28 March 2025 (*)

( Action for annulment – Law governing the institutions – Protection of personal data – Regulation (EU) 2018/1725 – Requests sent to EUIPO concerning the processing of the applicant’s personal data – Act not open to challenge – Inadmissibility )

In Case T‑349/24,

WS,

applicant,

European Union Intellectual Property Office (EUIPO),

defendant,

THE GENERAL COURT (Tenth Chamber),

composed of O. Porchia, President, P. Nihoul and S. Verschuur (Rapporteur), Judges,

Registrar: V. Di Bucci,

having regard to the written part of the procedure,

makes the following

1By his action under Article 263 TFEU, the applicant, [

confidential

], (1) seeks, in essence, annulment of the alleged decisions of the European Union Intellectual Property Office (EUIPO) by which the latter rejected his requests submitted on 1 February 2024 and 16 February 2024, respectively, under Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39).

Background to the dispute

2Between February 2022 and September 2023, the applicant submitted at least 150 requests, complaints, communications, letters and follow-up reminders to the various departments of EUIPO and to external entities, alleging a breach of his personal data, unauthorised access to his profile in the SAP SuccessFactors software (‘SuccessFactors profile’), and incorrect processing of those data in the context of his participation in various EUIPO selection procedures.

3On 26 April 2023, the applicant brought an action before the General Court, registered as Case T‑221/23, seeking annulment of the decision of the Selection Committee of EUIPO of 30 June 2022 not to admit him to the next stage of Selection Procedure EXT/22/08/AD 6/DTD – Business Analyst, claiming, in essence, that there had been a breach of his personal data in his SuccessFactors profile inasmuch as EUIPO had manipulated that profile.

4On 22 September 2023, EUIPO sent a letter to the applicant, concluding that there had been no breach of his personal data; nor had there been any unauthorised access to his profile in the systems. It also concluded that all his personal data had been correctly processed. In addition, EUIPO informed the applicant that it was discontinuing all correspondence with him on the basis of Article 14(4) of Regulation 2018/1725 and point 4 of the EUIPO Code of Good Administrative Behaviour due to the manifestly unfounded, excessive and repetitive nature of his requests.

5On 4 December 2023, the applicant brought an action before the General Court, registered as Case T‑1138/23, seeking annulment of the EUIPO decision of 22 September 2023 rejecting, in particular, a request which he had submitted on 25 July 2023 pursuant to Article 65 of Regulation 2018/1725, claiming alleged breaches by EUIPO of its obligation to comply with that regulation.

6On 5 December 2023, the applicant submitted a request to the Data Protection Officer of EUIPO (‘the DPO’), alleging that there had been a breach of his personal data, inasmuch as the data in his SuccessFactors profile regarding numerous selection procedures in which he had participated had been deleted. In that context, he asked that he be permitted to exercise certain rights as a data subject pursuant to Chapter III of Regulation 2018/1725 and that this alleged breach of his personal data be reported to the European Data Protection Supervisor (EDPS) and to him as the data subject.

7On 12 December 2023, the applicant sent a letter to the Executive Director of EUIPO reiterating the same requests as those made on 5 December 2023. He also requested, inter alia, that an administrative investigation be launched against certain EUIPO staff members and that they be reported to the European Anti-Fraud Office (OLAF) for ‘manipulating recruitment procedures’.

8On 1 February 2024, the applicant submitted a new data subject request to the DPO pursuant to Regulation 2018/1725, reiterating in essence the same requests as those made on 5 December 2023 and 12 December 2023.

9In support of his request of 1 February 2024, the applicant provided evidence of alleged modifications, discovered on 24 January 2024, of his SuccessFactors profile regarding certain selection procedures. More specifically, those modifications were changes which had been made in the ‘Date Applied’ column (which initially referred to the dates of 13 February 2022 and 9 July 2022, and subsequently referred to those of 14 February 2022 and 10 July 2022), as well as in the ‘Status Date’ column (which initially referred to the dates of 29 June 2022 and 30 July 2022, and subsequently referred to those of 30 June 2022 and 31 July 2022). In addition, the applicant requested that the DPO examine the possibility of launching an investigation under Article 69 of Regulation 2018/1725.

10On 8 February 2024, the applicant lodged a complaint with the EDPS, pursuant to Article 63(1) of Regulation 2018/1725, due to the lack of response from the DPO to his request of 1 February 2024. Receipt of that complaint was acknowledged by the EDPS on 7 March 2024.

11On 16 February 2024, the applicant sent a letter to the Executive Director of EUIPO, informing the latter that the DPO had not taken measures on the basis of Regulation 2018/1725 and the EUIPO Code of Good Administrative Behaviour and reiterating his requests of 1 February 2024.

12On 5 March 2024, the EDPS asked EUIPO to provide it with clarifications as to the alleged breach of personal data claimed by the applicant.

