Nikolaou: When an Internal Leak Becomes Unlawful Data Processing

Case T-259/03 | Court of First Instance of the European Communities | Second Chamber | 12 September 2007

Practice takeaways: ① An unauthorized disclosure of personal data to a journalist is processing of personal data. ② Publishing personal information in an official press release is also processing. ③ Omitting a person's name does not make information anonymous when the person is nevertheless readily identifiable. ④ An unauthorized leak must have a lawful basis just like other processing. ⑤ An institution cannot justify premature public disclosure merely because the underlying investigation concerns matters of public interest. ⑥ Confidentiality controls matter: where the institution is best placed to explain how an internal leak occurred, its inability to demonstrate adequate controls can have legal consequences.

What happens when information from a confidential EU investigation reaches the press? In Nikolaou, the Court held that leaking personal information to a journalist was itself processing of personal data—and that an unauthorized leak could violate EU data-protection law.

In Nikolaou v Commission, the Court of First Instance—now the General Court—considered disclosures made during an investigation by the European Anti-Fraud Office (OLAF) concerning Kalliopi Nikolaou, a former member of the European Court of Auditors. The case arose as an action for damages under what was then Article 288 EC.

For data-protection purposes, however, the case is much more interesting for a simpler proposition: disclosing personal information is processing, even when the disclosure takes the form of an unauthorized leak.

The Court also rejected the idea that withholding a person's name necessarily makes information anonymous. Information can remain personal data where the surrounding circumstances make the individual readily identifiable.

Background

Kalliopi Nikolaou, a former member of the European Court of Auditors, became the subject of an internal investigation by the European Anti-Fraud Office (OLAF) in 2002. OLAF notified her of the investigation and interviewed her concerning allegations relating to her conduct while serving at the Court of Auditors. She denied the allegations. (Judgment, paras. 148–149.)

Before OLAF formally notified Nikolaou that its investigation had concluded, a journalist from European Voice contacted her and revealed that OLAF had completed the investigation. The resulting article also reported information about what OLAF intended to recommend. (Judgment, para. 150.)

The Court examined the information in the article and concluded that three pieces of information could only have originated from someone working within OLAF—including that the investigation had just ended and that Nikolaou's case would appear in OLAF's annual report. (Judgment, paras. 151–153.)

OLAF subsequently issued a press release that officially confirmed several facts already circulating in the press, thereby increasing their credibility. (Judgment, paras. 185–187.)

Why the case matters

Nikolaou is an early EU decision illustrating how broadly data-protection law treats disclosure.

Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (Regulation (EC) No 45/2001)—the data-protection regime then applicable to EU institutions—defined processing to include the communication of personal data by transmission, dissemination, or otherwise making information available.

The important point is that the definition does not depend on whether disclosure occurs through an orderly institutional process.

A database transfer can be processing. A press release can be processing. And so can a leak to a journalist.

An unauthorized disclosure is not somehow outside data-protection law because the controller did not approve it.

Key holding

The Court's data-protection analysis centered on three points.

1. A leak is processing of personal data

The Court treated the unauthorized transmission of information from within OLAF to a journalist as processing of personal data. The subsequent publication of information through OLAF's press release likewise constituted processing. (Judgment, para. 204.)

The conclusion follows directly from the broad statutory definition of processing, which expressly included communication by transmission and dissemination.

2. Not naming someone does not necessarily make the information anonymous

OLAF's press release did not expressly identify Nikolaou by name.

That was not enough.

The Court concluded that the information concerned personal data because, in the circumstances, Nikolaou was easily identifiable. The earlier publicity surrounding the investigation meant that readers could connect the supposedly unnamed investigation to her. (Judgment, para. 222.)

This is an important distinction between removing a name and actually anonymizing information. Data remain personal when the individual can still be identified indirectly.

3. The disclosures lacked a lawful basis

The leak was not an authorized OLAF disclosure. It therefore could not simply be treated as an exercise of OLAF's legitimate authority to communicate information.

• The Court concluded that the disclosure violated Article 5 of Regulation 45/2001. Importantly, OLAF was in the best position to explain how information from its investigation had reached the journalist, yet it had not demonstrated concrete internal controls capable of ensuring confidentiality and preventing such disclosures. (Judgment, paras. 206–209.)
• The official press release presented a related problem. The Court concluded that publication could not be justified as necessary at that stage because the competent authorities had not yet decided what judicial, disciplinary, or financial action should follow from the investigation. (Judgment, para. 224.)

