---

The MEMORIA case, as detailed across the provided pages on memoria.cocoo.uk, centers on alleged irregularities in the implementation of Spain’s Ley de Memoria Democrática (Law 20/2022) and its predecessor (Law 52/2007). It comprises two subcases: LICITACION, which addresses procurement irregularities in public contracting for historical reports, exhumations, research, and related activities; and REPUTACION, which addresses reputational harm to UK citizens, particularly descendants of British International Brigade volunteers in the Spanish Civil War, stemming from allegedly biased historical narratives supported by those reports.

Ultra vires DORCAPS (decisions, omissions, regulations, conduct, actions, policies) are identified primarily in actions by Spanish public bodies exceeding legal powers under Spanish law (Ley 9/2017 de Contratos del Sector Público, Ley 19/2013 de Transparencia) and EU law (Directive 2014/24/EU on public procurement). These include:

– Deliberate fragmentation of contracts (fraccionamiento de contratos) by the Ministerio de Política Territorial y Memoria Democrática to evade mandatory tender thresholds, publicity requirements, and open competitive bidding procedures. This conduct avoids principles of transparency, equality, non-discrimination, and free competition.

– Omissions in ensuring competitive processes, such as failing to publish tenders or conduct open licitaciones, leading to discretionary awards often to favored entities (e.g., in-house or specific centers like Centro de Documentación de la Memoria Histórica).

– Actions involving potential abuse of in-house provisioning (medios propios), awarding contracts to controlled entities without meeting strict legal conditions (absence of private capital, sufficient control).

– Policies and decisions facilitating biased procurement, including lack of accountability in using public funds for historical reports alleged to favor one ideological narrative, potentially involving conflicts of interest.

– Regulatory oversight failures referenced in European Commission infringement proceedings against Spain for procurement violations and excessively difficult state liability claims, violating EU principles of effectiveness and equivalence.

No private companies are explicitly named as under investigation by regulators in the materials. Instead, the Spanish Ministry and related public administrations are the focus of scrutiny for these practices.

Harmed companies and consumers (victims) include:

– Excluded companies: Small and medium enterprises (PYMEs/SMEs), freelance professionals (autónomos), historians, researchers, and consultants in sectors like historical research (SIC 7220), heritage activities (SIC 9102), exhumations, digitalization, and cultural services. These are harmed by lost opportunities, wasted bidding costs, lucro cesante (lost profits), unfair competition, and exclusion from contracts due to non-competitive awards.

– Consumers and indirect victims: Taxpayers harmed by inefficient use of public funds and market distortions; UK citizens and descendants of British volunteers suffering collective reputational damage from misrepresented historical narratives; families of Civil War victims (Spanish side) potentially affected by biased processes in exhumations or identifications; broader competitors and consumers impacted by anti-competitive outcomes.

These ultra vires DORCAPS by public bodies are claimed to create tort liabilities under Spanish administrative law (responsabilidad patrimonial de la administración pública), unfair competition rules, and potential EU-derived claims (e.g., Francovich liability), enabling compensation for both directly excluded companies and secondary victims of any resulting harms.

---

The equivalent to **UK judicial review** in Spain is the **recurso contencioso-administrativo**, regulated by Ley 29/1998, de 13 de julio, reguladora de la Jurisdicción Contencioso-Administrativa (LJCA). This mechanism allows challenging ultra vires DORCAPS (dispositions of general character, acts, omissions, inactivities, or vía de hecho) by public bodies, including procurement irregularities under Ley 9/2017 and Ley 20/2022 de Memoria Democrática.

Judicial review opportunities in the MEMORIA case include:

– Direct challenge to specific ultra vires acts or decisions in procurement (e.g., fragmented contracts, discretionary awards without tender) via recurso contencioso-administrativo. Plazo: 2 months from the day following notification/publication of the act (art. 46.1 LJCA). For ongoing harms as of December 16, 2025, file within 2 months of knowledge or manifestation of the specific act.

– Challenge to inactividad administrativa (omissions), such as failure to publish tenders or ensure competitive processes. Requires prior requerimiento to the administration; if no compliance within 3 months, recurso contencioso-administrativo against the inactividad. Plazo: 2 months from end of the 3-month period (arts. 29 and 46 LJCA). For ongoing omissions in 2025, prior requerimiento remains possible, keeping the action timely.

– Specific opportunity for COCOO: recurso contencioso-administrativo against the public authority’s inactividad in initiating ex officio the procedimiento de repetición (action of regreso) against responsible officials for ultra vires DORCAPS causing compensated torts (art. 36 Ley 40/2015). This omission constitutes inactividad challengeable after requerimiento (3 months no response) + 2 months to file. As harms are ongoing and no mandatory initiation has occurred, file after requerimiento in 2025.

– Challenge to secondary legislation/implementation (policies, regulations, guidelines on Memoria Democrática procurement with high probability of ultra vires, e.g., facilitating fragmentation or bias). Direct recurso for disposiciones generales: 2 months from publication. Indirect (via act of application): raise illegality in recurso against the act. For ongoing implementation causing harm in 2025, indirect challenges remain timely; direct if publication recent or harm manifests newly.

– Combined with responsabilidad patrimonial claims (1-year plazo from harm manifestation, art. 67 Ley 39/2015), leading to potential repetición if compensated.

All these enable annulment, cessation of harms, and compensation for victims (excluded companies, reputational harms). Legitimación for COCOO exists via interest in competition/consumer protection.

---

 

From the content on the provided URLs at meta.cocoo.uk, the case focuses on alleged abuses by Meta Platforms (Facebook, Instagram, WhatsApp) involving data exploitation, privacy violations, and anticompetitive practices, with claims that regulators and public bodies committed ultra vires acts through specific DORCAPS that enabled these harms.

The identified ultra vires DORCAPS from regulators and public bodies include:

– Omissions in failing to conduct proper cost-benefit analyses of platform benefits versus damages to competition and citizen rights.

– Omissions in failing to prepare ethical impact reports, contingency plans, or fiscal provisions for state liability arising from regulatory inaction.

– Decisions approving key mergers (such as Instagram and WhatsApp acquisitions) without adequate risk assessments or appreciation of long-term impacts on competition.

– Omissions in timely investigation of known abuses, enforcement of GDPR (Articles 5, 6, 9 on lawful processing, data minimization, special categories), DMA (interoperability, no self-preferencing), and competition laws (TFEU Article 102).

– Actions and policies involving public bodies contracting advertising with Meta, where such contracts rely on illegally obtained data, exceeding legal authority and harming citizens.

– Omissions in addressing regulatory gaps, such as “misleading freeness” of services paid with data, and failure to protect markets and consumers from systemic harms.

The companies harmed include Meta itself as the company under investigation, facing existential risks, reputational damage, and unsustainable legal battles due to regulatory failures. Other harmed companies are competitors and business users, such as those in online classifieds (eBay, Gumtree, Vinted in UK; Wallapop, Milanuncios in Spain), web analytics firms (Databuzz Ltd., Cambridge Spark in UK; MARKETZILLA, Coco Solution in Spain), gaming and music developers (Rebellion, Codemasters, Team17 in UK; Gameloft, Crema Games in Spain; Spotify, Deezer), cloud providers (ANS Group in UK; Microsoft Azure, Google Cloud in Spain), and advertisers (Havas UK, LOLA MullenLowe Spain, Procter & Gamble) facing inflated ad prices, dependency, exclusionary practices, loss of market opportunities, and reduced innovation from Meta’s dominance enabled by regulatory omissions.

The consumers harmed, as tort victims of Meta and ultimately of the regulators’ ultra vires DORCAPS, include approximately 45 million UK Facebook users and 40 million Spanish users (primarily 2016-2019 period, with ongoing harms), affected by uncompensated excessive data collection (including biometric, emotional profiling), privacy breaches (e.g., Cambridge Analytica affecting millions, 2021 breach of 533 million), distress, non-material damages, algorithmic manipulation undermining autonomy, exposure to CSAM due to inadequate age checks, and overpayment or reduced choices in a non-competitive market.

---

Judicial review opportunities in the UK to challenge ultra vires DORCAPS in this Meta case include claims against ongoing omissions by the Information Commissioner’s Office (ICO) to enforce GDPR provisions (such as Articles 5, 6, 9 on lawful processing and data minimization) despite known breaches, where harm to consumers and competitors continues, allowing filing within three months of when grounds arise or treating the omission as a continuing act with no fixed date barring the claim.

Another opportunity is judicial review of ongoing policies or decisions by the Competition and Markets Authority (CMA) involving failures to address anticompetitive effects from data practices or inadequate merger assessments (Instagram 2012, WhatsApp 2014), as continuing harms mean the claim remains timely if framed as persistent omission.

Judicial review against public authorities (such as government departments or local bodies) for contracting advertising services with Meta reliant on allegedly illegally processed data, arguing such contracts exceed powers or involve improper use of public funds, with ongoing contracts providing grounds for current challenge without strict time bar if harm persists.

Opportunity for COCOO to seek judicial review mandating a public authority (such as the Cabinet Office or relevant oversight body) to initiate or publicize an internal procedure to pursue ex officio the regulator (ICO or CMA) whose ultra vires DORCAPS led to torts requiring state compensation, based on duties of accountability and recovery under public law, especially where state liability for regulatory failures arises.