13On 11 March 2024, EUIPO provided the EDPS with explanations, stating that the applicant’s allegations were already covered by Case T‑1138/23, WS v EUIPO, in which the alleged manipulation of his SuccessFactors profile by EUIPO had also been claimed, and in which EUIPO had demonstrated the continuous, repetitive and manifestly unfounded nature of the applicant’s requests and communications.

14On 6 June 2024, the applicant submitted a data subject request to the EDPS in order to gain access to his personal data, namely – inter alia – all communications between the EDPS and EUIPO concerning the complaints he had lodged with those two bodies.

15On 14 June 2024, the applicant sent a follow-up email to the EDPS.

16On 26 June 2024, the EDPS rejected his request of 6 June 2024, taking the view that, in the context of that request, it had not been possible to identify any personal data.

Forms of order sought

17The applicant claims that the Court should:

–annul the decision of EUIPO rejecting his requests made on 1 February 2024 and 16 February 2024 under Regulation 2018/1725;

–order EUIPO to pay the costs.

18In its objection of inadmissibility raised under Article 130(1) of the Rules of Procedure of the General Court, EUIPO contends that the Court should:

–dismiss the action as manifestly inadmissible in its entirety;

–order the applicant to pay the costs.

19Under Article 130(1) and (7) of the Rules of Procedure, if the defendant so requests, the Court may decide on inadmissibility or lack of competence without going to the substance of the case.

20In the present case, as EUIPO has applied for a decision on inadmissibility, the Court, finding that it has sufficient information from the documents in the case file, has decided to rule on the action without taking further steps in the proceedings.

21EUIPO contends that the present action is inadmissible in so far as the applicant did not bring that action within the legal time limit laid down in Article 263 TFEU.

22In the light of the arguments exchanged between the parties, the Court considers it appropriate to begin by examining whether there is a challengeable act for the purposes of Article 263 TFEU.

23In that regard, it should be borne in mind that any measure which produces binding legal effects such as to affect the interests of an applicant by bringing about a distinct change in his or her legal position is an act or decision which may be the subject of an action under Article 263 TFEU for a declaration that it is void (see judgment of 9 December 2004, Commission v Greencore, C‑123/03 P, EU:C:2004:783, paragraph 44 and the case-law cited).

24The silence of an institution when it has been called upon to express its view cannot, in itself and as such, produce legal effects, except where that result is expressly provided for by EU law. Where there are no such express provisions laying down a deadline by which an implied decision is deemed to have been taken and prescribing the content of the decision, an institution’s inaction cannot be deemed to be equivalent to a decision without calling into question the system of remedies instituted by the Treaty (see judgment of 13 October 2015, Intrasoft International v Commission, T‑403/12, EU:T:2015:774, paragraph 57 and the case-law cited).

25In the present case, it is common ground that EUIPO did not adopt any express decision following the requests made by the applicant on 1 February 2024 and 16 February 2024.

26Furthermore, it should be noted that Regulation 2018/1725 does not contain any express provision laying down a deadline by which an implied decision is deemed to have been taken following a request under that regulation. Indeed, paragraph 3 of Article 14 of that regulation refers only to (i) the period of one month from receipt of a request made by a data subject within the meaning of that regulation within which the institution may reply and (ii) the possibility of an extension of that period, taking into account the complexity and number of the requests. Paragraph 4 of that article merely lays down an obligation for a controller who does not take action on a request made by a data subject to inform the data subject, without delay and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with the EDPS and of seeking a judicial remedy.

27It also follows from the case-law that, in certain particular circumstances, an institution’s silence or inaction may exceptionally be considered to constitute an implied refusal decision (see, to that effect, judgment of 9 December 2004, Commission v Greencore, C‑123/03 P, EU:C:2004:783, paragraph 45).

28However, it must be stated that, in the present case, the applicant has not claimed any particular circumstance which would make it possible, exceptionally, for EUIPO’s silence or inaction following his requests of 1 February 2024 and 16 February 2024 to be deemed to be equivalent to implied refusal decisions.

29Even assuming that implied refusal decisions were adopted by EUIPO following the applicant’s requests of 1 February 2024 and 16 February 2024, which thus constitute acts open to challenge for the purposes of Article 263 TFEU, it is apparent from the case file that, contrary to the applicant’s assertions, those requests of February 2024 are, in essence, merely a repetition of those of December 2023. Those requests each relate to the alleged breach of the applicant’s personal data by EUIPO inasmuch as he claims that his SuccessFactors profile was manipulated. More specifically, in the requests of 1 February 2024 and 16 February 2024, the applicant reiterates his claim that EUIPO unlawfully deleted the data from that profile relating to several selection procedures in which he had participated, and, in that context, his wish to be able to exercise certain rights as a data subject in accordance with Chapter III of Regulation 2018/1725.

