28 October 2021 (*1)

(Appeal – Action for damages – Non-contractual liability – Pre-Accession Assistance Instrument – Decentralised management – Investigation by the European Anti-Fraud Office (OLAF) – On-the-spot checks – Regulation (Euratom, EC) No 2185/96 – Article 7 – Access to computer data – Digital forensic operation – Principle of legitimate expectations – Right to be heard – Non-material damage)

In Case C‑650/19 P,

concerning an appeal under Article 56 of the Statute of the Court of Justice of the European Union, brought on 3 September 2019,

appellant,

the other party to the proceedings being:

European Commission, represented by D. Triantafyllou, J. Baquero Cruz and A. Katsimerou, acting as Agents,

defendant at first instance,

THE COURT (First Chamber),

composed of K. Lenaerts, President of the Court, acting as President of the First Chamber, L. Bay Larsen (Rapporteur), Vice-President of the Court, and J.-C. Bonichot, Judges,

Advocate General: G. Hogan,

Registrar: R. Schiano (Administrator),

having regard to the written procedure and following the hearing of 10 February 2021,

after hearing the Opinion of the Advocate General at the sitting on 15 April 2021,

gives the following

By its appeal, Vialto Consulting Kft. (‘Vialto’) seeks the setting aside of the judgment of the General Court of the European Union of 26 June 2019, Vialto Consulting v Commission T‑617/17, not published, EU:T:2019:446; ‘the judgment under appeal’) by which the General Court dismissed its action seeking compensation for the damage it allegedly suffered as a result of the conduct of the European Commission and the European Anti-Fraud Office (OLAF), which was in its view unlawful, in connection with its exclusion from the contract for the provision of services bearing the reference TR2010/0311.01-02/001 (‘the contract at issue’).

Legal framework

Article 4 of Council Regulation (Euratom, EC) No 2185/96 of 11 November 1996 concerning on-the-spot checks and inspections carried out by the Commission in order to protect the European Communities’ financial interests against fraud and other irregularities (OJ 1996 L 292, p. 2) states:

‘On-the-spot checks and inspections shall be prepared and conducted by the Commission in close cooperation with the competent authorities of the Member State concerned, which shall be notified in good time of the object, purpose and legal basis of the checks and inspections, so that they can provide all the requisite help. To that end, the officials of the Member State concerned may participate in the on-the-spot checks and inspections.

In addition, if the Member State concerned so wishes, the on-the-spot checks and inspections may be carried out jointly by the Commission and the Member State’s competent authorities.’

3.3

Article 7 of that regulation provides:

‘1. Commission inspectors shall have access, under the same conditions as national administrative inspectors and in compliance with national legislation, to all the information and documentation on the operations concerned which are required for the proper conduct of the on-the-spot checks and inspections. They may avail themselves of the same inspection facilities as national administrative inspectors and in particular copy relevant documents.

On-the-spot checks and inspections may concern, in particular:

…

– computer data,

…

4.4

Article 9 of that regulation reads as follows:

‘Where the economic operators referred to in Article 5 resist an on-the-spot check or inspection, the Member State concerned, acting in accordance with national rules, shall give Commission inspectors such assistance as they need to allow them to discharge their duty in carrying out an on-the-spot check or inspection.

It shall be for the Member States to take any necessary measures, in conformity with national law.’

Decision 1999/352/EC, ECSC, Euratom

The first subparagraph of Article 2(1) of 1999/352/EC, ECSC, Euratom: Commission Decision of 28 April 1999 establishing the European Anti-fraud Office (OLAF) (OJ 1999 L 136, p. 20) provides as follows:

‘The Office shall exercise the Commission’s powers to carry out external administrative investigations for the purpose of strengthening the fight against fraud, corruption and any other illegal activity adversely affecting the Community’s financial interests, as well as any other act or activity by operators in breach of Community provisions.’