Challenges to secondary legislation or its implementation, such as aspects of the Data Protection Act 2018 or related regulations implementing UK GDPR that allegedly fail to adequately enforce against systemic data abuses, or competition regulations under the Digital Markets, Competition and Consumers Act 2024 enabling insufficient oversight, where ongoing application and harm allow timely judicial review claims arguing ultra vires for incompatibility with higher obligations.

The equivalent in Spain to UK judicial review is the recurso contencioso-administrativo, which challenges administrative acts, omissions, or regulations for ultra vires, with similar opportunities against AEPD omissions on GDPR enforcement or CNMC on competition issues, and no fixed dates barring claims where harms are ongoing.

---

From the list of identified judicial review opportunities, none involve a specific decision or act dated within the last three months (since 16 September 2025) that would place them strictly within the standard three-month time limit under CPR 54.5 for filing in the UK, as the challenges target ongoing omissions, policies, or continuing failures rather than recent discrete acts.

However, opportunities older than three months where the tort or harm is ongoing as of 16 December 2025 allow for a rolling judicial review in the UK, as courts recognise continuing omissions or persistent conduct (such as failures to enforce GDPR or address anticompetitive effects) as giving rise to fresh grounds without a fixed time bar, provided the claim is brought promptly in relation to the ongoing nature. This applies to judicial review of ongoing ICO omissions on GDPR enforcement, CMA failures on competition issues including past mergers with continuing effects, public authorities’ ongoing advertising contracts with Meta, COCOO’s claim mandating initiation of internal procedures against regulators, and challenges to secondary legislation or implementation (like Data Protection Act 2018 or Digital Markets, Competition and Consumers Act 2024 aspects) where application remains ongoing and harms persist.

In Spain, the equivalent recurso contencioso-administrativo has a two-month time limit for express acts but allows challenges to ongoing omissions or inactivities where harm continues, similarly supporting timely claims framed around persistent failures by AEPD or CNMC.

---

Proposals to prevent and remedy tort harms from ultra vires DORCAPS by regulators and public bodies (such as ICO and CMA omissions on GDPR and competition enforcement, and public advertising contracts reliant on unlawful data processing) include settlements where the State accepts vicarious liability for regulatory failures, providing compensation to victims (including affected consumers and competitor companies) through dedicated funds, while regulators/public bodies avoid personal fiduciary or contributory liability for bad faith non-disclosure of ultra vires risks that deprive the State of Violenti non fit injuria defences.

These proposals allow win-win outcomes: victims (consumers harmed by privacy breaches and non-material damage, and companies like competitors facing market distortions or Meta itself under unsustainable investigations) receive redress via State-funded compensation, injunctions, commitments, settlements, cy-près style awards (directed to consumer protection or competition advocacy charities like COCOO), grant awards for affected businesses, and public contract awards prioritising harmed competitors; the State remedies systemic harms positively; regulators/public bodies gain protection from abuse of power claims by cooperating transparently.

Customised remedies and undertakings COCOO should propose to ICO, CMA, or relevant public authorities include commitments to enforce GDPR Articles 5, 6, 9 against Meta’s ongoing data practices and review past merger effects with consumer/competitor input; no fines on regulators/public bodies (to encourage cooperation); injunctions mandating transparency on ultra vires risks and internal accountability procedures; suspended quashing orders on unlawful advertising contracts or policies, allowing time for transition to compliant alternatives while suspending invalidity; cy-près proposals directing equivalent value from avoided liabilities or saved enforcement costs to funds compensating UK/Spanish consumers (e.g., for non-material damages from excessive data collection) and harmed companies (e.g., lost market opportunities for analytics firms, developers, advertisers), administered via COCOO for privacy education, competition research, or direct victim support; undertakings to award grants/contracts to victim companies for innovation in privacy-compliant alternatives or competitive markets.

These facilitate State vicarious liability claims for compensation while incentivising regulators to accept by reducing exposure to contributory negligence for reckless bad faith cover-ups of ultra vires DORCAPS causing ongoing tort harms as of 16 December 2025.

---

No open or closed claim, settlement, or arbitration has been identified where a state (such as the UK, Spain, or any EU member state) has paid compensation or penalties due to regulatory failures or ultra vires acts by public bodies or regulators (like ICO, CMA, AEPD, or CNMC) in relation to Meta’s data practices, privacy violations, or anticompetitive conduct, directly or tangentially.

Companies have faced multiple penalties and compensation orders related to this case, all paid by Meta (or Facebook) rather than the state. These include a November 2025 Spanish court order requiring Meta to pay €479 million in compensation to 87 digital media publishers and news agencies for unfair competition arising from GDPR violations in behavioral advertising (2018-2023 period), treating Meta’s advertising profits as unlawfully obtained. Other examples are regulatory fines imposed on Meta, such as the €1.2 billion fine in 2023 by Ireland’s Data Protection Commission (under EDPB direction) for unlawful EU-US data transfers, €390 million in 2023 for improper ad personalization practices, and various other GDPR-related fines totaling hundreds of millions euros from EU authorities. No instances involve state payments for regulatory omissions or failures enabling these harms.

---

The probability that COCOO.uk, as a charity focused on competition and consumer protection without direct personal harm, would be granted locus standi for judicial review challenging a public body’s ongoing refusal (via ignored letter constituting negative administrative silence) to initiate an internal ex officio procedure akin to “accion de regreso” (state recovery against ultra vires regulators or officials) is approximately 65-75%. This estimate reflects the liberal “sufficient interest” test under Senior Courts Act 1981 s.31(3), where courts grant standing to genuine public interest charities or pressure groups on regulatory inaction in data protection or competition matters when no directly affected individual pursues the claim, as in R v Foreign Secretary ex parte World Development Movement [1995] (Pergau Dam, standing for pressure group on unlawful aid) and similar cases allowing public-spirited challengers to vindicate rule of law. The ignored letter strengthens interest as the challenged “decision” (ongoing omission treatable as rolling for timeliness), and COCOO’s mission aligns with public accountability for regulatory failures causing widespread tort harms. Success depends on framing the claim’s arguability and public importance at permission stage, with courts disinclined to deny meritorious public interest claims outright.

Ideas to build locus standi include sending targeted pre-action protocol (PAP) letters under the Judicial Review Pre-Action Protocol to regulators or public bodies (e.g., ICO, CMA, or oversight departments), demanding specific actions such as confirmation of refusal to publish ultra vires risk assessments (including foreseeable tort harms) or to initiate internal accountability procedures. A explicit response denying the request creates a fresh reviewable decision, bolstering COCOO’s interest as the recipient/addressee of that refusal. Silence after 14 days (standard response period) can be treated as refusal, supporting challenge to the omission. This forces crystallisation of the impugned act without “tricking” unlawfully, as PAP compliance is expected and courts recognise such correspondence in assessing standing.

FOI requests already sent by COCOO gather evidence of ultra vires DORCAPS, and any refusals or disclosures can be referenced to demonstrate COCOO’s active engagement, reinforcing sufficient interest without conferring standing alone.

Judicial review can serve as a public notification mechanism by seeking declarations on failures to disclose ultra vires risks and consequential tort harms, highlighting breach of fiduciary duties of good faith and transparency owed by regulators/public bodies. Courts may grant such remedies where inaction risks ongoing public harm, putting matters on record and enabling preventive measures by victims, though primary focus remains legality rather than broad publicity. No direct precedent mandates personal/official liability via JR for non-disclosure, but claims can argue irrationality or procedural impropriety in cover-ups depriving state defences.

---

From the identified DORCAPS in this Meta case, the key ones with potential ultra vires arguments are:

– Omissions by the ICO in failing to enforce GDPR Articles 5, 6, 9 against Meta’s data practices: 45% probability of being ultra vires. This estimate reflects the ICO’s broad discretion in enforcement under the Data Protection Act 2018 and UK GDPR, where courts rarely find regulatory inaction irrational or unlawful absent egregious failure, though ongoing systemic harms to millions could argue procedural impropriety or irrationality in prioritisation.

– Decisions by the CMA approving Meta’s Instagram (2012) and WhatsApp (2014) mergers without adequate long-term competition risk assessments: 30% probability of being ultra vires. Merger clearances were within statutory powers at the time, with ex post reviews (e.g., Lear report) acknowledging under-enforcement risks but not deeming original decisions unlawful, as predictive assessments involve judgment not easily overturned.

– Omissions by the CMA in addressing ongoing anticompetitive effects from data dominance: 40% probability of being ultra vires. Similar to ICO omissions, discretion in enforcement is wide, but persistent harms post-Digital Markets, Competition and Consumers Act 2024 could support arguments of irrational failure to act.

– Actions/policies by public bodies contracting advertising with Meta reliant on allegedly unlawful data processing: 55% probability of being ultra vires. Public contracts must comply with public law principles (e.g., proportionality, proper purpose), and reliance on unlawful processing could exceed powers or involve improper funds use, though no specific challenges have succeeded.

For those with good ultra vires probability (above 40%), no published notices, reports, or URLs from ICO, CMA, or relevant public bodies disclose ultra vires risks or mandatory risk reports specifically addressing the possibility of ultra vires in these DORCAPS related to Meta. ICO and CMA publish general corporate risk registers (e.g., ICO documents from 2020-2021 on internal risks) and annual reports/transparency statements, but these focus on operational risks, not admissions of ultra vires in enforcement omissions, merger decisions, or contracting. No equivalent mandatory risk notices highlight ultra vires foreseeability or consequential tort harms from these specific failures. This absence increases tort claim risks against the State via vicarious liability for regulatory ultra vires, as non-disclosure prevents constructive notice to victims, weakening any Volenti non fit injuria defence.

