The background to the complaint

1. The complainant is a company specialised in the implementation of projects in the field of information technology ('IT'). At the time when the present complaint was submitted, the complainant was a contractor in several framework contracts with the European Commission, among which the ESP DESIS framework contracts[1].

2. In October - November 2006, pursuing a strategy designed to expand its pool of IT experts, the complainant sent job offers to IT professionals who were working for the Commission as external IT consultants. To that end, it used the e-mail addresses which the Commission had set up for its external consultants[2].

3. The Commission asked the complainant to stop sending the recruitment messages and launched an inquiry in order to determine whether the complainant had breached its contractual obligations and/or the rules pertaining to personal data protection. The present complaint concerns primarily the actions taken by the Commission in this regard.

4. In parallel, the complainant alleged that the Commission had assisted its competitors in poaching the complainant's employees by abusing the complainant's confidential data.

The subject matter of the inquiry

5. When the Ombudsman decided to launch the present inquiry, he identified the following allegations and claims:

Allegations:

1. The Commission wrongly accused the complainant of abusing confidential data without clearly stating what was the misconduct committed by it and which legislation, Commission rule or contractual provision the complainant had allegedly breached.
2. The Commission defamed the complainant on the market, revealing to its strategic partners that it was being investigated by the Commission's Security Directorate.
3. The Commission abused the complainant's confidential data and assisted its competitors to cause a serious harm to it by poaching its employees.
4. The Commission failed to reply to the complainant's letter of 5 July 2007 within a reasonable period of time.

In view of the above, the complainant argued that the Commission breached Article 5 (absence of discrimination), Article 6 (proportionality), Article 7 (absence of abuse of power), Article 8 (impartiality and independence), Article 9 (objectivity), Article 10 (legitimate expectations, consistency and advice) and Article 17 (reasonable time limit for taking decisions) of the European Code of Good Administrative Behaviour (the 'ECGAB').

Claims:

1. The complainant claims that it should be recognised that the Commission infringed the ECGAB.
2. The Commission should stop the illegitimate investigation conducted by its Security Directorate and provide access to the complainant to all available information and details concerning the investigation and its legal framework.
3. The Commission should withdraw its letter of 3 July 2007, apologising to the complainant and assuring its strategic partners that the latter complies with all its obligations.
4. The Commission should allow the complainant to implement its business plans undistorted by not intervening in its legitimate practices and recruitment policy.
5. The Commission should provide redress for the problems it caused to the complainant, including its defamation and the serious financial losses.

6. In the course of the present inquiry and after having carefully examined all the information provided to him, the Ombudsman concluded that the complainant wished him to deal with a number of further issues. Although some of these issues were partly covered or alluded to in the allegations and claims set out above, the Ombudsman considered it appropriate to formulate them as separate, additional allegations. The Ombudsman, therefore, requested the Commission to provide him with a supplementary opinion on the following further allegations:

Additional allegations:

1. By forbidding the complainant to send e-mails to experts working at the Commission using the name.surname@ext.ec.europe.eu structure, the Commission acted (i) without a legal basis, (ii) in a discriminatory manner, given that other contractors were allowed to do what the complainant had done, (iii) disproportionately, and (iv) in an abusive manner.
2. The fact that the Commission's instruction to forbid sending e-mails to the complainant was communicated to the entire consortium was disproportionate and harmed the complainant's reputation.
3. The Commission made a disproportionate and abusive threat in its letter of 24 November 2006, namely, that "significant consequences, both on a contractual basis and a general public procurement level, will apply", if its initial finding that the complainant had violated certain contractual or other provisions were confirmed.
4. The Commission failed to comply with the relevant contract and with principles of good administration by (i) copying its letter of 3 July 2007 to third parties and (ii) failing to take remedial action even though the complainant had asked it to do so in its reply of 5 July 2007.
5. The Commission failed to complete its inquiry within a reasonable period of time.

The inquiry

Complaint 1889/2007/VIK:

7. On 12 July 2007, the complainant submitted to the Ombudsman a complaint concerning the issue of recruitment mailings. The complainant pointed out, however, that it had also addressed its allegations and claims to the Commission's Secretary-General. Given that the complainant's letter to the Commission had been sent on 5 July 2007, the Ombudsman considered that the latter had not given sufficient time to the institution to provide a reply, before it proceeded with a complaint to him. The Ombudsman, therefore, closed the case on the basis of Article 2(4) of his Statute and advised the complainant of the possibility to renew its complaint, if the Commission were to fail to provide a satisfactory reply within a reasonable period of time. Given that the complainant's grievances inter alia related to data protection issues, the Ombudsman also informed the complainant of the possibility of filing a complaint with the European Data Protection Supervisor ('EDPS').

Complaint 2395/2007/VIK:

8. On 14 September 2007, in a further letter to the Ombudsman, the complainant submitted that it had not yet received an answer from the Commission's Secretary-General to its letter of 5 July 2007. The complainant, thus, requested the Ombudsman to examine the grievances brought to him in the framework of complaint 1889/2007/VIK. The complainant added the allegation that the Commission had failed to reply to its letter of 5 July 2007 within a reasonable period of time. The complainant's renewed complaint was registered as complaint 2395/2007/VIK.

9. On 23 October 2007, the Ombudsman opened an inquiry into this case and asked the Commission to submit an opinion.

10. On 23 November 2007, the complainant forwarded to the Ombudsman copies of its further correspondence with the Commission related to the present complaint.

11. On 14 January 2008, the Commission provided preliminary comments on the complaint. The institution informed the Ombudsman of the existence of a separate complaint, submitted to the EDPS, which according to the Commission was based on the same set of facts. The Commission thus invited the Ombudsman to consider the risk of an overlap between the inquiries carried out by him and the EDPS. In order to allow for both inquiries to be conducted in an orderly manner, the Commission proposed the following approach:

• The Commission would take a final decision on its investigation concerning the recruitment mass-mailings within a reasonable period of time.
• The Commission would communicate its final decision immediately to the complainant.
• The Commission would simultaneously forward its decision to the EDPS.
• The EDPS would analyse the facts at the origin of the complaint he had received in the light of his special expertise in the field of data protection.
• Once the EDPS adopts a position on the complaint he had received, the Commission would inform the Ombudsman about it, unless the EDPS does so himself.
• The Ombudsman would resume at this stage his inquiry, in order to deal with any remaining aspects linked to possible instances of maladministration by the Commission.

12. On 30 January 2008, the Commission took a final decision on the inquiry it had launched in relation to the recruitment mailings sent by the complainant.

13. On 20 February 2008, the Ombudsman invited the complainant to submit observations on the Commission's preliminary comments. On the same date, he informed the Commission that he considered it useful to obtain the complainant's observations on the Commission's preliminary comments before deciding on how to proceed in this case.

14. On 31 March 2008, the complainant sent its observations on the Commission's preliminary comments. The complainant took the view that its complaint to the Ombudsman and the complaint pending before the EDPS - submitted by someone else - were to be distinguished. It authorised the Ombudsman to forward a copy of its complaint to the EDPS for information. The complainant reiterated its firm belief that the Ombudsman was the competent authority to decide on the present complaint. It recalled that the Commission had taken a final decision on its inquiry concerning this matter[3] and invited the Ombudsman to consider the Commission's findings in this respect.

15. On 29 April 2008, the Ombudsman forwarded to the EDPS a copy of the present complaint and informed him of the Commission's proposals regarding the procedural approach to be adopted in this case. In light of these proposals, the Ombudsman requested the EDPS to inform him - to the extent that this was possible - about the complaint submitted to him, its possible relevance for the present inquiry and the date by which the EDPS envisaged to complete his inquiry.

16. On 12 November 2008, the EDPS forwarded to the Ombudsman a copy of the final decision that he had adopted on the complaint submitted to him.

17. On 22 January 2009, the Ombudsman thanked the EDPS for having provided him with the above information and asked if a copy of this decision could be forwarded to the complainant for its complete information. On the same day, the Ombudsman informed the complainant accordingly and requested the Commission to complete its opinion on the present complaint by addressing those points on which it had not yet commented.

18. On 7 April 2009, the EDPS informed the Ombudsman that the complainant in the present case had made a request for access to the final decision he had adopted in the case submitted to him. After having analysed the circumstances of the case, the EDPS had decided to grant access to his decision.

19. On 18 June 2009, the Commission sent its supplementary opinion concerning the subject-matter of the present complaint, which the Ombudsman forwarded to the complainant. The latter provided observations on 15 October 2009.

20. On 30 April 2010, after having carefully analysed all the information provided in the course of the present inquiry, the Ombudsman identified a number of further allegations and requested the Commission to address them[4]. The Ombudsman informed the complainant accordingly.

21. The Commission provided its further opinion on 13 October 2010. The complainant sent additional observations on 15 November 2010.

22. In its last observations, the complainant argued that, as a result of the Commission's actions, many of the latter's officials avoided systematically and by all means to assign work to the complainant, thus preventing it from optimally implementing its contracts. In addition, the complainant's business partners also ceased cooperating with it. The Ombudsman notes that these are new elements, introduced by the complainant at a very late stage of the present inquiry. What is more, the complainant did not back up its relevant statements by concrete evidence. The Ombudsman does not, therefore, consider it appropriate to assess and pursue them in the context of the present inquiry.

The Ombudsman's analysis and conclusions

Preliminary remarks

(i) Concerning the scope of the present inquiry:

23. In its opinion, the Commission made the following preliminary observations:

• The present inquiry should focus on facts and on whether those facts constitute maladministration, rather than on judgements about the Commission's alleged intentions.
• The language used by the complainant was inappropriate and the allegations it had made against numerous Commission officials were unjustified.
• The Commission focused on the precise allegations and claims identified by the Ombudsman, without elaborating on the various additional allegations and claims advanced by the complainant, which fell outside of the scope of the present inquiry. The Commission, however, dismissed these allegations in general. The institution added that the complainant was a very important provider of IT services for the Commission and that it is very much respected by it.
• The complainant had submitted the present complaint at a time when the procedures against which it complained were still ongoing. This approach had forced the Commission to mention a number of documents which were sent after the submission of the present complaint. The Commission pointed out, however, that the scope of the present complaint could not automatically be enlarged so as to cover allegations postdating the submission of the original complaint and that it was for the Ombudsman to consider whether any such allegations would be admissible in the context of the present complaint.
• The Commission finally recalled the approach adopted by the Ombudsman in similar cases involving issues of a contractual nature, which was limited to the review of whether the relevant institution or body had provided him with a coherent and reasonable account of the legal basis for its actions and why it believed that its view of the contractual position was justified.

24. In its observations, the complainant clarified that the essence of the present complaint did not concern the issue whether there had been an infringement of the parties' contractual obligations. The case instead concerned the Commission's measures vis-à-vis the complainant and the question whether these measures were proportionate to the aim pursued and consistent with the provisions of the ECGAB.