Regulation (EC) No 718/2007

Recital 1 of Commission Regulation (EC) No 718/2007 of 12 June 2007 implementing Council Regulation (EC) No 1085/2006 establishing an instrument for pre-accession assistance (IPA) (OJ 2007 L 170, p. 1) states:

‘The purpose of Regulation (EC) No 1085/2006 (hereinafter referred to as “the IPA Regulation”) is to provide pre-accession assistance to beneficiary countries and support them in their transition from Annex II to Annex I of that Regulation and through to membership of the European Union.’

Article 10(1) of Regulation 718/2007 provides:

‘Unless otherwise provided for in paragraph 2, 3 and 4, decentralised management, where the Commission confers the management of certain actions on the beneficiary country, while retaining overall final responsibility for general budget execution in accordance with Article 53c of Regulation (EC, Euratom) No 1605/2002 [Council Regulation of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities (OJ 2002 L 248, p. 1)] and the relevant provisions of the EC Treaties, shall apply to the implementation of assistance under the IPA Regulation.

For the purposes of assistance under the IPA Regulation, decentralised management shall cover at least tendering, contracting and payments.

…’

Article 21(1) of that regulation reads as follows:

‘The beneficiary country shall designate the following different bodies and authorities:

…’

(f) an operating structure by IPA component or programme,

…’

Article 28 of that regulation provides:

‘1. For each IPA component or programme, an operating structure shall be established to deal with the management and implementation of assistance under the IPA Regulation.

The operating structure shall be a body or a collection of bodies within the administration of the beneficiary country.

…’

(f) arranging for tendering procedures, grant award procedures, the ensuing contracting, and making payments to, and recovery from, the final beneficiary;

…’

Regulation (EU, Euratom) No 883/2013

10.10

According to Article 3 of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ 2013 L 248, p. 1):

‘1. The Office shall exercise the power conferred on the Commission by Regulation (Euratom, EC) No 2185/96 to carry out on-the-spot checks and inspections in the Member States and, in accordance with the cooperation and mutual assistance agreements and any other legal instrument in force, in third countries and on the premises of international organisations.

…’

…’

11.11

Article 11 of that regulation states:

‘1. On completion of an investigation by the Office, a report shall be drawn up, under the authority of the Director-General. That report shall give an account of the legal basis for the investigation, the procedural steps followed, the facts established and their preliminary classification in law, the estimated financial impact of the facts established, the respect of the procedural guarantees in accordance with Article 9 and the conclusions of the investigation.

The report shall be accompanied by recommendations of the Director-General on whether or not action should be taken. Those recommendations shall, where appropriate, indicate any disciplinary, administrative, financial and/or judicial action by the institutions, bodies, offices and agencies and by the competent authorities of the Member States concerned, and shall specify in particular the estimated amounts to be recovered, as well as the preliminary classification in law of the facts established.

…

3. Reports and recommendations drawn up following an external investigation and any relevant related documents shall be sent to the competent authorities of the Member States concerned in accordance with the rules relating to external investigations and, if necessary, to the competent Commission services.

…’

Guidelines on Digital Forensic Procedures for OLAF Staff

12.12

Article 4.3 and 4.4 of the Guidelines on Digital Forensic Procedures for OLAF Staff of 15 February 2016 (‘the OLAF Guidelines’), provide:

‘3. At the start of the digital forensic operation, the DES [(OLAF Digital Evidence Specialist)] shall: (1) document and take photographs of all digital media which shall be subject to the forensic operation, as well as the physical surroundings and layout; (2) make an inventory of the digital media. The inventory should be included in the “Digital Forensic Operation Report”, and the photographs attached to it.

4. In general the DES should conduct a full digital forensic acquisition of the devices referred to in 4.3. If feasible, the DES and the investigator should together preview those devices to determine whether they may contain data potentially relevant for the investigation and whether a partial forensic acquisition would be appropriate. If so, the DES may instead conduct a partial forensic acquisition of the data. A short description of the contents and the case reference number added by the DES shall be recorded during the acquisition of the digital forensic image.’