In this case, the probability of successfully arguing contributory liability primarily against the regulator/public body (rather than vicariously against the State) so tort victims claim only against them is approximately 15-20%. UK public law establishes vicarious State liability for ultra vires acts by public authorities (including regulators like ICO/CMA), with non-delegable duties in core functions; direct personal/official liability requires misfeasance (bad faith/abuse of power), which is hard to prove absent evidence of malice, and contributory negligence rarely shifts full burden from State to individual regulators.

---

FOIS

The key bodies from which information is needed to gather evidence on ultra vires DORCAPS (including omissions in GDPR enforcement by ICO, competition enforcement/merger decisions by CMA, and public advertising contracts reliant on unlawful data) and potential internal recovery procedures (equivalent to accion de regreso) are the **Information Commissioner’s Office (ICO)** as main regulator for data protection, the **Competition and Markets Authority (CMA)** for competition aspects, and the **Cabinet Office** as oversight for central government contracting and potential state accountability procedures.

No specific published risk registers, board papers, or assurance frameworks from these bodies identify risks of ultra vires acts, legal challenges, or foreseeable tort harms related to Meta enforcement omissions, merger clearances, or advertising contracts; general corporate risks are published but not case-specific.

**Draft A: The “Strategic Knowledge” Probe** (Target: ICO as main decision maker on data enforcement)

Dear Information Access Team,

I am writing under the Freedom of Information Act 2000 to request the following metadata from any corporate, strategic, or operational risk registers held by the ICO concerning enforcement priorities or actions related to large online platforms processing personal data for behavioural advertising (including Meta Platforms Inc.):

1. Any risk entry titles, descriptions, risk IDs (if applicable), and assigned risk owners for risks involving potential under-enforcement of UK GDPR Articles 5, 6, or 9 against systemic data processing by dominant platforms, covering the period 2020 to present.

2. For any such identified risks, the inherent risk scores, residual risk scores, and any recorded changes in scores (movement) over the last 24 months.

3. The ICO’s current risk appetite statement or tolerance levels specifically regarding legal compliance and enforcement in data protection regulation.

Please provide this as factual administrative data, without disclosing any advisory content.

Yours sincerely,
oscar moya, Director of Competition & Consumer Organisation Party Limited (COCOO.uk), 23 Village Way, Beckenham, Kent BR3 3NA, Companies House Registration: 15466919, EU Transparency Register: 177568392007-84 Email: contact@cocoo.uk

**Draft B: The “Operational Failure” Probe** (Target: CMA as operational body on competition enforcement and mergers)

Dear Information Access Team,

Under the Freedom of Information Act 2000, I request the following metadata regarding any assessments or monitoring of competition impacts from digital mergers or data dominance involving Meta Platforms Inc. (formerly Facebook), including Instagram (2012) and WhatsApp (2014) acquisitions or ongoing market effects:

1. Dates of creation and finalisation (if any exist) for any post-merger reviews, impact assessments, or monitoring reports on long-term competition effects, along with the job titles of approvers.

2. The number of months (if tracked) that any related competition concerns or enforcement priorities have been reported as high-risk, red status, or off-track in board or management reporting since 2020.

3. Whether any internal procedure equivalent to recovery action (accion de regreso) has been initiated ex officio to reclaim costs or pursue accountability for potential regulatory failures leading to state compensation payments in competition or data-related torts; if not, any recorded reasons for non-initiation.

Yours sincerely,
oscar moya, Director of Competition & Consumer Organisation Party Limited (COCOO.uk), 23 Village Way, Beckenham, Kent BR3 3NA, Companies House Registration: 15466919, EU Transparency Register: 177568392007-84 Email: contact@cocoo.uk

**Draft C: The “Systemic Flaw” Probe** (Target: Cabinet Office as oversight for public contracting and state procedures)

Dear FOI Team,

I request under the Freedom of Information Act 2000 the following information on central government or public body advertising contracts involving Meta Platforms Inc.:

1. A list of titles and dates for any internal audit reports or reviews commissioned in the last 5 years related to compliance risks in public sector digital advertising contracts, particularly reliance on third-party data processing.

2. Metadata on any assessments of legal risks in such contracts, including dates created/finals and approver job titles (existence only, not content).

3. Details of any ex officio internal procedures initiated (or reasons for non-initiation) to pursue recovery (equivalent to accion de regreso) against regulators or public bodies for ultra vires acts leading to potential state liability or compensation payments in data protection or competition torts arising from regulatory failures.

Yours sincerely,
oscar moya, Director of Competition & Consumer Organisation Party Limited (COCOO.uk), 23 Village Way, Beckenham, Kent BR3 3NA, Companies House Registration: 15466919, EU Transparency Register: 177568392007-84 Email: contact@cocoo.uk

These questions focus on metadata (existence, titles, scores, dates, owners) to avoid refusals under sections 35 or 42, while trapping evidence of known risks (proving awareness of ultra vires potential without disclosure), score movements (showing watched-but-unaddressed escalation supporting recklessness), and non-initiation of recovery (evidencing failure to mitigate state tort exposure, strengthening misfeasance claims).

The PGE case, as detailed across the provided pages on pge.cocoo.uk, centers on alleged tortious harms stemming from the Spanish government’s prolonged failure to approve annual General State Budgets (Presupuestos Generales del Estado) since 2023, relying instead on automatic rollovers of prior budgets. This practice is claimed to violate Article 134 of the Spanish Constitution, which mandates annual budget approval.

Ultra vires DORCAPS (decisions, omissions, regulations, conduct, actions, policies) are attributed primarily to the Spanish government (Council of Ministers, Ministerio de Hacienda, and related ministries) as the public body:

– Decisions and actions: Choosing to rely structurally on budget rollovers rather than as exceptional temporary measures; awarding contracts directly or via in-house mechanisms (“encomiendas a medios propios”) during rollover periods without updated parliamentary appropriations.

– Omissions: Failing to approve new annual budgets, leading to lack of proper financial mandates for commitments; omitting competitive tenders in favor of direct awards without meeting strict unforeseeability or extreme urgency criteria.

– Conduct and policies: Engaging in opaque procurement practices that substitute parliamentary oversight with executive discretion, including recurring justifications of “urgency” for non-competitive awards; maintaining inadequate implementation of beneficial ownership registers under EU anti-money laundering directives.

These DORCAPS are further linked to breaches of EU law, including Directive 2014/24/EU on public procurement (transparency and competition requirements), Reglamento 2020/2092 on rule of law conditionality, and anti-money laundering directives requiring public beneficial ownership registers.

Secondary involvement includes omissions by the Spanish Competition Authority (CNMC) in failing to investigate anti-competitive effects of distorted procurement, and the European Commission in delayed enforcement related to Recovery and Resilience Facility fund disbursements affected by the impasses.

Harmed companies (victims under investigation or excluded from fair competition, facing delays, lost bids, and market distortions) include those in construction (e.g., Balfour Beatty plc, ACS, Ferrovial SE, Sacyr S.A.), technology and telecommunications (e.g., Capgemini SE, Amazon Web Services, Softcat plc), energy (e.g., Iberdrola S.A., SSE plc, Vestas Wind Systems A/S), healthcare and life sciences (e.g., ViiV Healthcare, Grifols S.A., Bupa/Sanitas), and others (e.g., London Stock Exchange Group plc, 2 Sisters Food Group). These entities suffer stalled projects, disrupted EU-funded initiatives (NextGenerationEU, Recovery and Resilience Facility), non-competitive contract awards favoring incumbents, and planning uncertainty.

Consumers and indirect victims include British and EU consumers reliant on public services (e.g., healthcare, infrastructure, energy transitions) impacted by delays in EU fund execution and macroeconomic instability; SMEs dependent on public contracts; and investors facing devalued opportunities or disrupted supply chains. The pages frame companies awarded contracts under the alleged distorted processes as initial beneficiaries but ultimately part of the victim chain due to the root ultra vires administrative failures, though primary emphasis is on excluded competitors and downstream economic operators as tort victims entitled to compensation via mechanisms like responsabilidad patrimonial del Estado under Spanish Law 40/2015 or EU-level claims. The evidencia-grok page focuses separately on Meta Platforms Inc. violations without linking to PGE-specific ultra vires or harms.

---

The equivalent in Spain to the UK judicial review for challenging ultra vires administrative decisions, omissions, regulations, conduct, actions, or policies is the **recurso contencioso-administrativo**, regulated by Ley 29/1998 de 13 de julio (LJCA). This allows direct challenge of general dispositions (reglamentos), express or presumed acts ending the administrative procedure, inactivities (omisiones), or material ways of acting (vías de hecho) that violate rights or interests.

Judicial review opportunities in the PGE case for ultra vires DORCAPS include:

– Recurso contencioso-administrativo against the ongoing omission of the Government (Council of Ministers and Ministerio de Hacienda) to approve annual Presupuestos Generales del Estado since 2023, relying structurally on prórrogas beyond exceptional temporary use, contrary to Article 134 of the Spanish Constitution. As an ongoing omission producing continuous harm, the recurso can be filed at any time while the inactividad persists (current in December 2025, with PGE 2025 prorrogated from 2023 via automatic mechanism and RD-ley 9/2024 of 23 December 2024). No fixed date applies; legitimacy requires demonstrating individualised harm or legitimate interest (e.g., as consumer/competition organisation affected by distorted procurement).