25. The complainant disagreed with the Commission's view that its allegations are based on the interpretation of the Commission's intentions. It argued that it had communicated promptly to the Commission all the incidents that, in its view, illustrated that the institution intended to harm the complainant's interests and that it took specific action to that end.

26. The complainant asserted that, once it had started reporting irregularities on the part of the Commission and bringing cases before the General Court or the Ombudsman, the Commission adopted "a very hostile attitude", which from 2006 onwards turned into a systematic effort to exclude it from all contracts for IT services. In this context, the complainant alleged, in general terms, that it was being "harassed and blacklisted" by the Commission.

27. The Ombudsman observes that the complainant has raised the above-mentioned general issue regarding its relationship with the Commission in the framework of all its complaints against the Commission and in separate correspondence that is not related to a specific complaint[5]. The complainant asked the Ombudsman to open an own-initiative inquiry against the Commission in this context. The Ombudsman has already addressed this issue[6], and there is therefore no need to deal with it in the framework of the present complaint.

28. The Ombudsman's examination in the present case will, therefore, be limited to the allegations and claims set out in paragraphs 5 and 6 above.

(ii) Important developments that have occurred after the launching of the present complaint:

29. Two important developments have taken place after the launching of the present inquiry by the Ombudsman[7]:

• the Commission has completed its investigation into the recruitment mailings sent by the complainant;
• the EDPD has also completed his investigation relating to the complaint from a third person brought before him.

30. The Commission closed its investigation with the following findings:

"The findings of the enquiry conducted by the Security Directorate concerning the facts of the case have not been disproved. The Commission is however not in a position to confirm that [the complainant] infringed the contractual obligations on data protection, confidentiality and use of information, however likely these infractions may be. The Commission confirms that [the complainant] committed an infraction of Art.I.18.3 of the ESP DESIS Framework Contracts regarding the distribution of information. However, taking into account the length of the procedure, the Commission will not take any further action.

The Commission considers the enquiry on a possible breach of contract closed. The Commission however reserves its right to seek redress from [the complainant] against any and all claims and causes of action by third parties for breach of any laws or regulations on the protection of personal data or the confidentiality or integrity of informatics systems [emphasis by the Commission].

31. As far as the overall procedure is concerned, the Commission added that the protection of the personal data of its internal and external staff was and would continue to be an area of paramount concern for the institution, that its investigation "was conducted in good faith and in a fully transparent way", and that its "sole objective was the implementation of contractual provisions and the respect of the Financial Regulation".

32. As for the EDPS's investigation, it focused on the evaluation of the "security and organizational measures adopted by the Commission in order to protect the data in the Commission directory as well as the protection provided to Commission e-mail addresses against unsolicited e-mail."

33. In his decision, the EDPS arrived at the following conclusions, which the Ombudsman considers to be relevant for the present case:

• The names, surnames and internal e-mail addresses of the Commission's external personnel (consultants) constitute personal data, given that these data are related to identified individuals. It was the Commission's responsibility to ensure their adequate protection.
• The EDPS did not evaluate the allegedly unsolicited communications, which had been made by a private party from a private e-mail address, as this was outside the scope of application of Regulation 45/2001[8] and would fall under the competence of the relevant national data protection authorities. The EDPS, however, noted that the personal data used by that private party to conduct a mass-mailing operation with job offers could only have been extracted from the Commission's Directory[9], and could not have been obtained from external sources such as the Internet.
• The EDPS took the view that the "security and organizational measures adopted by the Commission" were in principle reasonable in relation to the risks represented by the processing and the nature of the personal data to be protected. Nevertheless, the EDPS recommended the Commission to take the following measures to strengthen the level of data protection: (i) to evaluate whether it was necessary to implement more restrictive rules for the search options offered by the Commission Directory in view of avoiding possible misuses; (ii) to adopt a policy on conserving logs of privileged access to the Commission Directory; (iii) to conduct an analysis in order to identify whether the adoption of other technical measures would be necessary to prevent future unsolicited communications.

(iii) Concerning the structure of the present decision:

34. Given that the complainant's initial allegations and claims, as well as its further allegations, which the Ombudsman included in the present inquiry, are closely linked, the Ombudsman considers it useful and appropriate to address these issues by grouping the relevant arguments as follows:

• the Commission's investigation relating to the recruitment mailings sent by the complainant (section A below covering the complainant's initial allegation 1, its claim 2 and the further allegations 1- 3 and 5);
• the alleged defamation of the complainant resulting from the Commission's letter of 3 July 2007 (section B below covering the complainant's initial allegation 2, the related claim 3 and the additional allegation 4);
• the Commission's alleged involvement in the poaching of the complainant's employees by other companies (section C below covering the complainant's initial allegation 3 and the related claim 4);
• the Commission's alleged failure to reply to the complainant's letter of 5 July 2007 within a reasonable period of time (section D below covering the complainant's initial allegation 4);
• the Commission's alleged violation of the ECGAB (section E below covering the complainant's claim 1); and
• the complainant's claim for damages (section F below covering the complainant's claim 5).

A. As regards the Commission's investigation relating to the recruitment mailings sent by the complainant

Arguments presented to the Ombudsman

Concerning the Commission's decision to investigate the recruitment mailings and the legal basis for its investigation

35. In its complaint to the Ombudsman, the complainant strongly protested against the Commission's decision to launch an inquiry concerning the recruitment e-mails sent by it. It argued that it did not in any way use any information internal to the Commission and that it did not violate any rule known to it. The complainant submitted that it simply made use of public information broadly and generally accessible to everyone, which the complainant's recruitment and human resources department had diligently collected on the market. The complainant was not aware of any restrictions preventing it or any other entity from e-mailing or using the telephone to call an expert working in the Commission's premises. The complainant alleged that the Commission had failed to state the legal basis for its actions in this regard.

36. In its opinion, the Commission explained that it had received reports about the dispatch of the mass mailings in November 2006. Given that these reports indicated that the e-mails in question were unsolicited, the Commission wrote to the complainant in order to make sure that the latter would discontinue sending the mass recruitment e-mails. Shortly afterwards, namely, on 24 November 2006, the Commission informed the complainant about the precise provisions that, subject to the final outcome of the investigation, might have been breached. The relevant section of the Commission's letter read as follows:

"It also appears that regulatory and contractual data protection, confidentiality and security provisions and obligations may have been infringed in a systemic way as Commission internal information and personal data of individuals have been obtained, stored and processed without any authorisation.

Possible violations, in particular of Art.I.8.2, II.16 and II.18 of the Framework Contract, of Art. 21, 22 and 23 of Regulation (EC) 45/2001 of 18.12.2000, of the Administrative Notice 45-2006 of 15.9.2006 and of Art. 2.2., Annex II and Annex III of the General Terms and Conditions for Information Technologies Contracts, and, in general, of other legal provisions under national law stipulated in Art. I.7.1 of the Framework Contract will be investigated more closely".

37. Following the comments provided by the complainant, the Commission subsequently retained only three of the provisions listed above, namely, Article I.8.2 (Data Protection), Article II.16 (Confidentiality) and Article II.18 (Use, distribution and publication of information) of the ESP DESIS framework contracts.

38. According to the Commission, the complainant was thus able immediately to identify the relevant provisions. The latter had done so, since, in its letter of 5 December 2006, it was able to submit detailed comments in support of the view that no breach of the said provisions had occurred. The Commission concluded that the complainant was thus clearly aware of the provisions involved when it submitted its initial complaint to the Ombudsman. The fact that from the very beginning the complainant disagreed with the Commission's preliminary assessment relating to possible breaches did not mean that the institution had failed to inform it of the relevant legal basis.

39. The Commission recalled that the procedure it had followed involved two separate aspects:

1. assessment of the situation from a legal and contractual point of view, which was carried out by the Commission's Directorate-General "Informatics" ('DG DIGIT') on the basis of the relevant framework contracts, which provided the legal basis for this part of the procedure;
2. an independent inquiry aimed at determining the factual circumstances surrounding the dispatch of the mass mailings and ascertaining whether personal data could have been sent to external recipients from within the Commission. This inquiry had to gather any relevant evidence from the Commission's infrastructure, such as the e-mail system. Therefore, this inquiry was essentially of an internal nature and the Commission's Security Directorate was entrusted with it. The inquiry was carried out on the basis of Commission Decision C(94)2120 of 8 September 1994 on the tasks of the Security Office.

40. The Commission referred to the decision of the EDPS, in which he pointed out that "the names, surnames and internal e-mail addresses of the Commission's external staff (consultants) constitute personal data and that it was the Commission's responsibility to ensure the adequate protection of this data"[10]. Considering that the Commission had received reports that at least some of the complainant's e-mails had been unsolicited, the Commission was entitled to take action on the basis of Regulation 45/2001, in order to ensure adequate protection of these personal data and to clarify what had actually happened.

41. In its observations, the complainant argued that, by simply quoting the applicable contractual provisions and by stating that a "possible violation" of those provisions had taken place, the Commission did not offer an adequate justification for its allegations against the complainant. In the complainant's view, the institution failed to analyse and inform the complainant how the factual background of the complainant's case could be related to the said contractual provisions.

Concerning the Commission's alleged instructions to the complainant to stop sending the recruitment mailings

42. The complainant pointed out that when, on 5 December 2006, it communicated its views to the Commission, the latter was unable at that point in time to determine whether the complainant had infringed its contractual obligations and, if so, to what extent and with what consequences. Although no infringement of the respective contractual terms had been established, the Commission nevertheless ordered the complainant to stop contacting possible candidates. The complainant alleged that, in the absence of any final decision regarding this matter, the Commission had no legal basis for ordering it to discontinue sending the recruitment e-mails in question.

43. The complainant stated that, when the Commission subsequently closed its investigation, it concluded that the complainant had not infringed its contractual obligations. The corresponding contractual terms did not foresee any possibility for the Commission to take any preventive measures in this regard. This was a clear indication that the Commission's actions were not based on any legal basis.

44. In any case, even if one were to assume that the Commission had a legitimate interest to conduct an investigation in order to protect personal data, the "penalty" on the complainant should have been imposed eventually only after the Commission's inquiry had been concluded and not before. The complainant reiterated its view that the findings of the investigation had proven that there was no misconduct whatsoever on its part. The Commission had, therefore, left it exposed to a serious accusation for more than one year without justification, causing it and its reputation serious damage.

The Ombudsman's further inquiries

45. After having analysed the above positions of the parties, the Ombudsman asked the Commission to address certain additional aspects concerning its inquiry into the recruitment mailings. The Ombudsman noted that the complainant had clarified that its complaint did not concern the result of the Commission's assessment on whether or not it had infringed its contractual obligations and that the Commission concluded that the complainant had "committed an infraction of Art.I.18.3 of the ESP DESIS Framework Contracts regarding the distribution of information". The Ombudsman thus requested the institution to explain how such a violation entitled it to ask the complainant to stop sending e-mails using the said structure, given the complainant's argument that the first of the relevant contracts was only signed on 18 December 2006.