13.13

Article 8.2 and 8.4 of the OLAF Guidelines provides:

‘2. The DES shall transfer the digital forensic image to the forensic file server in the forensic laboratory. The file thus transferred becomes the forensic work file. The DES should inform the investigator as soon as the forensic work file is ready.

…

4 When the forensic work file is available, the investigator shall launch written requests through the CMS Intelligence Request Module to index the forensic work file and as appropriate obtain the assistance of the DES or operational analyst to identify data relevant for the investigation. The latter request should describe the aim of the search and what type of evidence and/or proof the investigator is searching for. In response to the investigator’s written request and in conjunction with the investigator the DES shall extract data matching the search criteria from the digital forensic work file for read-only access by the investigator.’

Background to the dispute

14.14

The background to the dispute is set out in paragraphs 1 to 23 of the judgment under appeal and, for the purposes of these proceedings, can be summarised as follows:

15.15

Vialto is a company incorporated under Hungarian law which provides advisory services to undertakings and entities belonging to the private and public sectors.

16.16

On 22 April 2011, the Commission concluded a financing agreement with the Republic of Turkey under the system of decentralised management with ex ante control, which formed part of the national programme for the Republic of Turkey under the ‘Transition Assistance and Institution Building’ component of the Instrument for Pre-Accession Assistance (IPA). The designated operating structure, within the meaning of Article 21 of Regulation No 718/2007, was the Central Finance and Contracts Unit (CFCU), a body within the Turkish administration.

17.17

On 17 December 2013, a restricted call for competition for the supply of external quality control services in the context of project TR2010/0311.01 ‘Digitization of Land Parcel Identification System’ (‘the project at issue’) was published in the Supplement to the Official Journal of the European Union (OJ 2013/S 244-423607) under reference EuropeAid/132338/D/SER/TR. The contracting authority designated in the call for competition was the CFCU.

On 19 September 2014, the contract corresponding to that call for competition was awarded to a consortium coordinated by Agrotec SpA composed of five participants, including Vialto (‘the consortium’). The consortium entered into the contract at issue with the CFCU.

Following the opening of an investigation on account of suspected acts of corruption or fraud committed in the context of the project at issue, OLAF decided to carry out checks and inspections at Vialto’s premises (‘the on-the-spot check’).

On 7 April 2016, OLAF issued two mandates designating the officials responsible for carrying out an on-the-spot check and a digital forensic technical operation. Under the terms of those mandates, the purpose of the on-the-spot check was to gather the evidence held by Vialto of its possible involvement in the acts of corruption and fraud alleged to have been committed in connection with the project at issue. The purpose of the digital forensic operation was to obtain, inter alia, digital forensic images of all Vialto’s digital assets used for management of the project at issue, the email correspondence of Vialto and its employees, the functional mailboxes used for implementation of the project at issue and any files or folders on Vialto’s network that might be relevant for the purposes of the investigation.

The on-the-spot check and the digital forensic operation were carried out from 12 to 14 April 2016. A report of each inspection day was drawn up by OLAF. It was noted in the report for 14 April 2016 that Vialto had refused to provide OLAF with certain information. A representative of Vialto signed each of the reports, making comments where necessary.

By letter of 6 May 2016, Vialto lodged a complaint with OLAF in which it disputed or commented on certain information contained in those reports. OLAF replied to its complaint by letter of 8 July 2016.

By letter of 14 September 2016, OLAF informed Vialto that it was considered to be a person concerned for the purposes of the investigation into the suspicions of corruption or fraud in respect of the project at issue and invited it to submit comments within 10 days.

By letter of 23 September 2016, Vialto submitted its observations to OLAF and stated that it had acted in accordance with the applicable rules and complied with all the conditions for legitimate access by OLAF to its data.