– Recurso contencioso-administrativo against specific acts of application, such as direct contract awards or encomiendas a medios propios during prorrogated budgets without proper parliamentary appropriations or competitive tenders, breaching Directive 2014/24/EU and national procurement rules. Plazo: 2 months from notification or publication of the act.

– Indirect challenge (impugnación indirecta) of underlying policies or regulations enabling non-competitive awards (e.g., recurring urgency justifications) when contesting an act of application, alleging they are ultra vires. No separate plazo for the indirect aspect if tied to timely challenge of the act.

– Recurso contencioso-administrativo for COCOO against the omission of the competent public authority (likely Ministerio de Hacienda or control organs under Ley 40/2015) to initiate ex officio internal procedures to pursue or publicise recovery of patrimonial responsibility from officials/regulators whose ultra vires DORCAPS caused State compensations to victims. Ley 40/2015 (arts. 32-37) establishes objective patrimonial responsibility but allows repetition against personnel with dolo, culpa or negligencia grave; no explicit mandatory ex officio initiation/publication exists, though control duties imply it. As ongoing omission with continuing harm (prórroga active), recurso viable now without expired plazo.

– Challenges to secondary regulations or policies with high probability of ultra vires (e.g., those facilitating opaque procurement or inadequate beneficial ownership registers under EU anti-money laundering directives) via direct recurso (2 months from publication) or indirect when applied. As harm ongoing via prorrogated budgets, indirect challenges remain timely when contesting current acts of application; direct if regulation recent or effects persistent.

All these allow claims for annulment, cessation of harm, and/or patrimonial responsibility indemnification under Ley 40/2015. COCOO has standing as organisation defending competition/consumer interests affected by market distortions.

---

1/ From the identified judicial review opportunities via recurso contencioso-administrativo, none are subject to a strict 3-month time limit, as the general plazo under Ley 29/1998 (LJCA) article 46 is 2 months for acts or dispositions. However, the opportunities tied to ongoing omissions (the structural reliance on prórroga of Presupuestos Generales del Estado, which remains in effect on 16 December 2025 as the 2023 budgets are prorrogated via automatic mechanism under article 134.4 of the Constitution and adjustments like RD-ley 9/2024) and the related omission to initiate ex officio internal recovery procedures under Ley 40/2015 are still viable without expired plazo, since the inactividad is continuing and produces persistent harm; jurisprudence allows challenge while the omission persists, without caducity if no prior fixed requerimiento has triggered a specific countdown. Specific acts of application (e.g., recent non-competitive contract awards during the current prórroga) would have their own 2-month plazo from notification or publication, so any from October 2025 onward remain within time. Indirect challenges to underlying policies also remain timely when tied to current acts. Yes, rolling judicial review opportunities exist here for the ongoing tort and contractual harms from the continued ultra vires omission and distorted procurement, as the harm is permanent and accruing daily in 2025, allowing fresh or continued challenges to the persisting inactividad and its effects without time bar while it lasts.

2/ Proposals to prevent and remedy the tort harms from these ultra vires DORCAPS include settlement agreements where the State (via Ministerio de Hacienda) accepts vicarious patrimonial responsibility under Ley 40/2015 for damages to excluded competitors, downstream consumers, and SMEs from distorted markets, offering compensation funds, priority contract awards to harmed companies, and grants for affected projects. In exchange, regulators and officials avoid personal liability claims for dolo or culpa grave by cooperating in transparency measures, such as public disclosure of ultra vires risks in procurement during prórroga periods; evidence supports that non-publication of these risks appears designed in bad faith to block the State’s violenti non fit iniuria defence, exposing them contributorily to harms via abuse of power. This incentivises acceptance to secure immunity from individual hooks while redressing victims. Customised remedies for COCOO to propose: declaratory injunctions ordering immediate approval of new PGE or cessation of non-competitive awards lacking urgency; suspended quashing orders on distorted contracts, conditional on retroactive competition; undertakings from Government to implement full beneficial ownership registers and competitive tenders; no fines on public bodies (to facilitate win-win via vicarious State liability); cy-pres proposals including a compensation scheme funded by State (e.g., 500 million euros pool for harmed companies in construction, tech, energy sectors and consumer restitution via reduced public tariffs), plus positive spillovers like accelerated EU fund execution grants and preferential awards to investigated/excluded firms, benefiting both companies under scrutiny and their tort victims by restoring market fairness against the ultra vires tortfeasors.

---

No open or closed claims, settlements, arbitrations, or cases exist where the Spanish State has paid compensation or penalties directly or tangentially related to the prolonged prórroga of Presupuestos Generales del Estado since 2023, or to alleged ultra vires omissions in annual budget approvals under Article 134 of the Constitution, or to resulting distortions in public procurement.

The prórroga mechanism is constitutional and automatic when new PGE are not approved, with no judicial findings of State liability for harms from its structural use.

No cases exist where companies have paid compensation or penalties specifically tied to these prórroga-related issues.

General responsabilidad patrimonial procedures under Ley 40/2015 apply to public administration harms, but no recorded instances link them to budget prórrogas in this context.

Related areas, such as COVID restrictions or other legislative breaches, have seen liability claims, but none connect to PGE prórrogas.

---

The probability that COCOO.uk may be granted locus standi (legitimación activa under article 19 LJCA) to challenge via recurso contencioso-administrativo the ongoing omission to initiate ex officio acción de regreso (under article 36 Ley 40/2015) against officials for ultra vires DORCAPS is low, around 20-30%. Spanish jurisprudence requires a qualified interés legítimo: direct or indirect affectation aligned with statutory purposes, not mere interest in legality or auto-attributed via statutes. Associations defending competition and consumers have standing in specific sectors (e.g., consumer actions under LGDCU), but general NGOs face denial if lacking specific link or when seen as defending abstract legality (e.g., cases against anticorruption or transparency associations). Here, COCOO is not directly harmed, no members identified as affected, and the omission concerns internal State recovery post-indemnification (not yet occurred in PGE prórroga context). The sent letter creates negative administrative silence (desestimación presunta), challengeable as inactividad while persisting, but silence alone does not confer strong standing without underlying qualified interest.

Ideas to build locus standi include sending targeted letters to public bodies (e.g., Ministerio de Hacienda) requiring response on specific issues, such as confirmation of ongoing refusal to publish ultra vires risk assessments or foreseeable tort harms from DORCAPS (including PGE prórroga effects on procurement/competition). If they reply expressly denying or confirming omission, that creates an express act challengeable with potentially stronger standing (as COCOO becomes affected by the response to its petition). Pre-action disclosure-style letters (though not formal PAD in Spain) or FOI requests (under Ley 19/2013) seeking evidence of risks/non-initiation of regreso can force decisions; negative silence or express refusal then becomes the impugned act. This is possible under LJCA for inactividad/vía de hecho, but success depends on framing as defending collective competition/consumer interests distorted by prórroga (e.g., market harms to SMEs/consumers). Using judicial review as public notification mechanism for risks aligns with transparency duties, but courts reject if primary motive is notification over qualified interest; argue breach of good faith fiduciary duty via non-disclosure enabling tort harms, tying to COCOO’s purposes. Prior FOIs strengthen evidence base but not standing alone.

---

The main DORCAPS identified are:

1. Ongoing omission by the Government (Council of Ministers and Ministerio de Hacienda) to approve annual Presupuestos Generales del Estado since 2023, relying structurally on automatic prórrogas under Article 134.4 of the Spanish Constitution.

Probability of being ultra vires: 5%. The prórroga mechanism is expressly constitutional and automatic when new PGE are not approved; it is presented in official documents (e.g., BOE publications like RD-ley 9/2024 and Ley 31/2022) as a standard temporary measure, not exceptional or illegal. No judicial or official recognition of ultra vires risk exists.

2. Decisions and actions awarding contracts directly or via encomiendas a medios propios during prorrogated budgets, often without competitive tenders or strict urgency criteria, allegedly breaching Directive 2014/24/EU.

Probability of being ultra vires: 40%. While direct awards are exceptional under EU and national procurement law, recurring use during prórroga could distort competition if not justified by genuine unforeseeability; however, Spanish practice allows flexibility, and no widespread findings of illegality tie specifically to prórroga periods.

3. Conduct and policies involving recurring urgency justifications for non-competitive awards and opaque procurement.

Probability of being ultra vires: 35%. Similar to above; potential for abuse exists, but justified urgency is permissible, and no official assessments label this as inherent ultra vires in prorrogated contexts.

4. Omissions in adequate implementation of beneficial ownership registers under EU anti-money laundering directives.

Probability of being ultra vires: 60%. Spain has faced EU criticism and infringement procedures for delays or inadequacies in transposition/implementation of directives like 2015/849; ongoing issues increase likelihood of non-compliance.

5. Omission by CNMC to investigate anti-competitive effects of distorted procurement during prórroga.

Probability of being ultra vires: 15%. CNMC has discretionary enforcement powers; no mandatory duty to investigate every potential distortion, and no evidence of required ex officio action ignored.

6. Omission by competent authorities (e.g., Ministerio de Hacienda) to initiate ex officio acción de regreso under Ley 40/2015 against officials for potential dolo or culpa in ultra vires acts.

Probability of being ultra vires: 10%. Acción de regreso is discretionary post-indemnification; no strict ex officio obligation exists without proven fault, and no harms have triggered State payments here.

7. Delayed enforcement by European Commission related to rule of law conditionality (Reglamento 2020/2092) and Recovery funds affected by budget impasses.

Probability of being ultra vires: 20%. Commission has tools but acts cautiously; no direct finding against Spain tying budget prórrogas to conditionality breaches.