30In that regard, it must be borne in mind that although, under Articles 17 to 24 of Regulation 2018/1725, each data subject may request that certain measures be adopted concerning the processing of his or her personal data, that option does not allow him or her to disregard the time limit laid down by Article 263 TFEU for bringing an action for annulment by indirectly calling into question, by means of a request, an earlier decision which has not been challenged within the prescribed period. Only the existence of new and material facts may justify the submission of a request for review of a decision which has not been challenged within the time limits (see, by analogy, judgment of 26 September 1985, Valentini v Commission, 231/84, EU:C:1985:377, paragraph 14, and order of 20 January 1998, Kögler v Court of Justice, T‑160/96, EU:T:1998:4, paragraph 41 and the case-law cited).

31According to the requirements of the case-law, in order for a fact to be ‘new’, it is essential that neither the applicant nor the administration was aware of, or in a position to be aware of, the fact in question when the earlier decision, which has become final, was adopted. In order to be ‘material’, the fact concerned must be capable of substantially altering the applicant’s situation forming the basis of the initial request which gave rise to the earlier decision which has become final (see, to that effect, judgment of 7 February 2001, Inpesca v Commission, T‑186/98, EU:T:2001:42, paragraphs 50 and 51).

32Furthermore, it should be borne in mind that the two-month time limit for instituting proceedings laid down by Article 263 TFEU is a matter of public policy, as it was established in order to ensure that legal positions are clear and certain and to avoid any discrimination or arbitrary treatment in the administration of justice. The time limits for instituting proceedings are thus not subject to the discretion of the Court or the parties (see, to that effect, judgments of 23 January 1997, Coen, C‑246/95, EU:C:1997:33, paragraph 21, and of 18 September 1997, Mutual Aid Administration Services v Commission, T‑121/96 and T‑151/96, EU:T:1997:132, paragraph 38; see also order of 13 November 2012, ClientEarth and Others v Commission, T‑278/11, EU:T:2012:593, paragraph 31 and the case-law cited).

33In the present case, it should be noted that the applicant has not adduced any evidence which is such as to demonstrate, in accordance with the case-law cited in paragraph 31 above, the existence of a fact capable of substantially altering his situation forming the basis of his initial requests of December 2023. In his written pleadings, the applicant does not identify any material fact. While he refers to alleged modifications of his SuccessFactors profile, discovered on 24 January 2024 and linked to a difference of one day concerning the ‘Date Applied’ and ‘Status Date’ of his applications for certain selection procedures which took place in 2022 (see paragraph 9 above), he does not, however, explain how such a circumstance would be capable of altering his personal situation. It is therefore not necessary to ascertain whether those alleged modifications constitute a new fact within the meaning of the case-law cited in paragraph 31 above.

34Therefore, even if the requests of 1 February 2024 and 16 February 2024 could have given rise to implied rejection decisions, which are the subject of the present action, it must be concluded that those requests are, in essence, merely a repetition of those of December 2023, with the result that the present action must be interpreted as seeking to circumvent the legal time limit laid down by Article 263 TFEU, within the meaning of the case-law cited in paragraph 30 above.

35In any event, even assuming that the requests of 1 February 2024 and 16 February 2024 contain, as compared with those of December 2023, a new and material fact within the meaning of the case-law referred to in paragraph 31 above and that they gave rise to implied rejection decisions on the expiry of the period of one month laid down in Article 14(3) of Regulation 2018/1725, it should be noted that the time limit for bringing proceedings laid down in Article 263 TFEU for seeking the annulment of such implied rejection decisions had expired on the date on which the present action was brought, namely 10 July 2024.

36That conclusion cannot be called into question by the applicant’s argument that the period of one month for replying had implicitly been extended by two months in accordance with the second sentence of paragraph 3 of Article 14 of Regulation 2018/1725. That article lays down the obligation for the controller to inform the data subject, within one month of receipt of the request, of that extension, stating the reasons for it. However, in the circumstances of the present case, not only did EUIPO not inform the applicant of such an extension, but also the applicant could legitimately have understood from the content of the letter of 22 September 2023 that EUIPO had no intention of extending that time limit in order to give itself more time to respond to his requests of 1 February 2024 and 16 February 2024, in so far as it had been expressly stated to him that EUIPO was discontinuing all correspondence with him (see paragraph 4 above).

37In the light of all those considerations, the present action must be dismissed as inadmissible.

Costs

38Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings.

39Since the applicant has been unsuccessful, he must be ordered to pay the costs, in accordance with the form of order sought by EUIPO.

On those grounds,

hereby orders:

1.The action is dismissed as inadmissible.

2.WS shall bear his own costs and shall pay those incurred by the European Union Intellectual Property Office (EUIPO).

Luxembourg, 28 March 2025.

Registrar

President

—

Language of the case: English.

1Confidential information redacted.