By letter of 29 September 2016, the CFCU informed Agrotec that the on-the-spot check had been conducted at Vialto’s premises and that Vialto had not consented to granting OLAF access to certain information requested by the latter in order to carry out its investigation. It added that OLAF considered that, by its conduct, Vialto had infringed Article 25 of the general conditions applicable to the contract at issue (‘the general conditions’), on checks, inspections and audits by bodies of the European Union. It also stated that OLAF was examining the situation with the relevant departments of the Commission. Taking the view that, according to the general conditions, Agrotec was its sole interlocutor for all the contractual and financial issues, the CFCU informed that company that as a precaution it was suspending payment of the invoices submitted by it, at least until the closure of OLAF’s investigation.

By letter of 13 October 2016, the Commission’s Directorate-General for European Neighbourhood and Enlargement Negotiations (‘DG Enlargement’) informed the CFCU of Vialto’s refusal, contrary to Article 25 of the general conditions, to cooperate in the investigation carried out by OLAF and requested it to take the necessary measures pursuant to those general conditions and, in that regard, to consider suspending performance of the contract at issue or the part of that contract performed by Vialto, as one of the possible measures under Articles 25 and 35 of the general conditions. It added that it considered that the amounts paid to Vialto under the contract at issue were not eligible for funding from the EU budget and asked the CFCU to determine the precise amounts involved.

By letter of 9 November 2016, OLAF informed Vialto that its investigation had been closed and that its final investigation report had been forwarded to DG Enlargement, and of the recommendations it had made to that Directorate-General (‘DG’) to take appropriate measures to ensure the application of the procedures and sanctions resulting from Vialto’s serious breach of the general conditions.

By letter of 11 November 2016, the CFCU informed Agrotec of the closure of OLAF’s investigation and of OLAF’s finding that Vialto had infringed Article 25 of the general conditions. The CFCU also informed Agrotec of its decision to exclude Vialto from all aspects of the contract at issue and to continue to perform that contract, instead of following the recommendation of DG Enlargement to suspend performance of the contract. Consequently, the CFCU requested that Agrotec immediately terminate Vialto’s activities and take the necessary steps to exclude it from the consortium, namely, by drafting an addendum to the contract at issue.

By letter of 5 December 2016 addressed to the CFCU, Vialto challenged its exclusion from the contract at issue. The CFCU rejected its arguments by letter of 10 January 2017.

On 13 December 2016, CFCU and Agrotec signed an addendum to the contract at issue in order to remove Vialto from the list of members of the consortium and to give effect to the resulting consequences, particularly the financial consequences.

The action before the General Court and the judgment under appeal

By application lodged at the Registry of the General Court on 7 September 2017, Vialto brought an action seeking an order that the Commission pay it compensation of EUR 320 944.56 and EUR 150000, together with interest, for the material damage and non-material damage respectively that it claimed was caused by the allegedly unlawful conduct of the Commission and OLAF in connection with its exclusion from the contract at issue.

In support of that application, Vialto advanced two complaints relating to OLAF’s alleged unlawful conduct, claiming, first, an infringement of Article 7(1) of Regulation No 2185/96 and, secondly, a breach of the right to good administration and the principles of non-discrimination, proportionality and the protection of legitimate expectations. In addition, Vialto submitted a complaint relating to the Commission’s alleged unlawful conduct, claiming that it had infringed its right to be heard.

During the hearing before the General Court, Vialto waived its claim for compensation for material damage and reduced the sum sought in compensation for the non-material damage allegedly suffered by it to EUR 25000, together with interest.

By the judgment under appeal, the General Court, having held that the Commission had wrongly contested its jurisdiction and, on that ground, the admissibility of the action, dismissed all Vialto’s complaints against OLAF and the Commission.

The General Court held first of all, in paragraphs 69 to 73 of the judgment under appeal, that the data to which the OLAF agents requested access in the present case could be regarded as relevant to the OLAF investigation and that the production of a digital forensic image falls within the powers conferred on the Commission by virtue of Article 7(1) of Regulation No 2185/96. It concluded from the foregoing, in paragraphs 74 and 80 of the judgment under appeal, that, by requesting Vialto to grant access to those data for analysis, the OLAF agents did not commit any violation of that provision.

