ was subsequent to and, thus, unrelated to Slovak press publications where he was represented as ‘member of the mafia’. 

Thirdly, the CJEU rejected the Europol’s argument that it met its obligations and implemented appropriate technical and organizational measures to protect personal data against any form of unauthorized access. The Court observed that the data of such intimate nature bears out the need for its protection to be strictly ensured in cooperation with Member States under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0794 Regulation 2016/794]. As an unauthorized access took place it constituted a sufficiently serious breach of a rule of EU law intended to confer rights on individuals. 

Fourthly, the Court held that European Union can incur non-contractual liability in the present case, as the result of publication of data subject’s intimate conversations. The leak of this information adversely affected his honour and professional reputation, and violated his rights to privacy, family life and respect for his communications guaranteed by Article 7 of the Charter of Fundamental Rights of the European Union.

As a result, the CJEU held Europol and the Slovak Republic jointly and severally liable for the unlawful data processing which caused the data subject to suffer non-material damage. The Court stated that Europol has the possibility to refer the matter to its Management Board so that it can determine who has the ultimate responsibility for the compensation awarded to the data subject. However, this exclusively concerns the internal allocation of responsibilities between the two jointly liable controllers.

The compensation attributed to the data subject for the inclusion of his name on the ‘mafia list’ by Europol was firstly set at €50,000. As this claim was dismissed, the Court only examined the damage regarding the compensation of €50,000 for disclosure of the data subject’s conversation with his girlfriend. The Court decided that the alleged damage resulted solely from the disclosure of transcripts of the conversation and no evidence established that any photographs have been disclosed. 

As a result, the CJEU granted Mr Kočner compensation in the amount of €2,000 as reparation for that damage.

== Comment ==
The case refers to the joint and several liability of two controllers under Regulation 2016/794. However, this concept is also relevant under [[Article 82 GDPR#4|Article 82(4) GDPR]] and [[Article 82 GDPR#5|Article 82(5) GDPR]].

== Further Resources ==
''Share blogs or news articles here!''