Public interest in an investigation did not make every disclosure about that investigation necessary or lawful.

Confidentiality is part of the story

The result also reflected the special confidentiality obligations surrounding OLAF investigations.

Article 8 of Regulation 1073/1999 provided that information obtained during internal investigations was protected by professional secrecy and generally could not be communicated to persons other than those whose functions required them to know it. The OLAF Director was also responsible for ensuring compliance with applicable personal-data protections.

Those obligations make Nikolaou more than a case about a rogue disclosure. It illustrates the relationship between data protection and organizational accountability.

Where an institution possesses confidential personal information, the legal question is not limited to whether senior management authorized a disclosure. It can also include whether the institution maintained and enforced safeguards capable of preserving confidentiality.

A brief note on liability

Nikolaou was technically an action for the non-contractual liability of the Community, not a standalone enforcement proceeding under Regulation 45/2001.

The Court therefore also had to determine whether the unlawful conduct amounted to a sufficiently serious breach of rules intended to confer rights on individuals and whether the breach caused compensable harm. It ultimately awarded Nikolaou €3,000.

That liability framework matters to the disposition of the case, but the more enduring data-protection lesson lies in the underlying violations: unauthorized disclosure can itself constitute unlawful processing, and information does not become anonymous merely because a name has been removed.

What the Court did—and did not—decide

The Court did establish that an unauthorized transmission of personal information to the press may constitute processing; that an official press release may independently constitute processing; that indirect identifiability is sufficient for information to remain personal data; and that disclosures by an EU institution must satisfy the applicable lawfulness requirements.

The Court did not hold that OLAF could never communicate publicly about an investigation. Nor does the judgment mean that every press report concerning confidential institutional information necessarily establishes that the institution was responsible for the disclosure. Indeed, the Court carefully separated information that could be attributed to OLAF from allegations and information that were already publicly known or could have originated elsewhere.

That distinction is important. Nikolaou is not a rule against institutional transparency. It is a rule against treating identifiability, disclosure, and lawfulness as disappearing simply because information reaches the public informally or without naming the individual.

Nikolaou under today's EU data-protection framework

Regulation 45/2001 no longer governs data processing by EU institutions. It was replaced by Regulation (EU) 2018/1725, which now provides the principal data-protection framework for EU institutions, bodies, offices, and agencies.

But the central logic of Nikolaou remains recognizable in modern EU data-protection law: personal data include information relating to an identified or identifiable natural person; processing includes disclosure by transmission, dissemination, or otherwise making data available; and removing a name does not necessarily anonymize information if the individual remains identifiable.

The case therefore remains a useful early illustration of a principle that is now fundamental to European data-protection practice:

A disclosure does not stop being data processing because it was unauthorized, and data do not stop being personal merely because the person's name was omitted.

Conclusion

Nikolaou turns an institutional leak into a straightforward data-protection problem.

OLAF possessed information about an identifiable individual. Information from its investigation was transmitted to a journalist. OLAF later publicly confirmed additional information through a press release. Both involved processing, and both remained subject to the rules governing lawful handling of personal data.

The enduring lesson is simple: confidential personal information remains protected at the moment it leaves the organization—whether through an official communication or an unauthorized leak.

Sources

Court of First Instance case materials are available through InfoCuria, the Court of Justice of the European Union's official case-law database.

Search Case T-259/03 on InfoCuria

• Court of First Instance of the European Communities, Second Chamber, Case T-259/03, Kalliopi Nikolaou v Commission of the European Communities, Judgment of 12 September 2007, ECLI:EU:T:2007:254.

Related reading from The de la Torre Review

• “Lindqvist: When a Parish Website Became Data Processing.” A useful companion on the breadth of the concept of processing under EU data-protection law. Lindqvist established early that making personal information available online can constitute processing, while Nikolaou applies the concept to disclosures to the press and official publication. Read the Article.
• “Österreichischer Rundfunk: When Salary Transparency Meets the Right to Privacy.” Rundfunk examines when a public-transparency objective can justify identifying individuals, providing a useful comparison with Nikolaou’s conclusion that OLAF could not justify its premature public disclosure. Read the Article. Read the Article.
• “Bank Austria: Employee Privacy Rights Do Not Belong to the Company.” A useful companion on the treatment of personal information when an EU institution publishes information arising from its official functions, including the limits imposed by data protection and professional secrecy. Read the Article.