It then dismissed Vialto’s arguments relating to OLAF’s breach of the right to good administration and the principles of non-discrimination, proportionality and the protection of legitimate expectations. As regards the principle of the protection of legitimate expectations, after recalling, in paragraph 114 of the judgment under appeal, the conditions which must be satisfied for a person to rely on it, in paragraphs 116 and 117 of that judgment, the General Court found that, in the present case, it was following Vialto’s refusal to grant the OLAF agents’ lawful requests for the collection of data that those agents agreed to derogate from the procedure laid down by the OLAF Guidelines as regards the place where the data are obtained and processed and the medium used for that purpose. The General Court concluded from that fact, in paragraph 118 of that judgment, that Vialto cannot rely on a sufficiently serious breach of the principle of the protection of the legitimate expectation which it had placed in the application of a practice derogating in its favour, despite its refusal to grant the requests made by the OLAF agents in accordance with Article 7(1) of Regulation No 2185/96.

Finally, the General Court dismissed Vialto’s complaint relating to the Commission’s infringement of its right to be heard, finding, first, in paragraph 121 of the judgment under appeal, that, by letters addressed to OLAF, Vialto had submitted its observations on the on-the-spot check and, secondly, in paragraph 122 of that judgment, that the decision to exclude Vialto from the contract at issue had been taken by the CFCU, which was not bound by a position adopted by DG Enlargement.

The General Court therefore dismissed Vialto’s action in its entirety without examining the conditions relating to the existence of a sufficiently direct causal link between the alleged conduct or to the damage claimed and the existence of that damage.

Forms of order sought by the parties

By its appeal, Vialto claims that the Court of Justice should:

–set aside the judgment under appeal, and

–order the Commission to pay the costs.

Vialto specifies that, were the Court to set aside the judgment under appeal, it should be a matter for the Court’s discretion to decide whether to refer the case back to the General Court for judgment on the merits.

The Commission claims that the Court of Justice should:

–dismiss the appeal as unfounded, and

–order Vialto to pay the costs.

The appeal

Vialto relies on three grounds in support of its appeal. The first two of those grounds allege that the General Court erred in dismissing the two complaints alleging, first, infringement of Article 7(1) of Regulation No 2185/96 and, secondly, a breach of the principle of the protection of legitimate expectations. The third grounds alleges that the General Court erred in dismissing the complaint alleging infringement of the right to be heard.

The first ground of appeal, alleging infringement of Article 7(1) of Regulation No 2185/96

The first and second parts of the first ground of appeal

– Arguments of the parties

By the first and second parts of its first ground, Vialto claims that the General Court committed several errors relating to OLAF’s powers to have access to and collect data in the context of an on-the-spot check.

In the first place, the General Court allegedly distorted the facts in two ways before concluding, wrongly, in paragraph 80 of the judgment under appeal, that OLAF had not infringed Article 7(1) of Regulation No 2185/96 when it requested Vialto to allow it access to the data referred to in paragraph 71 of that judgment.

First, the case that gave rise to the judgment under appeal concerns whether Article 7(1) of Regulation No 2185/96 was infringed by OLAF’s request to collect those data, not by its request for access to them.

According to Vialto, that distortion caused the General Court to misapply the law, since it should have interpreted the right of access under Article 7(1) of Regulation No 2185/96 as including, on the one hand, a very broad right of investigation applying to all the categories of data referred to in that article and, on the other, a right to collect data limited to data connected with the operations undergoing the check.

Secondly, the General Court misconstrued the facts, failing to find, in paragraph 80 of the judgment under appeal, that Vialto had granted OLAF access to the data at issue. Specifically, the General Court should have taken into account the annex – which Vialto submitted with its application – to OLAF’s report for the third day of the check. According to Vialto, it is clear from that document the Vialto did grant OLAF full access to its accounting system and its transactions.