46. In its further opinion, the Commission recalled the EDPS's explicit conclusion that the information used for the mailings constituted "personal data" in the sense of Regulation 45/2001. This fact alone entitled and even required the Commission to take appropriate measures, particularly in view of the absence of proof of unambiguous consent by the addressees, which the complainant never provided.

47. The Commission explained in more details the precise context in which the decision to ask the complainant to stop sending the e-mails was taken. According to the institution, the scale of the mailings appeared to be "massive and very well targeted". As its inquiry confirmed, at least some of the addressees had not given their consent to receive the mailings. While immediate action appeared necessary, the situation was extremely complex from a legal point of view, since the Commission had to consider the following legal aspects:

• the obligations of the complainant's consortium vis-à-vis the Commission under the ESP DESIS framework contracts, which were about to be signed;
• the obligations of the complainant vis-à-vis the Commission under the various framework contracts[11], which were then in force;
• the Commission's obligations vis-à-vis the other future ESP DESIS contractors;
• the Commission's obligations vis-à-vis the contractors under other framework contracts which were then in force and in particular those under which external consultants were then working at the Commission's premises, as these consultants were the main target of the mailings;
• the direct obligation of the Commission vis-à-vis the "data subjects", i.e., the addressees of the mailings, in particular under Regulation 45/2001;
• the possible repercussions under the national law stipulated in the contracts and/or under the national law applicable in the field of data protection, since in this case the operations had a cross-border dimension.

48. The Commission pointed out that the correspondence it had sent to the complainant during this period "did not refer exclusively to the breaches of the contract". It also made it clear that as a result of the complainant's initiative the Commission perceived a risk that it could be held liable under Regulation 45/2001. In light of the EDPS's conclusions, no such further actions were eventually necessary, as the EDPS decided to limit the scope of his inquiry to a general evaluation of the security and organisational measures adopted by the Commission in order to protect the data in its Directory and its e-mail addresses against unsolicited e-mail. The Commission stated that the decision of the EDPS to abstain from inquiring further about the Commission's liability under Regulation 45/2001 vis-à-vis the data subjects following the said mailings was "precisely a consequence of the Commission's prompt request for discontinuation of the mailings".

49. The fact that the ESP DESIS framework contract had not yet been signed when the Commission asked the complainant to discontinue sending the mailings was addressed in the Commission's conclusions following the latter's inquiry into the recruitment mass mailing. As pointed out above, the ESP DESIS framework contracts were not the only aspect considered relevant when the Commission requested the complainant to stop sending the e-mails. In addition to Regulation 45/2001 and potentially provisions of national law of several Member States, the existing contracts - both with the complainant and its competitors - were also relevant for this case. These contracts contained provisions similar to the ones of ESP DESIS. Furthermore, the addressees of the mailings were working precisely on the basis of these contracts.

50. The Commission added that the draft ESP DESIS framework contract was part of the tendering specification for the call for tenders and the complainant had been aware of its contents since the end of December 2005[12]. The tender specifications contained a standard statement saying that the very fact of submitting an offer implied that the tenderer accepted all the terms and conditions as stipulated therein and in all other documents related to the procurement. In early November 2006, the Commission communicated to the tenderers the results of the evaluation and was in the process of finalising the contracts for signature. Moreover, the recruitment messages sent by the complainant referred specifically to the ESP DESIS framework contracts and the complainant presented itself as "the contractor" rather than as a "future contractor" or "one of the successful tenderers".

51. The Commission remarked that, in these circumstances and while the precise scope of the strict legal obligations incumbent upon the future contractors at that very late stage of the procurement procedure may be debatable, the very least it was entitled to expect from future contractors was "not to act in patent contradiction with the terms and the spirit of the Framework Contracts". The Commission added that, in addition to the principle of good faith, the law of several Member States recognised the concept of "pre-contractual liability" in similar circumstances and some even developed an elaborate doctrine known as "culpa in contrahendo".

52. In view of the above, the Commission concluded that its actions could not be described as illegal.

53. In reply to the complainant's additional allegation that the Commission had communicated its instructions to the complainant to discontinue the dispatch of the mass mailings to the entire consortium, the Commission clarified that it "did not communicate its instruction to stop the mailings to the complainant's consortium partners". The complainant's partners were informed about the Commission's investigation and therefore only "indirectly" about the said instructions, and that only several months later.

54. In its further observations, the complainant reiterated its position that it was entitled to use the names of the persons to send e-mails to them and that the Commission never presented to it "any rule which could be applied to prevent [the complainant] from using the telephone of the EC or the email to contact a person which offered its consent for it". The complainant remarked that the Commission failed to provide any evidence to show that some of the addressees of the mailings had not given their consent. The Commission in any event ordered the complainant altogether to stop sending the recruitment mailings, even to those persons who had clearly given their consent to receive such messages. Even if one were to assume that some people had not given their consent, the Commission should have invited the complainant to abstain from contacting those persons, instead of blocking all communication of the complainant with the relevant market.

55. The complainant added that the Commission's comments that the scale of the mailings "appeared to be massive and very well targeted" lacked any foundation and could not possibly justify "the hostile action on the part of the Commission".

56. The complainant recalled in this context that its communications with the experts regarding the consent constitutes private data, which the complainant did not want to disclose to the Commission.

57. The complainant considered that the list of complex legal issues that the Commission presented was "out of place" for the following reasons:

• the Commission could not refer to obligations arising from a contract that was not signed. Even though the Commission referred to a pre-contractual liability, this could not possibly extend to the alleged abuse of private data, which the complainant never accessed in the course of the implementation of a contract that had moreover not yet kicked off;
• the other framework contracts in force at the time and referred to by the Commission had nothing to do with the case at stake;
• the Commission had no obligations vis-a-vis the data subjects and even in case of an alleged infringement of private data, this would be an issue between the complainant and the addressee and not between the complainant and the Commission. The Commission could "attack" the complainant only if the latter infringed its own contractual obligations in any way. The complainant, however, never did so and never had access to the private data it had allegedly misused.

Concerning the allegedly discriminatory nature of the Commission's actions

58. As regards the allegation that the Commission's actions were discriminatory, the Commission noted that the complainant had never provided any evidence of unsolicited communications received by its employees at the e-mail addresses provided to them by the Commission. The complainant had only referred generally to attempts by other companies to poach its employees. The Commission had clearly expressed its view that it cannot and will not interfere with the employment policy of its contractors[13]. This issue is, however, different from the protection of personal data of individuals or the protection of confidential information.

59. The Commission stressed that it had stated at a very early stage in this process and repeated several times afterwards that, if presented with evidence of similar activities by the complainant's competitors, it would have undertaken the same action. The complainant, however, did not provide such evidence, or at least an indication thereof.

60. In its further observations, the complainant remarked that another company, which is also a contractor of the Commission, had received "to the best of the complainant's knowledge even officially from the Commission" a list of the experts in place and "it was encouraged to approach them one by one". The said contractor used this method in order to poach the complainant's staff. In this case, the Commission allegedly ignored its "sensitivities" relating to private data and its obligations to the complainant as one of the Commission's contractors. In the complainant's view, this was an indication that the Commission used "double standards" in this regard.

Concerning the Commission's letter of 24 November 2006

61. On 24 November 2006, the Commission wrote the following to the complainant:

"This is to inform you that an internal investigation has been initiated concerning the mass mails that your company sent to external intra-muros consultants using the fn.n@ext.ec.europa.eu addresses of potential targets. Please note that initial results of an internal consultation with Commission services do indicate that these mass mails may, without prejudice to the final results of the internal investigation, constitute a serious breach of various contractual obligations. [...]

Should the initial analysis be confirmed by final results of this investigation, significant consequences, both on a contractual and a general public procurement level, will apply.

In addition, we have indications that your company may have continued the mailings as well as issued a large number of unsolicited phone calls to external staff from other companies working on the Commission's premises in spite of the explicit instructions that had been given to it in previous letters. In order to verify this situation, I should like to ask you to submit written evidence proving either prior authorisation related to the above mass mailings and/or the prior consent of all contracted external Commission staff..."

62. The complainant alleged that the Commission made a disproportionate and abusive threat in its letter, namely, that "significant consequences, both on a contractual basis and a general public procurement level, will apply" if the Commission's preliminary findings were to be confirmed.

63. The Commission explained that the above letter should be seen "in the context of its initial immediate priority, which was to require the complainant to stop the mailings". It recalled that at that point, "the complainant did not appear to be willing to accept the Commission's instructions readily". For example, in its e-mail of 9 November 2006, the complainant attempted to set a one-day deadline, after which it would resume the mailings.

64. The letter of 24 November 2006 was the Commission's response to the complainant's repeated demands to be provided with a statement of the relevant grounds for the Commission's request and other announced actions. Given the circumstances, it was not and could not be a final, elaborate legal analysis of the situation and its consequences, not least because the investigation about the facts had just been initiated. The Commission added that during the first six weeks it exchanged with the complainant at least 12 communications, of which seven in the first week alone.

65. The contested statement was "not meant to threaten the complainant, but simply to inform it that the Commission did not regard this episode as a minor incident". The Commission added that it is good administrative practice to inform the party concerned of the possible consequences of its acts or of pursuing a certain course of action. The Commission concluded that, while the wording of the letter "might have been improved, there was surely nothing threatening, abusive or disproportionate in it".

66. The Commission further clarified that it had first asked the complainant to stop sending the said e-mails; it then provided the complainant with a preliminary assessment of the contractual and legal provisions which had possibly been breached. The Commission subsequently launched an internal investigation limited to the factual aspects and finally, based on the findings of the investigation, provided the complainant with an opportunity to express its views before the Commission finalised its position. The Commission recalled that it had closed its inquiry without any further action, because it could not establish how the list in question had reached the complainant. The institution thus concluded that the above-mentioned steps clearly showed that its approach had been fair and appropriate.

67. The complainant expressed its firm belief that the Commission launched its investigation in order to "neutralise" it for one whole year, thus allowing its competitors to position themselves and secure a great share of the market. It took the view that the Commission's actions to that effect were disproportionate and abusive and that the institution could instead simply have invited it to discuss the issue in order to arrive at a more reasonable decision concerning this matter.

68. In its further observations, the complainant reiterated that the only area where the Commission could possibly intervene was to check whether the complainant had illegally accessed private data of third parties, thereby abusing its access rights arising from its contracts with the Commission. The complainant maintained its view that "by ordering the complainant to cease contacting the market and by spreading the rumour that the complainant was in default", the Commission acted abusively.