For those with good ultra vires probability (above 30%):

– Prórroga omission (5%): No published notices, reports, or URLs from public bodies (Ministerio de Hacienda, Consejo de Ministros, BOE) acknowledge ultra vires risk; documents treat it as routine constitutional application.

– Direct/opaque contract awards (40% and 35%): No specific notices or mandatory risk reports from contracting authorities or Ministerio de Hacienda identify ultra vires risks tied to prórroga; general procurement guidance exists, but not framing this as inherent illegality.

– Beneficial ownership registers omission (60%): Some EU Commission reports note Spanish delays/incumplimientos in anti-money laundering directives, but no public Spanish notices (from Ministerio or regulators) admit ultra vires risk levels.

No publications found for other lower-probability DORCAPS framing them as ultra vires risks.

In this case, the probability of successfully arguing that the regulator/public body (not the State) is the contributorily liable party, shifting tort victim claims exclusively against them via personal liability for dolo/culpa grave (excluding vicarious State responsibility under Ley 40/2015), is very low, around 10-15%. Spanish law establishes objective vicarious patrimonial responsibility of the State for harms from public bodies’ agents; personal liability requires proven fault, and non-publication of risks does not automatically negate State’s primary hook or enable violenti defence to block victim compensation entirely.

---

Target bodies for FOI requests under Ley 19/2013 are:

– Main decision maker: Ministerio de Hacienda y Función Pública (responsible for PGE preparation, prórroga management, and patrimonial responsibility procedures).

– Operational arm: Consejo de Ministros/Gobierno de España (decisions on budget submission and prórroga reliance).

– Regulator/oversight: Comisión Nacional de los Mercados y la Competencia (CNMC) (potential competition distortions from procurement during prórroga).

Requests submit via Portal de la Transparencia (https://transparencia.gob.es or https://sede.transparencia.gob.es) for central administration, or CNMC sede electrónica (https://sede.cnmc.gob.es) for CNMC.

No public risk registers, board papers, or strategic risk frameworks found acknowledging ultra vires risks related to prolonged PGE prórroga, non-competitive procurement during prórroga, or beneficial ownership implementation delays.

### DRAFT A: Strategic Knowledge Probe (Target: Ministerio de Hacienda y Función Pública)

Oscar Moya Lledo
DNI: 11820221S
Direccion: Paseo de la chopera, 9, Madrid 28045
contact@cocoo.uk

16 December 2025

Ministerio de Hacienda y Función Pública
Unidad de Información Transparencia
Via Portal de Transparencia (or registered submission)

Solicitud de acceso a la información pública al amparo de la Ley 19/2013, de 9 de diciembre.

Solicito la siguiente información relativa al período 2023-2025 respecto de riesgos asociados a la prórroga automática de Presupuestos Generales del Estado y sus efectos en contratación pública y competencia:

1. Si existe entrada en cualquier registro de riesgos estratégico, marco de gestión de riesgos o equivalente, incluyendo título de la entrada, descripción breve (sin contenido detallado), propietario del riesgo y fechas de creación/actualización.

2. Evolución de puntuaciones de riesgo (inherente vs residual, o equivalente) para cualquier entrada relacionada con legalidad constitucional, cumplimiento Directiva 2014/24/UE o distorsiones competitivas derivadas de prórroga presupuestaria, indicando fechas y cambios de puntuación numérica o cualitativa.

3. Declaración de apetito de riesgo (risk appetite statement) respecto de cumplimiento legal en materia presupuestaria y contratación pública.

4. Si se ha iniciado acción de regreso (art. 36 Ley 40/2015) contra funcionarios o autoridades por daños derivados de prórrogas presupuestarias o contrataciones asociadas; en caso negativo, motivos registrados para no iniciarla ex officio.

Esta información es metadata administrativa para evidenciar evaluación de riesgos previsibles y deberes de recuperación interna.

### DRAFT B: Operational Failure Probe (Target: Consejo de Ministros / Presidencia del Gobierno, via Portal Transparencia)

Oscar Moya Lledo
DNI: 11820221S
Direccion: Paseo de la chopera, 9, Madrid 28045
contact@cocoo.uk

16 December 2025

Presidencia del Gobierno / Consejo de Ministros
Unidad de Información Transparencia
Via Portal de Transparencia

Solicitud de acceso a la información pública al amparo de la Ley 19/2013.

Solicito información operativa (metadata, no contenido) relativa a 2023-2025 sobre prórroga PGE y ejecución presupuestaria:

1. Fechas de creación, finalización y titular del cargo aprobador de cualquier evaluación de impacto o informe interno sobre efectos de prórroga prolongada en ejecución de fondos europeos o contratación.

2. Número de meses o períodos en que la prórroga presupuestaria o sus efectos (ej. contrataciones directas) han sido reportados como “rojo” (off track, alto riesgo o equivalente) en dashboards o informes al Consejo de Ministros.

3. Si consta iniciación ex officio de procedimiento de responsabilidad patrimonial o acción de regreso por daños a terceros derivados de prórroga; en caso negativo, motivos administrativos registrados.

Esta solicitud busca datos factuales sobre seguimiento operativo de riesgos previsibles.

### DRAFT C: Systemic Flaw Probe (Target: CNMC)

Oscar Moya Lledo
DNI: 11820221S
Direccion: Paseo de la chopera, 9, Madrid 28045
contact@cocoo.uk

16 December 2025

Comisión Nacional de los Mercados y la Competencia
Via sede electrónica (https://sede.cnmc.gob.es/tramites/general/transparencia)

Solicitud de acceso a la información pública al amparo de la Ley 19/2013.

Solicito la siguiente información relativa a 2023-2025 sobre posibles distorsiones competitivas derivadas de prórroga PGE:

1. Porcentaje de personal formado en políticas de defensa de competencia aplicadas a contratación pública durante prórrogas presupuestarias o procedimientos de urgencia.

2. Lista de títulos de informes de auditoría interna o revisiones encargadas relacionados con investigación de efectos anticompetitivos en contratación pública estatal o fondos europeos durante períodos de prórroga presupuestaria.

3. Si la CNMC ha evaluado o registrado riesgos de omisión en investigación ex officio de distorsiones por prórroga PGE; en caso de acción de regreso iniciada contra CNMC por tales omisiones, estado y motivos si no se inició.

Esta información es agregada y de títulos para evaluar cumplimiento sistémico.

These questions trap authorities because confirming existence of risk entries with rising scores or red status evidences knowledge of foreseeable ultra vires harms and competition distortions without mitigation or disclosure, supporting misfeasance/reckless conduct claims; absence or non-initiation of acción de regreso highlights failure to pursue internal recovery, strengthening vicarious State liability while exposing personal/contributory fault for non-disclosure of risks.

---

 

The NextGen case, as detailed across the provided pages on nextgen.cocoo.uk, centers on alleged systemic mismanagement and irregularities in Spain’s implementation of the European Union’s Recovery and Resilience Facility (RRF) funds under NextGenerationEU. The content claims breaches of EU and Spanish laws in public procurement, transparency, and competition, leading to unfair allocation of funds.

Regulators and public bodies identified with potentially ultra vires DORCAPS include Spanish public authorities and ministries (such as those responsible for Finance, Economic Affairs, Industry, and Transport), which awarded RRF contracts through opaque processes, direct awards, and without adequate due diligence on recipient eligibility, ignoring prior anti-competitive sanctions. The European Commission is cited for omissions in substantive action, inadequate response to complaints, and failure to enforce transparency or trigger mechanisms like suspension of payments. The Spanish National Commission on Markets and Competition (CNMC) issued sanctions but the awards proceeded despite them. Key ultra vires elements involve decisions to allocate over €800 million in RRF funds to ineligible recipients, omissions in reporting final beneficiaries and conducting controls, conduct involving favoritism and non-transparent tenders, actions via Royal Decree-Law 36/2020 weakening procurement controls, and policies breaching RRF Regulation (EU) 2021/241 (Articles 5, 9, 22), Rule of Law Conditionality Regulation (EU, Euratom) 2020/2092, EU procurement directives, and Spanish laws like General Subsidies Law (Article 13).

Companies harmed as victims (excluded competitors under investigation or sanctioned by regulators, yet ultimately victimized by the ultra vires awards) include Dragados S.A. (ACS Group), Sacyr S.A., FCC Construcción S.A., Ferrovial Agroman S.A., Carat España S.A., Media Sapiens España S.L., Alstom, Siemens Mobility, CAF, and others that received funds despite CNMC fines for bid-rigging and cartels, facing risks of contract nullification, clawbacks, and liabilities.

Consumers and tort victims harmed (primarily excluded SMEs and competitors suffering economic loss from distorted markets) include small and medium-sized enterprises in sectors such as heavy/civil engineering construction (e.g., Obrascón Huarte Lain, COMSA Corporación, Elecnor), energy/green transition (e.g., Solaria Energía y Medio Ambiente, Nexus Energía), automotive/EV supply chain (e.g., Gestamp, CIE Automotive), digital transformation/technology (e.g., Everis, GMV), and healthcare (e.g., Ribera Salud, Vithas), along with broader classes represented by associations like National Confederation of Construction, APPA Renovables, SERNAUTO, and Adigital. These parties face lost opportunities, unfair exclusion, and market distortions traceable to the regulators’ and public bodies’ alleged ultra vires DORCAPS. No references to Google or Gemini appear in the case content.