In the second place, the judgment under appeal does not substantiate the finding, made in paragraph 74 of the judgment under appeal, that the data which OLAF requested to collect in the present case related to the operations concerned and were required for the proper conduct of the on-the-spot check, within the meaning of Article 7(1) of Regulation No 2185/96. That finding is therefore, Vialto contends, arbitrary.

In the third place, that finding, which is repeated in paragraph 83 of the judgment under appeal, is vitiated by an error of law since, prior to any keyword search, it could not be found that all the data requested by OLAF, including all the correspondence and the contents of the computers of two employees of Vialto and the whole of its server and copies of all its transactions since 2012, were connected with the operations under investigation and were required for the investigation, with the effect that OLAF was entitled to collect them.

In the fourth place, the General Court misconstrued the facts by finding, in paragraph 75 of the judgment under appeal, that Vialto merely objected to those data being collected on media to be taken to OLAF’s premises, whereas according to Vialto it objected, from the outset and in general terms, to the collection of data unrelated to the project under review.

The Commission claims that the first and second parts of the first ground of appeal should be dismissed as unfounded.

– Assessment by the Court

First, Vialto’s argument that the General Court misconstrued the scope of the complaint advanced by Vialto in its application at first instance alleging that OLAF’s conduct was unlawful since it infringed Article 7(1) of Regulation No 2185/96, cannot succeed.

It must be observed that the General Court stated, in paragraph 62 of the judgment under appeal, that Vialto complains that OLAF demanded that it be able to collect data unconnected with the project at issue, in breach of that article. In addition, the General Court stated, in paragraph 75 of the judgment under appeal, that Vialto argues that it did allow the OLAF agents access to all the data requested and that it objected only to the collection of those data.

The General Court therefore cannot be found to have interpreted the application at first instance as meaning that the complaint in question concerned whether Article 7(1) of Regulation No 2185/96 was infringed as a result of OLAF’s request for access to those data, rather than in connection with the collection of those data.

Secondly, as regards Vialto’s claim that the General Court misconstrued the facts by failing to find, in paragraph 80 of the judgment under appeal, that Vialto had granted OLAF access to all the data requested, it must be observed that that paragraph concludes the General Court’s reasoning on the interpretation of Article 7(1) of Regulation No 2185/96 and contains no assessment of Vialto’s behaviour. That claim is therefore based on a misreading of that paragraph.

Furthermore, even assuming that, by that claim, Vialto intended to dispute the reasons that led the General Court to conclude as it did, it must be observed that paragraphs 63 to 78 of the judgment under appeal contain no finding that Vialto refused to grant OLAF access to the data referred to in paragraph 71 of the judgment under appeal.

By contrast, in paragraph 79 of the judgment under appeal the General Court found that when the OLAF agents ended the on-the-spot check and the digital forensic operation Vialto had not provided them with the data it considered were covered by professional secrecy or by the contractual clauses on which it relies.

It is important to bear in mind in that respect that, as is clear from the second subparagraph of Article 256(1) TFEU and from the first paragraph of Article 58 of the Statute of the Court of Justice of the European Union, appeals are limited to points of law. The General Court, therefore, has exclusive jurisdiction to make findings in respect of the relevant facts and to assess those facts and the evidence. Accordingly, the assessment of those facts and that evidence does not, save where it distorts those facts and evidence, constitute a point of law which is, as such, subject on appeal to review by the Court of Justice (judgment of 25 February 2021, Dalli v Commission, C‑615/19 P, EU:C:2021:133, paragraph 73 and the case-law cited).

Such distortion must be obvious from the documents in the Court’s file, without there being any need to carry out a new assessment of the facts and the evidence. The appellant must indicate precisely the evidence alleged to have been distorted by the General Court and show the errors of appraisal which, in its view, led to that distortion (judgment of 4 March 2020, Tulliallan Burlington v EUIPO, C‑155/18 P to C‑158/18 P, EU:C:2020:151, paragraph 102 and the case-law cited).