Concerning the length of the Commission's investigation

69. The Commission acknowledged that it took a long time to conclude the inquiry. It added, however, that on 19 October 2007 it had provided the complainant with an explicit apology for this delay. The Commission accepted that the length of the inquiry might have caused undue uncertainty and inconvenience to the complainant. The institution, however, took into consideration the duration of the inquiry as a relevant factor in the context of its final decision.

70. In his request for further information from the Commission, the Ombudsman noted that the institution did apologise for the delay that had occurred[14]. The complainant, however, did not consider this apology to be sincere. The Ombudsman noted that the Commission's investigation clearly affected the complainant's interests, not least because the Commission had from the very beginning asked the complainant to stop sending the relevant recruitment e-mails. However, nearly one year elapsed between the Commission's letter of 7 November 2006 announcing an inquiry and its letter of 19 October 2007 setting out its provisional conclusions.

71. In its further opinion, the Commission reiterated its position. It added that the resources it can mobilise for security-related investigations are necessarily limited and priorities needed to be allocated. The Commission mentioned that a few weeks before the mailing started a horrendous assassination of a Commission official and his wife had taken place in a third country. This event absorbed the entire investigative capacity of the department in charge. The Commission regretted that the complainant did not consider its apology to be sincere.

72. In reply, the complainant asserted that the heart of the Commission's inquiry "was of technological (i.e. IT) character" and had to be conducted by DIGIT itself. The complainant asserted that it knew for a fact that DIGIT could investigate "in a few minutes" if the complainant or any other user had unlawfully had access to the data in question, since the Commission's IT resources were all built in a manner that allows the IT administrators to detect who had access to such IT applications, when and for what purpose. The Commission thus knew within hours that the complainant had never accessed any of the Commission's resources.

73. The complainant considered the Commission's position that it had to wait for the overloaded security department to investigate the case to be insincere. In any event, the Commission should not oblige the complainant to cease any contact with the market for nearly an entire year because of its inability rapidly to conduct an investigation.

74. In view of its long experience in the field of IT and its obligation to protect private data, the complainant considered that the Commission had all the necessary knowledge, skills and monitoring procedures in place in order to deduce that the complainant had simply followed a common practice. In its view, the Commission's position that any person within the institution could possibly extract from its IT systems private and sensitive data without leaving any trace was totally insincere.

Concerning the claim that the Commission should stop its investigation

75. In its complaint, the complainant claimed that the Commission should stop the investigation conducted by its Security Directorate and should grant it access to all the available information and details concerning the investigation and its legal framework.

76. In its opinion, the Commission submitted that the present claim had become devoid of purpose, given that the relevant inquiry had in the meantime been closed and its results duly communicated to the complainant.

77. In its observations, the complainant acknowledged that its request had become without object. It argued, however, that the outcome of the investigation, which proved that it did not infringe its contractual obligations, showed that it had a legitimate interest in including such request.

The Ombudsman's assessment

78. In the present case, the complainant requested the Ombudsman to assess whether the Commission's actions vis-à-vis the complainant were legal and consistent with the principles of good administration. The Ombudsman will consequently focus on this central element of the complaint.

79. The Ombudsman's analysis will not touch upon the question whether the Commission breached the applicable data protection legislation. This issue falls within the EDPS's specific competences. Moreover, the latter has already completed an investigation regarding this matter. In his analysis, the Ombudsman will, however, refer to the EDPS's findings, when relevant.

80. The Ombudsman recalls that the complainant clarified in its observations that "the essence of the complaint is not to examine whether there has been or not an infringement of the parties contractual obligations, but to ensure that the measures taken by the Commission were proportional to the aim pursued and that it was consistent with its administrative behaviour as it is foreseen in articles 5 to 10 of the European Code of Good Administrative Behaviour". The Ombudsman will, therefore, assess the complainant's allegations and claims accordingly and will not seek to establish whether the parties had committed violations of any of their contractual obligations, stemming from either the ESP DESIS framework contracts or any other contract.

81. Before addressing the specific issues raised by the complainant, the Ombudsman considers it important to recall the principles of good administration, which the Commission had to respect in handling the contested investigation.

82. Article 41 of the Charter of Fundamental Rights of the European Union (right to good administration) provides that "every person has the right to have his or her affairs handled impartially, fairly and within a reasonable time by the institutions and bodies of the Union". This right includes "the right of every person to be heard, before any individual measure which would affect him or her adversely is taken" and "the obligation of the administration to give reasons for its decisions".

83. The principles of good administration are further defined in the ECGAB. The complainant argued that the Commission breached in particular Article 5 (absence of discrimination), Article 6 (proportionality), Article 7 (absence of abuse of power), Article 8 (impartiality and independence), Article 9 (objectivity), Article 10 (legitimate expectations, consistency and advice) and Article 17 (reasonable time limit for taking decisions).

84. It follows from the above provisions that it is good administrative practice for the administration, when launching administrative inquiries or investigations, to inform the parties concerned of the legal basis for its actions[15]. The institution must also set out the basic elements of the inquiry, such as who will be investigated and what the scope of the inquiry and its subject-matter are. It should further clarify the procedural rights of the parties, including the right to be heard, the expected timeline/duration of the inquiry, the confidentiality of the proceedings and any other relevant issues. The administrative investigations must respect the presumption of innocence. They should be carried out fairly and objectively and be concluded with a duly reasoned decision taken within a reasonable period of time. If the inquiry procedure is based on a specific legal act, the interested parties must be informed about this act and any other pertinent legislation.

85. Against this background, the Ombudsman will address the specific allegations and claims raised by the complainant concerning this matter.

Concerning the complainant's first allegation[16]

86. The complainant alleged, in the first place, that the Commission failed clearly to inform it what the misconduct committed was and which legislation, Commission rule or contractual provision it had allegedly breached.

87. By letters dated 7 and 9 November 2006 the Commission informed the complainant that its Security Directorate and the Data Protection Officer would carry out an investigation that would "cover IT security aspects as well as data protection regulations" in relation to the e-mails the complainant had addressed to external experts working at the Commission. On 10 November 2006, the institution stated that the complainant might have infringed "regulatory and contractual data protection legal provisions and obligations". On 24 November 2006, the Commission provided the following specific information:

"Possible violations, in particular of Art.I.8.2, II.16 and II.18 of the Framework Contract, of Art. 21, 22 and 23 of Regulation (EC) 45/2001 of 18.12.2000, of the Administrative Notice 45-2006 of 15.9.2006 and of Art. 2.2., Annex II and Annex III of the General Terms and Conditions for Information Technologies Contracts, and, in general, of other legal provisions under national law stipulated in Art. I.7.1 of the Framework Contract will be investigated more closely".

88. The analysis of the above correspondence indicates that the institution did inform the complainant about what the possible misconduct committed was and which legislation or contractual provision the latter might have failed to respect. The Ombudsman considers that, when opening an inquiry, the institution is free to inform the parties concerned that a whole range of legal issues will be looked at. The subsequent conclusion that some of the legal issues might not be relevant does not make it inappropriate to refer to them in the beginning, if these issues are to be considered in the course of the said inquiry.

89. The Ombudsman notes, however, that it would have been consistent with the principles of good administration if the Commission had provided the above information in a single letter that would have informed the complainant about the opening of the Commission's investigation and clearly set out its scope, rather than providing the relevant elements in the course of two weeks and in several separate letters, in response to the complainant's requests for more detailed information. The Ombudsman understands that it was the Commission's letter of 24 November 2006 which formally opened the investigation and it was this letter which contained the most detailed information about its scope. It thus appears that the letters the Commission addressed to the complainant before that date were sent with a view to simply informing it of the Commission's intentions to investigate.

90. The complainant further submitted that the Commission lacked a legal basis for conducting an investigation against it.

91. Regulation 45/2001, to which the Commission referred, provides that it is the responsibility of the EU institutions and bodies (in this case the Commission) to "protect the fundamental rights and freedoms of natural persons and in particular their right to privacy with respect to the processing of personal data"[17]. In addition, Article 5 (Protection of personal data) of Commission Decision C(2006) 3602 concerning the security of the information systems used by the Commission[18] stipulates that the Commission's "information systems security policy must guarantee a high level of protection of personal data and the processing thereof in accordance with Regulation (EC) No 45/2001, particularly Articles 21 to 23 and 35 to 37".

92. In its opinion, the Commission pointed out that the procedure it had followed involved both the assessment of the situation from the legal and contractual point of view (concerning the basis of the relevant framework contracts) and an inquiry carried out by its Security Directorate (concerning the basis of Commission Decision C(94)2120 on the tasks of the Security Office). The Ombudsman considers that the Commission was fully entitled to assess whether the recruitment mailings sent by the complainant constituted a breach of the latter's contractual obligations, stemming from its contracts with the Commission. In accordance with Commission Decision C(94)2120 on the task of the Security Office, the institution was also responsible for taking the appropriate measures to protect its property and information, including data transmission and processing.

93. In the context of the above regulations and considering that the Commission's investigation concerned the protection of personal data, data transmission and processing, its subject-matter would appear clearly to fall within the institution's sphere of responsibility. It was, therefore, legitimate for the Commission to inquire into any possible illegalities that it believed might have taken place in this regard.

94. The Ombudsman thus concludes that the Commission was fully entitled to open and conduct the investigation in question.

95. The complainant further considered that it was "wrongly accused" by the Commission. The Ombudsman understands the complainant to argue that the Commission had made unfounded accusations against it, particularly in view of the fact that it subsequently decided to close its inquiry without taking any further action.

96. As stated above, the Ombudsman considers that the Commission was fully entitled to conduct an investigation into the issues that fall within its responsibility. The opening of the administrative inquiries must, however, be communicated to the parties concerned in such a way that they are reassured that the Commission will arrive at the relevant conclusions only after having fully assessed the facts and the applicable legislation and after having given them an opportunity to explain their position. The administrative inquiry should be handled fairly and impartially[19]. It should be recalled that these principles apply throughout the entire procedure.

97. In the present case, however, the Commission stated from the very beginning that the e-mails with job offerings sent by the complainant constituted an abuse of its internal e-mail system and a serious breach of the contract. The Commission also conveyed the impression that it would conduct an inquiry only to find out how that happened and precisely which rules had been infringed. The exact wording used by the Commission was the following[20]:

"Please note that I consider this an abuse of the internal e-mail system of the European Commission and a serious breach of the contract. Please note that an investigation with the Directorate Security will be launched to examine the circumstances of this abuse".

98. The Ombudsman considers that the use of such an accusatory language at a moment when the investigation into the matter had not even formally been opened was clearly inappropriate. It is true that, in its subsequent letters to the complainant, the Commission softened its tone and used a much more neutral language, by saying, for example, that certain provisions "may have been infringed" and by referring to "possible violations" that may have taken place "without prejudice to the final results of the internal investigation".