---

The equivalent in Spain to the UK judicial review is the recurso contencioso-administrativo, which allows challenges to administrative acts, omissions, regulations, and policies for illegality, including ultra vires actions by public bodies.

Judicial review opportunities in the NextGen case to challenge ultra vires DORCAPS include the following.

Recurso contencioso-administrativo against specific contract awards or direct allocations of RRF funds to ineligible recipients despite CNMC sanctions, on grounds of breach of RRF Regulation (EU) 2021/241, procurement directives, and Spanish laws. Excluded competitors or associations like COCOO have standing if directly affected. Time limit is generally two months from notification or publication of the act, or six months for presumed acts via silence administrativo. As awards continue into 2025 and harm is ongoing through distorted markets, filings remain timely for recent or future awards.

Recurso contencioso-administrativo against Royal Decree-Law 36/2020 provisions weakening procurement controls, or its implementation in RRF fund management, as ultra vires or disproportionate. Regulations have a two-month limit from publication (expired since 2020), but ongoing implementation and harm allow indirect challenge when applied in specific acts, or direct if arguing continued effects. High probability of success if proven to breach EU law principles.

Recurso contencioso-administrativo for administrative inactivity or omission, such as failure by Spanish ministries or authorities to report final beneficiaries, conduct adequate controls, or exclude sanctioned entities ex officio. This includes the specific opportunity for COCOO to challenge the public authority that should have initiated, but omitted, an internal procedure to pursue or publicise recovery against the ultra vires regulator/public body causing torts compensated by the State. Inactivity challenges have no fixed act date; filing is timely while omission persists and harm is ongoing.

Action for patrimonial liability of the public administration for damages from ultra vires DORCAPS, seeking compensation for victims (excluded SMEs, competitors). One-year limit from when harm is known and stabilised, timely for ongoing distortions in 2025.

At EU level, action for annulment under Article 263 TFEU at the CJEU against European Commission decisions approving payments or omitting enforcement despite complaints on transparency or eligibility breaches. Two-month limit from publication or notification; limited standing for non-privileged applicants like COCOO unless directly and individually concerned. Preliminary ruling requests via national courts also possible on EU law interpretation.

These avenues establish grounds to annul acts, compel action, or obtain compensation traceable to ultra vires DORCAPS by Spanish authorities and Commission omissions.

---

From the previously identified judicial review opportunities via recurso contencioso-administrativo, the ones still within a potential 3-month time limit as of 16 December 2025 are those challenging specific contract awards or direct allocations of RRF funds that occurred after 16 September 2025 (3 months prior). Recent adjudications and resolutions of PERTE and other NextGenerationEU funds have continued into late 2025, with ongoing convocations, resolutions, and payments reported throughout the year, including new projects and disbursements in sectors like agro, energy, and infrastructure. For these recent awards (published or notified after mid-September 2025), the standard 2-month deadline from notification or publication applies and remains open.

The opportunities older than 3 months but where the tort or contractual harm is ongoing as of 16 December 2025, allowing for potential continued or renewed challenge (equivalent to a rolling judicial review), include the recurso contencioso-administrativo for administrative inactivity or omission, such as the failure by Spanish ministries or authorities to report final beneficiaries, conduct adequate controls, exclude sanctioned entities ex officio, or initiate/publish internal procedures to pursue recovery against ultra vires bodies causing State-compensated torts. This omission persists daily while funds remain undistributed or distorted markets continue, with market harms from unfair allocations ongoing in 2025 due to active execution of the Plan de Recuperación. Jurisprudence supports that challenges to persistent inactivity have no fixed deadline and can be filed while the omission and harm endure, without strict prescription barring access.

Additionally, the action for patrimonial liability of the public administration for damages from ultra vires DORCAPS remains timely, as the 1-year limit runs from when the harm is known and its effects manifest or stabilise; with ongoing market distortions and economic losses in 2025 traceable to the continuing implementation and effects of past awards/omissions, filings for current harms are within time.

---

To prevent and remedy the tort harms from ultra vires DORCAPS in the NextGen case, proposals focus on leveraging the State’s vicarious liability under Spain’s responsabilidad patrimonial del Estado regime, where the State bears objective responsibility for damages caused by public bodies’ illegal acts or omissions, including ultra vires ones. This shields individual officials from personal fiduciary liabilities while enabling victims (excluded SMEs, sanctioned companies facing risks, and their downstream tort victims) to obtain compensation through administrative claims or recurso contencioso-administrativo.

Evidence supports that public bodies’ unwillingness to publish ultra vires risks, such as ineligible RRF awards despite CNMC sanctions or omissions in beneficiary reporting, constitutes bad faith and abuse of power, depriving the State of any potential “volenti” defense (analogous to volenti non fit injuria, inapplicable here as victims did not consent to harms). This contributory liability arises from reckless concealment, incentivising bodies to accept proposals that redress victims and avoid escalation to personal accountability claims.

Customised remedies and undertakings for COCOO to propose include commitments by ministries (e.g., Economic Affairs, Industry) to immediate transparency on all PERTE/RRF final beneficiaries and sanctions checks, with public disclosure of ultra vires risks in ongoing 2025 awards (e.g., PERTE Chip, decarbonisation, economy circular projects resolved post-September 2025). Propose undertakings for ex officio exclusion of ineligible recipients and clawback initiation, plus reallocation of recovered funds via new grant awards to harmed excluded SMEs in affected sectors (construction, energy, automotive, digital).

No fines on public bodies, as focus is vicarious State liability, not punitive sanctions. Injunctions via recurso contencioso-administrativo to compel reporting omissions and halt further distorted awards while harms persist. Suspended quashing orders on past awards, conditional on redress commitments. Cy-pres equivalents through extrajudicial settlements under responsabilidad patrimonial procedures, directing State compensation funds to victim classes (e.g., associations representing excluded SMEs) for positive spillovers like sector grants or contract priority awards to investigated companies and their victims.

These proposals benefit all: public bodies/regulators avoid personal hooks via State coverage and bad faith exposure; investigated companies gain risk mitigation and potential reallocation; tort victims (SMEs) secure compensation, injunctions, and new opportunities; State redresses distortions efficiently.

---

No open or closed claims, settlements, or arbitrations have been identified where the Spanish State has paid compensation or penalties directly or tangentially related to the NextGen case, involving alleged ultra vires awards of RRF/PERTE/NextGenerationEU funds to sanctioned companies despite CNMC sanctions, lack of transparency, or exclusion of SMEs.

Tangentially related matters include a 2024 Tribunal Supremo ruling annulling direct subsidies of 6 million euros from RRF funds awarded to certain autonomous communities, on grounds of insufficient justification, but this involved reallocation rather than State payment of compensation or penalties. Another tangential issue is the 2025 European Commission suspension of 626 million euros in NextGenerationEU funds to Spain due to non-compliance with public employment temporary contracts milestones (unrelated to procurement irregularities), resulting in withheld payments but no compensation or penalty paid by the State.

Companies involved in the case have faced penalties from the CNMC for past cartel conduct in public tenders, including a 2022 sanction totalling 203.6 million euros on six constructoras (Dragados/ACS: 57.1 million; FCC: 40.4 million; Ferrovial: 38.5 million; Acciona: 29.4 million; OHLA: 21.5 million; Sacyr: 16.7 million) for altering licitaciones over 25 years, with some suspensions cautelar while appealed. No payments of compensation by these companies to victims or the State have been identified in relation to RRF awards, and no clawbacks or recoveries tied to their receipt of NextGenerationEU funds despite sanctions. No claims or settlements involving COCOO or related to the specific ultra vires DORCAPS in RRF implementation have been found.

---

The probability that COCOO.uk may be granted locus standi (legitimación activa under Article 19 LJCA) to challenge via recurso contencioso-administrativo the ongoing public body’s decision (manifested as negative administrative silence to your letter) not to initiate acción de regreso against the ultra vires tortfeasor regulator, public body, or officials is approximately 40-50%. This estimate derives from Tribunal Supremo jurisprudence requiring associations to demonstrate a legitimate interest beyond mere statutory aims or general public interest defence, with the interest arising from direct affection to collective rights promoted in statutes (not auto-attribution) or specific impact producing benefit from annulment. COCOO’s role in competition and consumer protection aligns partially with transparency and fair procurement harms in NextGen, but lacks direct harm to COCOO or proven specific affection to members/victims, and acción de regreso is discretionary post-compensation payment (rarely exercised, per doctrine). The silence to your letter strengthens interest as the challenged decision, but courts often deny broad associational standing without concrete ties, as in cases rejecting anticorruption or transparency associations for lacking direct impact.

Ideas to build locus standi include sending targeted letters (requerimientos) to public bodies demanding express resolutions on specific duties, such as publishing ultra vires risk assessments (including foreseeable tort harms) or confirming denial of public notices on DORCAP risks. If ignored (silence after 3 months under Article 29.1 LJCA), this creates a challengeable inactivity while ongoing, per STS allowing reiterated requerimientos without caducity (plazos reopen). If they respond expressly denying, this produces a recurrible act (express resolution). Pre-action disclosure equivalents exist via transparency requests (Ley 19/2013) or FOI already used by COCOO, forcing responses evidencing omissions and bolstering interest claim. This is possible and strategic: it generates recurrible decisions/inactions, evidences bad faith concealment (breach of good faith duty), and serves public notification by highlighting risks in proceedings, compelling disclosure that prevents harms and supports fiduciary breach arguments against bodies for non-publication of foreseeable tort risks. No “tricking” needed; requerimientos are lawful tools to activate duties and create judicial hooks.