Vialto contends, in essence, that had the General Court taken into account the annex to OLAF’s report for the third day of the on-the-spot check, which contains its comments on the conduct of the check that day, it would necessarily have found that Vialto granted OLAF full access to the data requested.

It must be observed nevertheless that the document in question reproduces Vialto’s observations on the conduct of the check, and is therefore helpful only in establishing its point of view on that conduct. The General Court in fact stated, in paragraph 75 of the judgment under appeal, that Vialto claims that it allowed the OLAF agents access to all the data requested.

It therefore cannot be established, on the basis of the argument put forward by Vialto, that the General Court misconstrued the relevant facts or evidence, and that argument must therefore be dismissed as unfounded.

Thirdly, as regards the allegation that the finding in paragraph 74 of the judgment under appeal fails to state reasons, it must be recalled that, according to consistent case-law of the Court of Justice, the duty to state reasons does not require the General Court to provide an account which follows exhaustively and one by one all the arguments put forward by the parties to the case. The General Court’s reasoning may thus be implicit, on condition that it enables the persons concerned to know why it has not upheld their arguments and provides the Court of Justice with sufficient material for it to exercise its power of review (judgment of 25 June 2020, SatCen v KF, C‑14/19 P, EU:C:2020:492, paragraph 96 and the case-law cited).

In the present case, the General Court stated, in paragraphs 66 to 73 of the judgment under appeal, the reasons that led it to find that the data which OLAF requested to collect related to the operations concerned and were required for the proper conduct of the on-the-spot check, within the meaning of Article 7(1) of Regulation No 2185/96.

It can be seen from those paragraphs that the finding in question is based, first of all, on the wording of Article 7(1) of Regulation No 2185/96, from which it is clear, according to the General Court that, on one hand, OLAF is entitled to have access to all the information and documentation relating to the facts to which its investigation relates and to take copies of the documents required in order to carry out its on-the-spot check and, on the other hand, that OLAF has a degree of discretion to determine the data relevant for that purpose. The General Court then turned its attention to the subject matter of the investigation conducted by OLAF in the present case and to the data requested, which, according to the General Court, fell within the type of data to which Article 7(1) of Regulation No 2185/96 refers. Lastly, the General Court reviewed the specific features of digital forensic operations, including the need to index data, which involves making digital copies of the data in question, in order to identify the documents that are relevant for the OLAF investigation.

That statement of reasons is sufficient, on the one hand, to enable Vialto to understand why its arguments were dismissed and, on the other, for the Court of Justice to exercise its power of review. Vialto’s allegation that the statement of reasons was inadequate must therefore be dismissed as unfounded.

Fourthly, as regards the alleged error of law concerning the interpretation of Article 7(1) of Regulation No 2185/96, it must be observed that the General Court held, in paragraph 74 of the judgment under appeal, that the data which OLAF requested to collect in the present case related to the operations concerned and were required for the proper conduct of the on-the-spot check, within the meaning of that article. The General Court also found, in paragraph 80 of the judgment under appeal, that OLAF did not commit any violation of that provision by requesting from Vialto that it have access to those data for analysis.

Article 7(1) of Regulation No 2185/96 provides that Commission inspectors are to have access, under the same conditions as national administrative inspectors and in compliance with national legislation, to all the information and documentation on the operations concerned which are required for the proper conduct of the on-the-spot checks and inspections. That article specifies that they may avail themselves of the same inspection facilities as national administrative inspectors and in particular may copy relevant documents. That provision also states that on-the-spot checks and inspections may concern, in particular, computer data.

Furthermore, it follows from Article 2(1) of Decision 1999/352 and Article 3(1) of Regulation No 883/2013 that OLAF is to exercise the power to carry out on-the-spot checks and inspections conferred on the Commission by Regulation No 2185/96.

It is clear from those articles read together that, in the context of an on-the-spot check, OLAF agents have access, under the same conditions as national administrative inspectors and in compliance with national legislation, to all the information, including computer data, required for the proper conduct of the on-the-spot checks and inspections and that they can avail themselves of the same inspection facilities as national administrative inspectors and can, in particular, copy relevant documents.