99. The fact nevertheless remains that, in its letter of 7 November 2006, the Commission accused the complainant of having committed an abuse before it was able to complete its assessment into the matter. The Commission thus failed to respect Article 41 of the Charter and Article 8, point 1 of the ECGAB in so far as it did not show impartiality vis-à-vis the complainant at this point in time. This is an instance of maladministration and the Ombudsman will make a critical remark below.

Concerning the complainant's first and second additional allegations[21]

100. The complainant argued that the Commission ordered it to stop sending the recruitment mailings as soon as it had found out about this practice. It further alleged that, by forbidding the complainant to send e-mails to experts working at the Commission and using the name.surname@ext.ec.europa.eu structure, the Commission acted without legal basis, in a discriminatory manner, disproportionately and abusively.

101. The Ombudsman notes that, in its correspondence with the complainant, the Commission used the word "request", but it appears from the Commission's opinions in this case that what it meant was indeed ordering the complainant to stop sending the recruitment messages.

102. As established during the present inquiry, the ESP DESIS framework contracts were not yet in force at the time when the Commission communicated its instructions to the complainant. These contracts could therefore not be invoked as a legal basis for the Commission's preventive measures. It is true that, during the course of the present inquiry, the Commission submitted that it was entitled to expect from a future contractor "not to act in patent contradiction with the terms and the spirit of the Framework Contracts". The Commission added that, in addition to the principle of good faith, the law of several Member States recognised the concept of "pre-contractual liability" in similar circumstances. The Ombudsman is not convinced by these considerations, which basically suggest that the complainant should have complied with obligations under the ESP DESIS framework contracts before these contracts entered into force. He notes that the Commission did not provide any precise arguments on the law applicable to these contracts, so as to show that its argument was valid. In any event, the Ombudsman recalls that this argument was not put forward at the time when the Commission took the measures challenged by the complainant.

103. The Commission justified its action on the basis of Regulation 45/2001. It argued that this Regulation entitled and even required it to take appropriate measures. The Ombudsman, however, is not convinced of that view for the following reasons:

• The Commission referred to Regulation 45/2001 in general, but did not indicate any specific provision that could be used as a legal basis in this context. The Ombudsman was unable to find in Regulation 45/2001 a provision that could constitute a legal basis for the Commission to take actions such as those it adopted in the present case on the mere basis of a suspected illegitimate processing of personal data.
• The Ombudsman further notes that the instructions to the complainant were issued before the Commission had even formally launched its investigation and before the complainant had been given an opportunity to submit observations[22]. The timing of the Commission's action would, therefore, also appear to contradict Article 41 of the Charter of Fundamental Rights, which provides that the right of good administration includes the "right of every person to be heard, before any individual measure which would affect him or her adversely is taken".

104. The Ombudsman recalls that Article 4 of the ECGAB provides that "the official shall in particular take care that decisions which affect the rights and interests of individuals have a basis in law and that their content complies with the law". In view of the above considerations, the Ombudsman concludes that the Commission had no legal basis to order the complainant to stop sending the recruitment e-mails and that, by taking such an action, it thus breached the said Article 4 of the ECGAB. This is an instance of maladministration and the Ombudsman will make a corresponding critical remark below.

105. It follows from the above finding that there was no legal basis for the Commission's action that there is no longer a need for the Ombudsman to examine the other arguments put forward by the complainant in this context, namely, that the Commission acted disproportionately, abusively or in a discriminatory manner.

106. Finally, as regards the complainant's allegation that the Commission's instruction to the complainant to stop sending the e-mails was communicated to the entire consortium, the Ombudsman is unable to see any evidence that this was indeed the case (see also section B below). This additional allegation cannot therefore be sustained.

Concerning the complainant's third additional allegation[23]

107. The complainant alleged that the Commission had made a disproportionate and abusive threat in its letter of 24 November 2006, namely, by stating that "should the initial analysis be confirmed by final results of this investigation, significant consequences, both on a contractual and a general procurement level will apply".

108. The Ombudsman agrees with the Commission that the said statement should not be read in isolation. However, when considering the overall context in which the statement was made, one should also take into account the accusatory language used by the Commission in its previous letters and the tense relationship between the complainant and the Commission, which was obvious from the complainant's correspondence. Consequently, it is not surprising that the complainant understood the Commission's above statement as being "threatening".

109. However, the Ombudsman considers that the above statement cannot be perceived as being disproportionate or abusive, in particular because of its first part ("should the initial analysis be confirmed"). The Commission's explanation that it decided to inform the complainant about the possible consequences of its actions because the latter did not seem to be willing to accept the Commission's instructions appears credible.

110. Regard should, moreover, be had to the fact that, in its subsequent letter to the complainant (dated 7 December 2006), the Commission explained that "any action that might be taken as a result of this appraisal would not flow from any "threat" or from "an extremely negative and aggressive attitude" against your company; it would, on the contrary, be the result of the fair and transparent application of legal provisions which the EU civil servants are bound to comply with". The Commission also explained in its opinion that the statement made in its letter of 24 November 2006 "was not meant to threaten the complainant". The Ombudsman, therefore, takes the view that there was no instance of maladministration concerning this aspect of the case.

Concerning the complainant's fifth additional allegation[24]

111. The complainant alleged that the Commission failed to complete its investigation within a reasonable period of time. As noted above, the Commission formally opened its inquiry on 24 November 2006, but already on 7 November 2006 it had informed the complainant that an investigation "will be launched". The institution informed the complainant of its preliminary assessment of the situation on 19 October 2007. The Commission then closed its investigation on 30 January 2008. The Ombudsman notes that, when launching its investigation, the Commission did not indicate what its approximate duration would be. The Ombudsman considers that, if possible, the Commission should provide some indications to that effect when opening such inquiries.

112. As regards the time taken by the Commission to complete its investigation in the present case, the Ombudsman is not convinced by the complainant's argument that the Commission could have investigated the situation "within a few hours" on the basis of the technology available at its disposal. He recalls in this context the statement made by the EDPS in his final decision, where he noted that "the logs of the Commission Directory consultation are not subject to a specific log policy. Therefore, a systemic access to external IT consultant's data cannot be traced easily or with reasonable effort" [emphasis by the Ombudsman].

113. Given that the Commission started the relevant investigation in order to clarify what it perceived to be a serious breach of rules by the complainant, it clearly ought to have done all it could to complete this investigation as rapidly as possible. In the absence of any specific elements to show that a duration of nearly 11 months was necessary, the Ombudsman is not convinced that the Commission has complied with this duty. He Ombudsman notes, however, that the Commission has apologised to the complainant "for the length of the enquiry and for the uncertainty and inconvenience that this situation may have caused". It is notable that the Commission offered its apology already before the opening of the present inquiry and then reiterated it subsequently.

114. In view of the above, the Ombudsman takes the view that further inquiries as regards this aspect of the case are no longer needed.

Concerning the complainant's second claim[25]

115. Both the Commission and the complainant acknowledged that the claim that the Commission should stop its investigation and provide all the relevant information is without object at present, since the Commission has already closed its investigation and has also communicated its findings to the complainant. Consequently, further inquiries concerning this aspect of the case are also not needed.

B. As regards the alleged defamation resulting from the Commission's letter of 3 July 2007

Arguments presented to the Ombudsman

116. On 3 July 2007, the Commission informed the complainant that its investigation relating to the possible abuse of personal data was progressing. In this context, DIGIT asked for clarifications as to whether the relevant job offers had been sent on behalf of the complainant alone or on behalf of the consortium led by it. The Commission copied this letter to all the companies forming the said consortium.

117. The subject of the Commission's letter of 3 July 2007 was indicated as "mass mailings to e-mail addresses @ext.ec.europa.eu". The relevant parts read as follows:

"...The enquiry on this matter is progressing and we expect to be able to inform you about its results in the near future. In the meantime, we need your co-operation in order to clarify one particular aspect.

I refer to the wording used in the sample email attached to Mr [D.'s] letter dated 8 November 2006, which - according to the information currently available - is indeed identical (or very similar) to the wording used in many other messages. This sample e-mail refers to the Job Offer mailing list of [the complainant] and says that '[the complainant] is the contractor of several framework contracts for the European Commission (e.g. ESP DESIS Lots 1A, 1B and 2) and many other EU institutions and organisations in Benelux, Spain, Germany, Sweden, etc.' At the end of the e-mail there is a brief company profile of [the complainant].

In view of the fact that your co-contractors for ESP DESIS Lots 1A, 1B and 2 are not named, I should like to ask you to clarify whether the above-mentioned mails were sent:

- on behalf of [the complainant] alone; or

- on behalf of the consortia for ESP DESIS Lots 1A, 1B and 2, i.e. in your capacity as "Group Leader" under the powers of attorney annexed to the relevant framework contracts.

Please note that, at this stage, the Commission is only requiring you to give a short and precise answer to the specific question raised above. Any other comments are not needed for the time being and will not be taken into account. Of course, once the results of the enquiry are notified, you will be given the opportunity to make comments on the substance of the issue before any decision is taken".

118. On 5 July 2007, the complainant reacted to the above letter, arguing that it was the sole contact point for the Commission concerning the ESP DESIS framework contracts and it was actually the Commission's contractual obligation to contact the complainant only. Moreover, it was clear from its previous correspondence with the Commission that the issue concerned the complainant alone. By distributing the letter to all its partners, the Commission breached the terms of the contracts and the privacy and confidentiality of their correspondence. The complainant, consequently, claimed that the institution should withdraw its letter from its non-authorised recipients, apologise to it and assure the complainant's partners that the complainant complied with all its obligations. The complainant wrote the following:

"We hereby invite you to immediately stop all your hostile and harassing actions against our company, to withdraw your letter from its non-authorised recipients and to apologise to them for the serious mistake, and to take concrete actions with our cooperation to remedy this serious situation you caused to us" [emphasis by the Commission].

119. The complainant submitted that, by communicating the above letter to all its consortium partners and by informing them that it was under an investigation by the Commission's Security Directorate, the Commission attempted to harm it "in an irreparable manner" and to "disclose strictly private and confidential information in a defamatory manner".

120. In its opinion, the Commission explained that the addressees of the said letter were not only the complainant's partners, but also - just as the complainant - the Commission's contractors. The Commission was thus entitled to discuss with them any matter relating to the contracts in question, provided that it did so in full transparency as regards the complainant. This was exactly what the Commission did in the present case.

121. The Commission pointed out that, contrary to the complainant's assertions, the above-mentioned letter of 3 July 2007 did not contain any defamatory statement. It only referred to the fact that an inquiry was ongoing and that the complainant would be given an opportunity to make further comments before any final decision is taken. The Commission argued that it thus underlined and fully respected the adversarial nature of the procedure and the presumption of innocence.

122. The Commission added that, on the basis of the wording of the recruitment mailings sent by the complainant, it assumed that the mailings had indeed been sent by the complainant alone, under its own responsibility. For this reason, the Commission had sent all the correspondence prior to the above-mentioned letter to the complainant alone.