---

The main DORCAPS identified in this chat history are decisions by Spanish ministries to allocate over €800 million in RRF funds to recipients ineligible due to prior CNMC sanctions, omissions by Spanish authorities in reporting final beneficiaries and conducting controls, conduct and actions involving favoritism and non-transparent tenders, policies via Royal Decree-Law 36/2020 weakening procurement controls, and European Commission omissions in enforcement despite complaints.

For decisions allocating funds to ineligible recipients despite CNMC sanctions, the probability of being ultra vires is 70%. This opinion bases on clear breaches of RRF Regulation (EU) 2021/241 Article 22 requiring protection of EU financial interests and exclusion of entities undermining competition, plus Spanish procurement laws mandating exclusion post-competition sanctions, with awards proceeding despite known CNMC fines constituting disproportionate and illegal favoritism under EU principles.

For omissions in reporting final beneficiaries and controls, the probability of being ultra vires is 80%. Article 22(2)(c) and (d) of Regulation 2021/241 impose mandatory duties on Member States for transparency and controls, with persistent non-reporting despite complaints violating these directly applicable obligations.

For conduct and actions via favoritism and non-transparent tenders, the probability of being ultra vires is 65%. These breach EU procurement directives and Spanish laws requiring open competition, with direct awards and opacity traceable to weakened procedures under emergency justifications exceeding permissible limits.

For policies in Royal Decree-Law 36/2020 weakening controls, the probability of being ultra vires is 60%. While justified under urgency, ongoing application distorts competition beyond necessity, potentially disproportionate under EU law proportionality principle, though courts may uphold emergency basis.

For European Commission omissions in enforcement, the probability of being ultra vires is 50%. The Commission has discretion under Article 24 but omissions despite evidenced breaches could fail duty to protect interests under Article 22, though high deference to Commission margin limits success.

Searches across official sites (planderecuperacion.gob.es, mineco.gob.es, hacienda.gob.es, transparencia.gob.es) and reports reveal publications of general antifraud plans, risk maps for fraud/conflicts (e.g., Guía Medidas Antifraude at pap.hacienda.gob.es, planes by ministries/IDAE), beneficiary lists (top 100 perceptores at portal.mineco.gob.es), and CoFFEE/MINERVA tools for risk detection. No publications found of specific ultra vires risks, such as illegality of awards to CNMC-sanctioned entities, breaches of Regulation 2021/241 eligibility/transparency, or Royal Decree-Law 36/2020 legal risks; reports focus on fraud/irregularities, not ultra vires or procurement illegality tied to sanctions. No URLs disclose these particular DORCAP ultra vires probabilities or mandatory reports admitting such risks.

In this case, the probability of successfully arguing contributory liability solely against the regulator/public body (shifting claims from vicarious State liability under responsabilidad patrimonial) is low at 15-20%. Spanish law imposes objective State liability for public agents’ illegal acts/omissions (Ley 40/2015 Article 32), with acción de regreso against officials only post-State compensation and requiring proven dolo or culpa grave (rarely granted, discretionary). Non-publication of risks strengthens bad faith arguments but does not override vicarious regime or enable volenti-like defense, as victims lack consent/notice; jurisprudence favors State as primary payer for efficiency, limiting personal hooks.

---

The target bodies for these FOI requests under Ley 19/2013 de Transparencia are the main Spanish public authorities involved in managing and overseeing NextGenerationEU/RRF funds and related procurement in the NextGen case.

Target Body 1 (The Big Decision Maker): Ministerio de Hacienda y Función Pública (overall PRTR coordination, antifraud, beneficiary controls, potential acción de regreso via responsabilidad patrimonial).

Target Body 2 (The Operational Arm): Ministerio de Economía, Comercio y Empresa (formerly Asuntos Económicos, direct management of PERTE awards and allocations to sanctioned entities).

Target Body 3 (The Regulator/Auditor): Comisión Nacional de los Mercados y la Competencia (CNMC, competition sanctions relevant to eligibility) and Intervención General de la Administración del Estado (IGAE, financial controls, SNCA antifraud).

The Issue/Case Topic: Allocation of RRF/PRTR funds to entities despite prior competition sanctions, omissions in transparency/controls on final beneficiaries, and potential ultra vires breaches of Regulation (EU) 2021/241.

The Suspected Harm: Market distortions, economic losses to excluded competitors/SMEs, foreseeable tort harms from non-publication of legal/eligibility risks.

Relevant Dates: Decisions/omissions ongoing from 2021 to 2025.

Reconnaissance shows Spanish authorities publish Planes de Medidas Antifraude with general risk matrices (fraud/conflicts focus), but no specific risk registers admitting ultra vires/legal challenge risks on sanctioned recipients or transparency omissions. No smoking gun docs with Risk IDs for ultra vires found in board papers (mostly fraud-oriented). Requests target metadata to evade refusals.

Draft A: The “Strategic Knowledge” Probe (Target: Ministerio de Hacienda y Función Pública, as main decision maker/coordinator).

Oscar Moya LLedo
DNI: 11820221S
Direccion: Paseo de la chopera, 9, Madrid 28045
contact@cocoo.uk

Unidad de Información de Transparencia
Ministerio de Hacienda y Función Pública
Calle Alcalá, 9
28014 Madrid

Email: unidadinformaciontransparencia@hacienda.gob.es

16 December 2025

Solicitud de acceso a la información pública (Ley 19/2013)

I request the following information on any risk registers or matrices maintained in relation to the management of Plan de Recuperación, Transformación y Resiliencia (PRTR) funds:

1. Titles, descriptions, and risk owners of any entries related to risks of legal non-compliance, eligibility breaches for beneficiaries with prior competition sanctions, or transparency obligations on final beneficiaries.

2. Movement of inherent vs residual risk scores (e.g., dates of changes, previous/current scores) for such entries over the period 2023-2025.

3. Any statement or document outlining the risk appetite for legal compliance in PRTR fund allocation and controls.

Additionally, whether any acción de regreso has been initiated (or reasons for non-initiation) against administrations, regulators, or officials for potential responsabilidad patrimonial arising from PRTR-related harms, and if no such procedure exists or was pursued, the reasons.

This is factual/administrative metadata, not content requiring privilege exemptions.

Draft B: The “Operational Failure” Probe (Target: Ministerio de Economía, Comercio y Empresa, as operational allocator).

Oscar Moya LLedo
DNI: 11820221S
Direccion: Paseo de la chopera, 9, Madrid 28045
contact@cocoo.uk

Unidad de Transparencia
Ministerio de Economía, Comercio y Empresa
(Submit via Portal de Transparencia or known contact if available; alternatively through general Hacienda transparency portal)

16 December 2025

Solicitud de acceso a la información pública (Ley 19/2013)

I request metadata on any impact assessments or monitoring related to PERTE/PRTR awards:

1. Dates of creation, finalisation, and job titles of approvers for assessments on eligibility checks (e.g., exclusion of sanctioned entities) or transparency reporting.

2. Number of months or periods in 2023-2025 where PRTR/PERTE allocation processes were reported as high risk or off-track internally regarding legal/eligibility compliance.

Additionally, details on whether acción de regreso procedures were considered or initiated for any potential State compensation claims linked to PRTR awards, including reasons if not pursued.

This seeks existence/proof metadata only.

Draft C: The “Systemic Flaw” Probe (Target: CNMC and IGAE/SNCA).

For CNMC: Submit via sede.cnmc.gob.es/tramites/general/transparencia

For IGAE: secretaria.ig@igae.hacienda.gob.es or transparency portal.

Oscar Moya LLedo
DNI: 11820221S
Direccion: Paseo de la chopera, 9, Madrid 28045
contact@cocoo.uk

[Relevant transparency unit]

16 December 2025

Solicitud de acceso a la información pública (Ley 19/2013)

I request:

1. Percentage or numbers of staff trained on policies for competition sanctions impacting EU fund eligibility or PRTR antifraud measures (2023-2025).

2. List of titles of internal audit reports commissioned in 2023-2025 related to PRTR fund implications of sanctions or transparency controls.

Additionally, for IGAE/SNCA: Information on any acción de regreso pursued (or reasons not) against regulators/public bodies for PRTR-related potential liabilities.

These questions trap authorities because factual metadata on risk scores/movements proves awareness of escalating legal risks without admitting illegality, evidencing reckless failure to mitigate foreseeable harms; existence of assessments without action supports misfeasance/abuse claims; training/audit gaps reveal systemic recklessness in concealing ultra vires risks, strengthening tort liability for non-publication and bad faith contributory conduct.

From the content of the provided COCOO.uk pages on the Telefónica case, the identified ultra vires DORCAPS (decisions, omissions, regulations, conduct, actions, policies) attributed to regulators and public bodies are as follows:

The Spanish government through SEPI authorized and executed a €2.3 billion investment to acquire a 10% stake in Telefónica, described as a political maneuver rather than a rational commercial decision compliant with the Private Investor in a Market Economy principle, constituting illegal state aid under Article 107 TFEU and misfeasance in public office.

CNMC (Spain) engaged in omissions by failing to enforce merger remedies from 2010 (Mediaset/Atresmedia duopoly) and 2015 (Telefónica/DTS acquisition), refusing new investigations despite evidence of ongoing breaches, arbitrary and inconsistent enforcement (e.g., pursuing Telefónica breaches but not equivalent Mediaset ones post-2024 annulment), and past unlawful conduct using anonymized evidence violating rights to defense.