Although, in relation to the conditions governing access to information by OLAF agents, that provision refers to the law of the Member State concerned, it must be observed that Vialto has not made any allegations that OLAF infringed the applicable rules of Hungarian law in connection with the on-the-spot check at issue, and that it has not put forward any argument to that effect.

Furthermore, it must be observed that Vialto has not challenged the findings of the General Court on the production of a digital forensic image, in paragraph 73 of the judgment under appeal, which refers to the explanations in paragraph 44 of that judgment. In those paragraphs, on the basis, in particular, of Articles 4 and 8 of the OLAF Guidelines, the General Court found that, in the context of such a procedure, the production of a digital forensic image of the data on a digital storage medium serves to enable the data to be indexed, which is intended in turn to enable keyword searches using specific forensic computer software in order to identify the documents relevant for the OLAF investigation.

Since, by its line of argument, Vialto appears to be equating the production of such a digital forensic image of all the data stored on certain digital media with copying, for the purposes of Article 7(1) of Regulation No 2185/96, all the documents saved on those media, it must be observed, as the Advocate General observes in point 78 of his Opinion, that this operation constitutes merely an intermediate step in the examination of those data (see, by analogy, judgment of 16 July 2020, Nexans France and Nexans v Commission, C‑606/18 P, EU:C:2020:571, paragraph 63).

Accordingly, even though the production of such an image, in technical terms, necessarily involves temporarily ‘copying’ all the data at issue, at a stage when their relevance has not yet been examined, that operation forms part of the exercise of the right of access to information, enshrined in Article 7(1) of Regulation No 2185/96, since it serves solely to identify the documents that are relevant for the investigation. It cannot be found that, by doing so, OLAF is copying all the documents concerned for the purposes of that provision. It is apparent from the wording and scheme of that article that the right available to an inspector to copy relevant documents, unlike the right to access information, relates to the fact that the inspector may keep durable copies of certain documents, among those to which the inspector had access, identified by the inspector as relevant for the purposes of the investigation and which may be used subsequently in the context of that investigation.

Under those circumstances, it appears that the General Court could correctly find that the production of a digital forensic image of that nature can fall within the powers conferred on OLAF under Article 7(1) of Regulation No 2185/96 to have access to the information required for the proper conduct of the on-the-spot check and to copy the relevant documents.

Therefore, Vialto has failed to demonstrate an error of law vitiating the General Court’s finding, in paragraphs 74 and 80 of the judgment under appeal, that the request made by OLAF to Vialto to allow it to collect the data referred to in paragraph 71 of the judgment under appeal, in order to carry out a digital forensic operation, was not contrary to Article 7(1) of Regulation No 2185/96.

Vialto’s allegation of an error of law in respect of that finding must therefore be dismissed as unfounded.

Fifthly, Vialto’s argument to the effect that the General Court distorted the facts in paragraph 75 of the judgment under appeal is based on a misreading of paragraph 75 of the judgment under appeal and must also be dismissed as unfounded. In that paragraph, the General Court merely noted that Vialto objected to the collection of data on a medium which was to be taken away from its premises, which Vialto does not contest.

The first and second parts of the first ground of appeal should therefore be dismissed as unfounded.

Third part of the first ground of appeal

– Arguments of the parties

By the third part of its first ground of appeal, Vialto submits, first, that in paragraph 77 of the judgment under appeal, the General Court erred in law by dismissing its arguments based on respect for professional secrecy and on the clauses of contracts concluded with its commercial partners as irrelevant for the purposes of finding the European Union to have non-contractual liability. In its view, those arguments are relevant to establishing that OLAF infringed Article 7(1) of Regulation No 2185/96, as they demonstrate that the reservations expressed by Vialto with regard to the collection of data unrelated to the investigation were justified. Under the case-law of the Court of Justice, Vialto was required to prove that the making of such reservations did not constitute an abuse of rights.