123. However, on 19 June 2007 the Commission received a letter from the EDPS, which suggested - on the basis of the information the EDPS had gathered - that the mailings might have been sent not on behalf of the complainant alone, but on behalf of at least one other of the companies forming the consortium. Since the Commission did not have a copy of the complaint submitted to the EDPS, it was not in a position to check directly what the precise allegations and arguments presented to him were. The Commission added in this regard that the EDPS's final decision of 12 November 2008 was based on the assumption that the mailings had been sent on behalf of a consortium.

124. Under these circumstances, the Commission considered it legitimate to ascertain whether the complainant alone or the consortium led by it had sent the recruitment mailings. The Commission was moreover in the process of assessing the situation from a legal and contractual point of view and had to know which entity or entities should be the object of its investigation and/or of any measures that could eventually result from it.

125. The Commission thus concluded that copying the letter in question to the other contractors was a proportionate and legitimate way to achieve the above purpose, since it also gave these other contractors an opportunity to confirm or complete the complainant's reply, if necessary.

126. A few days later, the complainant confirmed that the mailings had been sent on its behalf alone. Following this clarification, the Commission addressed all the subsequent correspondence regarding this issue to the complainant alone.

127. In its observations, the complainant stated that, even if the Commission might have been uncertain as to whether the mailings had been sent by it alone, the institution ought to have first contacted the complainant with a view of obtaining the relevant clarifications. The complainant added that it was "crystal clear" from the content of the recruitment e-mails that they concerned solely itself. It reiterated its view that contractually it was the only contact point for the Commission on behalf of the said consortium relating to all the contractual issues. Moreover, the Commission could also have contacted the EDPS to clarify any uncertainty regarding this matter.

128. Notwithstanding the above, the Commission chose to communicate the said correspondence to all the consortium's members, propagating unfounded accusations and thus defaming the complainant. The complainant expressed the view that the said letter referred to an infringement of contractual obligations and that the Commission presented it, that is, the complainant, to its partners as a company that had committed a serious error leading to the cancellation of all its contracts.

129. As regards the further allegation concerning the Commission's failure to "comply with the relevant contract and with principles of good administration by (i) copying its letter of 3 July 2007 to third parties and (ii) failing to take remedial action even though the complainant had asked it to do so in its reply of 5 July 2007", the Ombudsman requested the Commission also to address the complainant's argument that it was its sole contact point for any questions concerning the relevant contract. The Ombudsman added that, even if one were to assume that the Commission was entitled to copy its letter of 3 July 2007 to the other consortium partners, so as to enable them to provide the information it was looking for, regard should be had to the fact that the letter indicated that the complainant had sent "mass mailings" to the e-mail addresses concerned[26]. It also mentioned that the Commission had opened an inquiry against the complainant. Finally, the letter pointed out that this inquiry would lead to a decision affecting the complainant. The Ombudsman noted that it was thus difficult to understand, at first sight, why these elements needed to be given to third parties, if all the Commission wanted was an answer on a specific factual issue.

130. In its further opinion, the Commission recalled that, in the framework of another complaint, the Ombudsman found that a consortium leader does not have an absolute right to be, in all circumstances, the Commission's exclusive point of contact[27]. In this case, he took the view that the purpose of such provisions was "to create an organisational framework in order to ensure the efficient use of the Commission's resources by channelling documents and correspondence through a co-ordinator". The Commission pointed out that the underlying reasoning in the present case should be the same.

131. The ESP DESIS framework contracts were not signed with the complainant, but with three different consortia that included the complainant. The framework contracts provided that "the Contractor shall be jointly and severally liable vis-à-vis the Commission for the performance of this contract".

132. The Commission acknowledged that the complainant's co-contractors had agreed to appoint the complainant as a "Group Leader". However, this was an agreement between the co-contractors, which did not in any way affect the contractual principle of joint and several liability vis-à-vis the Commission. The Commission was, therefore, puzzled by the complainant's repeated attempts to present the companies in questions "as its rivals rather than its partners". The Commission reiterated that these companies were also its contractors, as much as the complainant itself. The institution was thus unable to share the Ombudsman's reference to "third parties" in this respect.

133. The Commission added that only two sentences in its letter of 3 July 2007 might perhaps be regarded as not entirely necessary. One sentence in the beginning of the letter ("The enquiry on this matter is progressing and we expect to be able to inform you about its results in the near future") and one at the end ("Of course, once the results of the enquiry are notified, you will be given the opportunity to make comments on the substance of the issue before any decision is taken"). Nevertheless, the Commission argued that these sentences were both "informative and therefore useful". The first one set the context in which the question that followed was raised and aimed at addressing the complainant's repeated concerns about the duration of the inquiry. The second sentence confirmed that the procedure that the Commission followed was of an adversarial nature and, consequently, reassured the complainant that its rights of defence were being fully respected.

134. As for the possible remedial action to be taken by the Commission, the institution did not share the complainant's view that it had acted in a way that could be described as "hostile or harassing" and that it was not entitled to copy its letter of 3 July 2007 to its other contractors and that, generally it had caused a "serious situation", which affected the complainant's interests. The Commission was thus clearly not in a position to take the requested remedial action.

135. Nevertheless, the institution was prepared "to inform the members of the complainant's consortia that the investigation on a possible breach of contract was eventually closed without any further action, and that the complainant was then, and remains, a respected IT service provider of the Commission". However, the Commission was not prepared to withdraw its letter of 3 July 2007 or to apologise to the complainant for its content. The institution was also not prepared to state in a letter to be addressed to the complainant's consortium partners that the purpose of that letter was to restore the complainant's reputation, since the Commission maintained its position that it never defamed the complainant.

136. In its further observations, the complainant remarked that the Commission was trying to shift the focus of this debate, which is that "the subject of the case concerned a private and confidential matter of [the complainant] only".

137. It asserted that the Ombudsman's findings to which the Commission referred in justifying its "abusive position" concerned a totally different case, involving a different type of contracts. Contracts like ESP DESIS have a well specified and clearly defined structure, also as regards the roles of the parties. Their implementation relies on solid project management and quality assurance procedures, including strict service level agreements, allowing for serious penalties in case of failures. In such cases, the client (i.e., the Commission) is obliged to contact the consortium as described in the contract.

138. The complainant recalled once again that the issue at stake concerned the complainant and the Commission only and no other members of the consortium. Even if one were to assume that the Commission could contact the other contractors, "infringing the communication procedures described in the contract and thus causing a total chaos", such a contact could only be made in relation to issues of concern to all of them. The complainant concluded that the Commission "cannot contact third partners to communicate to them sensitive information concerning solely [the complainant]".

139. Furthermore, the Commission's comment that the members of the complainant's consortium were its partners and not its rivals was out of place. Following the steps taken by the Commission in this regard, all the complainant's partners had immediately dissociated themselves from it, seeing it as an enemy of the Commission, which the latter accused and threatened. The complainant concluded as follows:

"...It is clear that when the most important public sector institution and client in the EU attacks a company, [it] will be immediately abandoned by its partners fearing for the future of their own relations with the EC. In light of the above, the action of the EC was clearly aggressive and inappropriate and it aimed to harm [the complainant]. Actually, it achieved its goal since [the complainant] was forced to break its relations with all its partners".

140. The complainant claimed that the Commission should provide redress for the problems it had caused it, including defamation and serious financial losses. The complainant welcomed the offer of the Commission to send a letter to its consortium partners and agreed to cooperate with the Commission in this respect. The complainant added that the Commission was expected to send now a letter to the complainant, allowing it to disclose it to its partners, and containing the following:

Dear Mr D.,

Further to our previous correspondence, we hereby inform you on the following.

The Commission conducted in 2006 and 2007 an investigation on a possible breach of the terms of its contract with the Commission by [the complainant] in the field of the misuse of private data. The investigation found that [the complainant] was not liable for any wrongdoing and subsequently, it was closed without any further action.

We hereby apologise for any inconvenience and damage that [the complainant] may have suffered due to the aforementioned investigation. We take the opportunity to state that [the complainant] was then and remains a respected IT service provider of the Commission".

The Ombudsman's assessment

Concerning the complainant's second allegation[28], its related third claim[29] and the fourth additional allegation[30]

141. The Ombudsman considers that the complainant's grievances concern the following three main issues:

(i) Did the Commission fail to respect its contractual obligations and the principles of good administration by copying its letter of 3 July 2007 to the other members of the complainant's consortium?

(ii) Was the Commission's letter of 3 July 2007 defamatory?

(iii) In view of the conclusions arrived at (i) and (ii) above, was the non-pecuniary redress claimed by the complainant adequately addressed?

Concerning issue (i) above

142. The first of the complainant's arguments was that, by sending the letter to the other members of the consortium, the Commission breached the ESP DESIS contract. The Ombudsman is not convinced by the complainant's submissions that, due to the nature of the contract, the Commission was legally barred from corresponding with any of its other contractual partners and that it had to contact the complainant alone. Such a limited interpretation cannot not be accepted, particularly in view of the fact that the complainant did not refer to any specific provision in the ESP DESIS contract, which imposed such restrictions on the Commission. The fact that the companies forming the consortium had chosen the complainant as a "Group Leader" and agreed among themselves that it would be the "single point of contact for the European Commission" does not necessarily imply that the Commission would be at fault if it decided to write to all of the members of the consortium. The Ombudsman thus takes the view that the complainant's argument that the Commission failed to comply with the ESP DESIS contracts in this regard cannot be sustained.

143. Concerning the complainant's second argument that the Commission failed to respect the principles of good administration, the Ombudsman considers that the mere statement, in a letter copied to other contractors, that the Commission was conducting an inquiry relating to the complainant was likely to affect its reputation. Therefore, the Commission's decision to copy this information to the other members of the consortium could only be considered proportionate and in compliance with the principles of good administration[31], if the institution had a good reason for doing so.

144. The Commission explained that it copied the letter to the other members of the consortium because of the information it had received from the EDPS. The EDPS did indeed mention in his decision that the complaint addressed to him concerned "a consortium led by Company X and its partner", which appeared to have had access to a complete list of all external consultants working at the Commission in the framework of various IT projects. Considering that the Commission was informed by the EDPS accordingly, it was understandable that the institution considered it necessary to clarify this matter, since obviously the issue of the company or companies involved in the sending of the recruitment mailings was of great relevance for its ongoing investigation.

145. The question, however, remains why the Commission had to inform the entire consortium, thus potentially compromising the complainant's reputation, instead of simply asking the latter to clarify the relevant issue.

146. The Commission argued that, by sending the said letter to the other companies, it gave them an opportunity to confirm or complete the complainant's reply, if necessary. The Ombudsman does not consider this to be a valid argument. If the Commission was really expecting a reply from any of the other companies forming the consortium, it would be difficult to understand why did it not write to the relevant companies directly, instead of addressing only the complainant and putting the others in copy. What is more, it was not very likely that a company that was not specifically addressed, would be prepared to provide a reply on a question which, if replied in affirmative, would potentially lead to negative consequences for that company and result in an investigation against it.

147. The Ombudsman further recalls that the Commission acknowledged in its opinion that the wording of the recruitment e-mails suggested that they had been sent by the complainant alone. These e-mails indicated only the complainant's HR department as the sender and were sent from the complainant's e-mail address. Moreover, when the Commission's letter was sent, a considerable exchange of correspondence on this issue had already taken place between the complainant and the Commission. There was no mention whatsoever in that correspondence that the recruitment e-mails might have had anything to do with companies other than the complainant. Taking into account all these elements, the Ombudsman considers that the reasons put forward by the Commission for copying its letter of 3 July 2007 to other contractors are not convincing.

148. In any event, if all the Commission needed was information on the company or companies on whose behalf the recruitment e-mails had been sent, it was sufficient to put a question to that effect to the complainant and the other contractors concerned. There was clearly no need to mention that the Commission was investigating the complainant.

149. In view of the foregoing, the Ombudsman concludes that the Commission did not present him with a valid reason why it needed to copy its letter of 3 July 2007 to the other members of the complainant's consortium. The Ombudsman, therefore, concludes that the Commission failed to act in accordance with the principle of proportionality, laid down in Article 6 of the ECGAB. This was an instance of maladministration and a critical remark will be made below.

Concerning issue (ii) above

150. The complainant claimed that the Commission's letter of 3 July 2007 was defamatory. In order to examine whether the Commission's letter was defamatory, the Ombudsman should assess if it contained untruthful statements concerning the complainant, which were disseminated with a view to jeopardizing the complainant's reputation.

151. The Ombudsman does not consider that the Commission's letter contained untruthful statements concerning the complainant. The Ombudsman is also unable to find any proof that the letter in question was sent with a view to jeopardizing the complainant's reputation.

152. The Ombudsman cannot, therefore, conclude that the Commission's letter was defamatory or that the institution acted in a defamatory manner.

Concerning issue (iii) above

153. As noted above, the mere fact that the Commission informed the complainant's consortium partners that it was investigating the complainant was likely to affect the latter's reputation. It cannot consequently be excluded that the complainant suffered negative consequences as a result of the Commission's actions. It should further be noted that only two days after the Commission's letter, i.e., on 5 July 2007, the complainant asked the institution to withdraw this letter from its non-authorised recipients and to take remedial measures vis-à-vis the complainant.

154. In view of the above conclusions, the Ombudsman considers that the complainant's demand for remedial action was justified. It should be noted, however, that in the course of the present inquiry the Commission offered to send a letter to the recipients of its letter of 3 July 2007 to inform them (i) that its investigation had been closed without any further action and (ii) that the complainant was and remains a respected IT service provider of the Commission.

155. The Ombudsman notes that the complainant welcomed this proposal and agreed to cooperate with the Commission in this context. In addition, however, the complainant further proposed, in a rather imperative manner ("the Commission is expected to send now ..."), that the Commission send a letter to itself, that is, the complainant, which could then be disclosed to its partners. In this letter, the Commission was to declare that (i) its investigation had found that the complainant was not liable for any wrongdoing, (ii) its investigation had therefore been closed without any further action, (iii) the complainant was and remains a respected IT service provider of the Commission and (iv) the Commission apologised "for any inconvenience and damage that [the complainant] may have suffered due to the aforementioned investigation.

156. The Ombudsman notes that points (ii) and (iii) are covered by the letter the Commission declared itself willing to send to the other contractors. As regards point (iv), the Ombudsman notes that the Commission has already, in its letter of 19 October 2007, apologized for the time it took to complete its investigation. The Ombudsman has already concluded that the Commission's investigation was legitimate. The Ombudsman does not, therefore, consider that the Commission should provide an apology for having carried out this investigation. As regards the only remaining issue, i.e., point (i), it should be pointed out that what the complainant asked for was a letter addressed to it by the Commission that it could then forward to the other contractors. However, the Commission has already informed the complainant of the results of its investigation. The Ombudsman is not aware of any obstacle that would prevent the complainant from forwarding the said letter or at least the relevant conclusion to the other contractors of the ESP DESIS contracts.

157. In view of the above, the Ombudsman takes the view that there are no grounds for further inquiries into this aspect of the present case.

C. As regards the Commission's alleged involvement in the poaching of the complainant's employees

Arguments presented to the Ombudsman

158. In its complaint to the Ombudsman, the complainant explained that the contracts of three of its employees, who worked for the Commission's Directorate-General Communications ('DG COMM') had expired in the first trimester of 2007. It alleged that the Commission had transmitted private data of these employees to its competitors, encouraged them to terminate their contracts with the complainant and thus assisted the complainant's competitors in poaching the experts in question. The complainant claimed that the Commission should not intervene in the complainant's recruitment policy.

159. On 2 July 2007, the complainant wrote the following to the Commission:

"Our company submitted a tender to the Commission in the context of ESP DESIS. In its tender it presented its own offer, methodologies and its own staff. The proposed staff of the company clearly forms part of the offer of the company which was awarded the ESP DESIS contract as 2nd contractor in the cascade. If the Commission wishes to purchase/use the services of the staff of our company, it has to contract DIRECTLY with our company and NOT to accept, consent to, or even encourage practices distorting free competition, such as poaching of our company's staff by our competitors".

160. In its opinion, the Commission stated that, following the termination of its previous contracts with the contractors concerned, DG COMM issued a new service request form for service providers. The experts in question were proposed to DG COMM by the first contractor in the relevant ESP DESIS cascade and then selected. In any event, any transfer of a consultant from one company to another remained within the legal framework of the free labour market and the Commission had no means to interfere with or block such transfers. The Commission added that it was also not in a position to verify the reasons why a consultant decides to terminate a contract and to sign up for another service provider, nor to establish a control system that would keep track of these movements. The Commission denied any suggestions that it had violated the ESP DESIS framework contracts in this context. The institution's position was that it had fully complied with all the applicable rules.

161. The Commission added that in no way did it suggest to, or encourage, consultants to change their employer. It was the contractor's responsibility to propose candidates and the Commission could not oblige consultants to commit themselves to work with certain companies, since this was a relationship governed by the employment contracts between the consultants and the respective companies. Consequently, if an expert decided to quit a company and another one decided to hire him or her, this did not constitute a violation by the Commission of the terms of the ESP DESIS contracts. The Commission had no means whatsoever to interfere with or block any transfers among contractors. In any event, the complainant's allegation that the Commission assisted its competitors in poaching the complainant's employees was not supported by any evidence.

162. The Commission therefore concluded that the above allegation was "totally unfounded". The complainant's related claim was consequently without object, since the institution had always stood by its approach not to interfere with its contractors' recruitment policy.

163. In its observations, the complainant expressed the view that the poaching of its own staff by its competitors under the ESP DESIS contracts was "a side effect arising from the Commission's preventive measures against the complainant regarding the mailing investigation". Most of the complainant's staff was worried that the Commission might terminate its contract with the complainant. The complainant's competitors took advantage of this situation to poach its employees, as well as many other candidates who were negotiating their cooperation terms with the complainant. The complainant maintained its claim that the Commission should allow it to implement its business plan undistorted by not intervening in its legitimate practices and recruitment policy.

164. The complainant surmised that the poaching of its staff "could not be considered as incidental". The Commission's attempt to downplay the consequences of its unfounded accusations against the complainant was "wrong, unfair and in bad faith". Contrary to the Commission's assertions that it did not interfere with the complainant's recruitment policy, the Commission's actions had caused serious difficulties for the complainant in this field.

165. The Ombudsman invited the Commission to address in its further opinion the complainant's argument that it had allegedly forwarded to the complainant's competitors contact details and private data concerning some of the complainant's employees.

166. In its further opinion, the Commission denied the complainant's general statement that the institution has a systematic policy of assisting its competitors and reiterated that this statement was not supported by any evidence. The complainant referred to attempts by other companies to poach its employees and concluded by stating that the Commission's refusal to take action to prevent such attempts constituted evidence of its willingness to assist its competitors and to discriminate against it. The Commission explained in this context that a distinction had to be drawn between protecting personal data of individuals or confidential information (which is the reason why the Commission undertook action in the present case) and interfering with the recruitment policy of the Commission's contractors (which the Commission cannot and will not do).

167. The Commission referred to the situation mentioned by the complainant concerning an interview, which apparently took place outside the Commission's premises on 26 October 2006 between one of the complainant's employees and an executive of a competitor. The Commission wondered how it could have inferred from this unsubstantiated statement that personal data or confidential information were being abused, and, what is more, that this was done with the assistance of the Commission itself.

The Ombudsman's assessment

Concerning the complainant's third allegation and the related fourth claim[32]

168. After having reviewed the parties' submissions, the Ombudsman understands the complainant to argue that the Commission first transferred to other companies operating on the market confidential data relating to the complainant's employees, and then also accepted the offer made by a complainant's competitor that proposed the services of the complainant's former employees.

169. As regards the first argument, the Ombudsman notes that the Commission did not explicitly address the issue. He understands, however, that the Commission wishes to deny the complainant's assumption that it had provided a list of contacts of its employees to its competitors[33]. The Ombudsman notes that there are no concrete elements that would suggest that the Commission transferred confidential data relating to the complainant's employees to other contractors.

170. As regards the second argument that by accepting the services of the complainant's former employees the Commission breached the ESP DESIS contracts, the Ombudsman notes that the complainant stated in very vague terms that the Commission breached the "the confidentiality clauses of ESP DESIS lot 5 contract". The complainant did not, however, refer to any particular provision(s) of the contract in this regard.

171. The Ombudsman further notes that, in its letter to the complainant of 10 May 2007, the Commission explained that its "officials must not interfere in the relation between consultants and their employers". The institution added the following further clarifications:

"With a view at this, no evidence has been brought to my attention indicating that an official has exercised any pressure on any consultants on site, or knowingly accepted any consultants that were proposed by one contractor while they had a working contract with another contractor for the time of start of delivery of services. This would indeed compromise the cascade.

However, this will not prevent DGs to accept proposals of consultants that have previously worked for another contractor. Given the high fluctuation in the service market this would result in strong difficulties for any reliable service delivery. This fluctuation is the normal course of business and it has nothing to do with any complicity, harassment or intimidation you allege".

172. In view of the above explanations, it appears clear that the Commission accepted the proposed experts only after their employment contract with the complainant had expired. The Ombudsman agrees with the Commission that it is not its responsibility to intervene in this area. Considering that the complainant's employment relationship with the experts in question had expired at the time when they were offered to the Commission by another service provider, the institution cannot be reproached for having accepted this offer.

173. The Ombudsman is consequently of the view that the Commission's position regarding this matter is reasonable and that no maladministration can be found on the part of the institution concerning this aspect of the complaint. The complainant's related claim that the Commission should not interfere with its recruitment policy consequently must therefore also fail.

D. As regards the Commission's alleged failure to reply to the complainant's letter of 5 July 2007 within a reasonable period of time

Arguments presented to the Ombudsman

174. The Ombudsman recalls that he opened the present inquiry only after the complainant informed him that the Commission's Secretary-General failed to reply to its letter of 5 July 2007[34].

175. The Commission explained that, on 5 July 2007, the complainant had in fact sent two letters to the Commission - one to its Secretary-General and another to DG DIGIT.

176. On 19 July 2007, the Commission's Secretary-General did provide a reply to the complainant's letter dated 5 July 2007, informing it that she had no competence to deal with the issues raised in this letter. On 6 August 2007, the Commission also replied to the letter addressed to DG DIGIT, announcing that the results of the Commission's investigation would be made available to the complainant in due course.

177. The Commission acknowledged that the complainant might not have been entirely satisfied with these replies. Nevertheless, the institution found it striking that the complainant did not inform the Ombudsman about the above replies when it renewed its original complaint with him. The complainant had even replied to the Commission's letters more than one month before it renewed its complaint with the Ombudsman.

178. In its observations, the complainant pointed out that its letter of 5 July 2007 to the Commission's Secretary-General had not been "adequately addressed", since the response provided by the Commission did not contain any firm, substantive and straightforward answer.

179. The complainant further stated that it received DG DIGIT's reply to its letter of 5 July 2007 only on 6 August 2007, i.e., one month after its own letter had been sent, which was not within the timeframe foreseen in Article 14 of the ECGAB. Moreover, the said reply did not even address the issues the complainant had raised.

The Ombudsman's assessment

Concerning the complainant's fourth allegation[35]

180. On 14 September 2007, the complainant turned to the Ombudsman, pointing out that it had not yet received an answer from the Commission's Secretary-General to its letter of 5 July 2007. Consequently, the complainant's allegation regarding the Commission's failure to provide a reply concerns this letter only.

181. It has been established in the course of the present inquiry that the Commission did actually provide a reply to the complainant's letter. It has also been established that the reply was provided in a timely manner, since the Commission sent it 14 days after it had received the complainant's letter. In these circumstances, the complainant's allegation that the Commission failed to provide a reply within a reasonable period of time must clearly fail.

182. The Ombudsman notes that if the complainant was not satisfied with the reply of the Commission's Secretary-General, it should have informed the Ombudsman accordingly.

183. The Ombudsman notes that it was only after the Commission had referred to the reply it had sent that the complainant argued that the Secretary-General's letter hat not "adequately addressed" the issues raised by the complainant. This is a new allegation, not covered by the initial allegation included in the Ombudsman's inquiry, which did not concern the substance of the Commission's reply.

184. It is true that the Secretary-General's reply did not address the complainant's arguments on the substance, since she considered that she had no competence to deal with the relevant issues. Regard should, however, be had to the fact that the Commission has addressed these arguments in the course of the present inquiry. The Ombudsman is thus of the view that there are no grounds for further inquiries into this aspect of the complaint.

E. As regards the complainant's claim pertaining to the alleged violation of the ECGAB

Arguments presented to the Ombudsman

185. The complainant argued that, in the context of the present complaint, the Commission breached Article 5 (absence of discrimination), Article 6 (proportionality), Article 7 (absence of abuse of power), Article 8 (impartiality and independence), Article 9 (objectivity) and Article 10 (legitimate expectations, consistency and advice) and Article 17 (reasonable time-limit for taking decisions) of the ECGAB. It thus claimed that it should be recognised that the Commission had infringed the ECGAB.

186. In reply, the Commission summarised that it did not fail to state the relevant legal basis for its actions; its inquiry was legitimate, even though it took a long time to conclude it; it did not defame the complainant; it did not abuse the complainant's confidential data or assist its competitors to poach its employees; and it replied in a timely manner to the complainant's letters dated 5 July 2007. The Commission thus reiterated that none of the complainant's allegations could be sustained and maintained that it did not breach any provisions of the ECGAB or of its own Code of good administrative behaviour.

187. In its observations, the complainant maintained its claim.

The Ombudsman's assessment

Concerning the complainant's first claim[36]

188. The Ombudsman reiterates his findings (made in paragraphs 99, 104 and 149 above) that the Commission failed to comply with the requirement of impartiality, laid down in Article 8, point 1 of the ECGAB and Article 41 of the Charter and with the principle of proportionality and lawfulness, laid down in Articles 4 and 6 of the ECGAB.

189. The Ombudsman does not find violations on the part of the Commission concerning the other provisions of the ECGAB referred to by the complainant.

F. As regards the complainant's claim for damages

Arguments presented to the Ombudsman

190. The complainant finally claimed that the Commission should provide redress for the problems it caused the complainant, including defamation and serious financial losses.

191. The complainant maintained its view that the Commission's correspondence was defamatory and caused harm and financial losses to it. It specified that the harm caused to it resulted primarily from the following:

• the sudden departure of members of its staff due to the uncertainty that had been caused within their business environment and in relation to the complainant's ability properly to implement its contractual obligations; and
• the discouragement of the community of over 300 experts active in this specific market from cooperating with the complainant and the complainant's resulting inability to deliver 100 % of the requests received from the Commission and other clients.

192. The Commission noted that the complainant did not provide any details of the financial losses it had allegedly suffered. In any event, should the complainant have suffered certain losses, these could surely not be the result of the Commission's actions. The Commission stated that it did not defame the complainant on the market and that all its actions were legitimate and in accordance with the principles of good administration. The institution, therefore, concluded that the claim for financial redress must be dismissed.

193. The Commission added that the complainant did not provide any details as regards the losses it had allegedly suffered. The institution suggested that it was prepared, if the Ombudsman so requested, to provide detailed figures on the execution of the three framework contracts (ESP DESIS Lots 1A, 1 B and 2) concluded by the consortium led by the complainant. These figures would confirm that the execution of the contracts was fully in line with the estimates, especially taking into account that this consortium had ranked second in the cascade.

The Ombudsman's assessment

Concerning the complainant's fifth claim[37]

194. As regards the damage resulting from the alleged defamation, the Ombudsman recalls that he was unable to conclude that the Commission's letter of 3 July 2007 was defamatory or that the institution had acted in a defamatory manner[38]. Any claim for compensation to that effect must, therefore, fail.

195. As for the remaining claim for financial losses, which the complainant considered to have suffered as a result of the Commission's actions, the Ombudsman recalls that it is for the complainant duly to substantiate any such claim. After having carefully analysed all the information and materials presented in the context of the present inquiry, the Ombudsman considers that the complainant did not submit clear evidence that it had suffered damage resulting from the Commission's actions discussed above. The Ombudsman therefore takes the view that the complainant has failed to substantiate its relevant claim.

196. The Ombudsman reminds the complainant that his decisions are not legally binding and his investigations are aimed at establishing whether there was an instance of maladministration on the part of the institution concerned. If the complainant believes that it is in possession of clear evidence that could justify its claim for financial compensation, it remains free to turn to a competent court.

G. Conclusions

On the basis of his inquiry into this complaint, the Ombudsman closes it with the following three critical remarks:

First critical remark:

By accusing the complainant of abusing the Commission's internal e-mail system and of breaching its contractual obligations before having even launched and carried an investigation into the relevant issues, the Commission failed to demonstrate impartiality vis-à-vis the complainant at this point in time. The institution consequently failed to comply with the requirement of impartiality, laid down in Article 8, point 1 of the ECGAB and in Article 41 of the Charter. This was an instance of maladministration.

Second critical remark:

By ordering the complainant to stop sending the recruitment e-mails without having a legal basis for doing so, the Commission breached Article 4 of the ECGAB. This was an instance of maladministration.

Third critical remark:

The Commission did not present the Ombudsman with valid reasons why it needed to copy its letter of 3 July 2007 to the other members of the complainant's consortium. The Ombudsman, therefore, concludes that the Commission's action to that effect failed to respect the principle of proportionality, laid down in Article 6 of the ECGAB. This was a further instance of maladministration.

The complainant and the Commission will be informed of this decision.

 

P. Nikiforos Diamandouros

Done in Strasbourg on 13 December 2011

---

[1] Framework Contracts DIGIT-05711-00, DIGIT-05713-00 and DIGIT-05718-00.

[2] These e-mail addresses were structured as follows: name.surname@ext.ec.europe.eu.

[3] See paragraph 12 above.

[4] See paragraph 6 above.

[5] The complainant's letters to the Ombudsman of 31 May 2011 and 13 July 2011.

[6] The Ombudsman's letters to the complainant of 30 June 2011 and 27 October 2011.

[7] See also paragraph 11, 12 and 16 above.

[8] Regulation 45/2001of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, OJ 2001 L 8, p. 1.

[9] The Commission's Directory on IntraComm is a reference repository designed to facilitate tracing Commission departments and staff.

[10] See paragraph 33 above.

[11] Such as DI-04551 - ESP-DIMA and DI-05450 - CIRCA support.

[12] The Commission published the Contract notice on 22 December 2005.

[13] See also section C below.

[14] The Commission's letter of 19 October 2007.

[15] Article 7 of the ECGAB provides that "[p]owers shall be exercised solely for the purposes for which they have been conferred by the relevant provisions. The official shall in particular avoid using those powers for purposes which have no basis in the law or which are not motivated by any public interest".

[16] See paragraph 5, point 1 above.

[17] Article 1 of the Regulation 45/2001.

[18] Commission Decision of 16 August 2006 C(2006) 3602 concerning the security of the information systems used by the European Commission.

[19] Article 41 of the Charter of Fundamental Rights of the EU.

[20] The Commission's letter of 7 November 2006.

[21] See paragraph 6, point 1 and 2.

[22] The Commission first instructed the complainant to stop sending the e-mails on 7 November 2006.

[23] See paragraph 6, point 3.

[24] See paragraph 6, point 5.

[25] See paragraph 5, point 2.

[26] The subject of the Commission's letter of 3 July 2011 read: "Mass mailings to e-mail addresses @ext.ec.europa.eu".

[27] Decision of the European Ombudsman on complaint 870/2007/TN.

[28] See paragraph 5, point 2 (allegations).

[29] See paragraph 5, point 3 and 5 (claims).

[30] See paragraph 6, point 4.

[31] Article 6 of the ECGAB.

[32] See paragraph 5, point 3 (allegations) and 4 (claims).

[33] See paragraph 166 above.

[34] See paragraph 8 above.

[35] See paragraph 5, point 4 (allegations).

[36] See paragraph 5, point 1 (claims).

[37] See paragraph 5, point 5 (claims).

[38] See paragraph 152 above.