CMA (UK) and Ofcom omissions include failing to establish frameworks assessing risks from foreign state influence on critical infrastructure (via Virgin Media O2), and not investigating governance distortions post-SEPI investment despite statutory duties.

European Commission (DG COMP) omission in not investigating or acting on alleged illegal state aid despite complaints.

These DORCAPS are claimed to enable Telefónica’s anti-competitive conduct, harming companies under investigation (Telefónica itself, through distorted governance and enforcement inconsistencies) and the tort victims of those companies (competitors such as Orange España, MasOrange, Vodafone Spain/Zegona, Digi Spain, BT Group/EE, Vodafone UK, MVNOs like Sky Mobile, Tesco Mobile; media entities like Atresmedia, Mediaset España, DAZN, Sky, BT, ITV; advertisers and smaller operators facing margin squeeze, discriminatory access, predatory pricing, bundling).

Consumers harmed include residential and business users of Movistar (Spain) and Virgin Media O2 (UK) services, facing higher prices, reduced choices, poorer service quality, and threats to media pluralism from ongoing distortions ultimately traceable to the regulatory and public body failures.

---

The equivalent to UK judicial review in Spain is the **contencioso-administrativo** procedure, which challenges administrative acts, omissions, regulations, and policies of public bodies for illegality, including ultra vires actions.

Judicial review opportunities to challenge the identified ultra vires DORCAPS include the following, with a focus on ongoing harm from continuing omissions and policies, meaning claims remain timely as of December 16, 2025:

In Spain, via contencioso-administrativo proceedings (generally 2 months from the act or knowledge of it, but ongoing omissions or continuing effects of regulations/policies allow claims while harm persists):

– Challenge the Spanish Government’s 2023 decision (implemented in 2024 with SEPI reaching 10% stake in Telefónica by May 2024) as illegal state aid and misfeasance, though the core decision is time-barred; ongoing implementation and effects (e.g., distorted governance) remain challengeable.
– Challenge CNMC omissions in enforcing 2010 and 2015 merger remedies and refusing investigations, as these are continuing failures with ongoing anti-competitive harm.
– Challenge any CNMC secondary regulations or policies on merger remedy enforcement or state influence assessment that appear ultra vires, given inconsistent application and ongoing distortions.

In the UK, via judicial review (promptly and within 3 months of grounds arising, but continuing breaches or policies allow claims while effects persist):

– Challenge CMA and Ofcom omissions in failing to assess or investigate foreign state influence risks in Virgin Media O2 post-SEPI investment, as these are ongoing statutory duty failures with continuing harm to critical infrastructure competition.

At EU level:

– Action for failure to act under Article 265 TFEU against the European Commission (DG COMP) for omission in investigating the alleged illegal state aid despite complaints; must first call on Commission to act (2 months for response), then challenge inaction within further 2 months; viable as no formal investigation opened yet and harm ongoing.
– If a no-aid decision emerges, challenge it via annulment action (Article 263 TFEU, 2 months from publication).

Additionally, COCOO can pursue judicial review (or contencioso-administrativo equivalent) against the relevant public authority (e.g., Spanish Government or Ministry responsible for CNMC oversight) for failure to initiate or publicize an internal procedure to hold the regulator/public body accountable ex officio where its ultra vires DORCAPS caused tort harm compensated by the State; this targets the omission to pursue liability/recovery internally, which is ongoing while harm and non-action persist.

For secondary legislation/implementation (policies/regulations relevant to this case with high ultra vires probability, ongoing harm):

– CNMC policies on selective merger remedy enforcement (e.g., inconsistent pursuit of breaches) — challengeable in Spain as continuing arbitrary conduct.
– Any Spanish or UK regulatory policies failing to address state-influenced governance distortions in telecoms — timely due to persistent effects on competition and consumers.

No specific fixed dates apply beyond the SEPI acquisition completion around May 2024 (core decision likely time-barred now except for effects); all omission-based or policy challenges remain in time due to ongoing nature.

---

From the list of identified judicial review opportunities, none are strictly within a fresh 3-month time limit as of 16 December 2025, given that the core SEPI acquisition decision and completion occurred in 2023-2024 (with the 10% stake reached and maintained since May 2024, and ongoing effects including governance influence persisting into 2025).

However, several opportunities involve older grounds (predating September 2025) where the tort harm (anti-competitive distortions, higher prices, reduced choice for consumers and competitors) remains ongoing as of 16 December 2025, allowing for a rolling judicial review challenge due to continuing omissions, policies, or effects:

– In Spain (contencioso-administrativo, generally 2 months but viable for continuing omissions while harm persists): CNMC ongoing omissions in enforcing 2010/2015 merger remedies and refusing investigations; challenges to CNMC secondary policies on selective/inconsistent enforcement; COCOO challenge against the oversight authority for failure to initiate/publicize internal accountability procedures for the regulator’s ultra vires conduct causing ongoing compensated harm.

– In the UK (judicial review, promptly and within 3 months but extendable for continuing duty failures/effects): CMA/Ofcom ongoing omissions in assessing/investigating state influence risks in Virgin Media O2.

– At EU level (Article 265 TFEU action for failure to act against European Commission DG COMP): viable for ongoing omission in not investigating the alleged illegal state aid, as no investigation has been opened and harm persists; requires prior formal call to act (2 months for response), then challenge inaction within further 2 months.

These rolling challenges target persistent regulatory failures enabling continuing tort harm to victims (competitors, consumers in Spain/UK telecoms/media markets), supporting compensation claims through established liabilities.

---

Proposals to prevent and remedy the tort harms from the identified ultra vires DORCAPS focus on facilitating **vicarious State liability** for compensation to victims (competitors like Orange España, MasOrange, Digi Spain, Vodafone UK, MVNOs, media entities like Atresmedia, Mediaset España, DAZN; and consumers facing higher prices/reduced choice in Spain and UK telecoms/media markets), while offering regulators/public bodies (CNMC, Spanish Government/SEPI, European Commission DG COMP, CMA, Ofcom) an incentive to accept through avoidance of personal contributory liability for bad faith non-disclosure of ultra vires risks, abuse of power, and reckless conduct enabling ongoing distortions.

These proposals allow win-win outcomes: victims receive redress (compensation, commitments, injunctions, settlements, positive spillovers like improved competition/pluralism, grant/contract awards); the State bears vicarious liability; regulators/public bodies escape personal fiduciary hooks by cooperating transparently and redressing harms they enabled/covered up.

Customised remedies, undertakings, commitments, fines, injunctions, suspended quashing orders, and cy-pres proposals for COCOO to propose in this case:

– To the Spanish Government/SEPI: Undertakings to place the 10% Telefónica stake (held since 2024, ongoing as of December 2025) into a blind trust with independent governance free of state influence, or partial divestment to neutral investors; commitments to fund a €500 million compensation fund (vicarious State liability) for harmed competitors/consumers, distributed via claims process or cy-pres to consumer organisations/charities promoting digital access/pluralism; no fine on individuals, but suspended quashing order on the investment decision contingent on non-compliance; injunction against further state interference distorting governance; positive spillovers including priority contract awards to victim companies (e.g., smaller operators/MVNOs) in public telecoms tenders, and grant awards for infrastructure to redress margin squeezes.

– To CNMC: Commitments to immediately launch ex officio investigations/enforce 2010/2015 merger remedies consistently (addressing ongoing selective omissions post-2025 fines on Telefónica for breaches); undertakings to publish all ultra vires risks in enforcement policies and establish transparent internal accountability procedures; propose reduced or no additional fines on CNMC officials in exchange for cooperation; cy-pres distribution of any recovered amounts (e.g., from past inconsistencies) to victim support funds; injunction requiring non-discriminatory access/wholesale pricing oversight; suspended quashing of past omission-based decisions if commitments met, benefiting investigated companies like Telefónica (relief from distorted enforcement) and their victims.

– To European Commission DG COMP: Formal call to act under Article 265 TFEU, proposing undertakings to open state aid investigation into SEPI investment; commitments to guideline reforms assessing state influence in telecoms; cy-pres awards from any recovery to EU-wide consumer competition funds; no personal fines, but incentive via avoidance of contributory liability claims.

– To CMA/Ofcom: Commitments to assess/investigate foreign state influence risks in Virgin Media O2 governance; undertakings to framework for critical infrastructure protection; injunctions for enhanced competition monitoring; cy-pres proposals for consumer redress funds from any findings.

These target ongoing harms (distortions persisting in 2025 despite CNMC actions on remedies), enabling settlements where the State compensates victims directly, regulators gain protection from personal liability by accepting/transparently implementing, and all parties benefit from restored competition/media pluralism.

---

No open or closed claims, settlements, or arbitrations have been identified where the **Spanish State** (or UK authorities) paid compensation or penalties directly related to the ultra vires DORCAPS in this Telefónica case, including the SEPI 10% stake (alleged illegal state aid since 2023-2024), CNMC omissions on merger remedies enforcement, European Commission inaction on state aid complaints, or CMA/Ofcom failures to assess foreign state influence in Virgin Media O2.

No formal European Commission state aid investigation (no SA. case number) exists for the SEPI investment, and no recovery orders, penalties, or compensation payments by the State arise from regulator/public body tort liabilities here.

Companies have faced penalties from regulators, directly tied to the ongoing distortions from the 2015 Telefónica/DTS merger remedies:

– Telefónica paid or faces multiple CNMC fines for remedy breaches:
– €6 million (2023) for permanencia obligations in Movistar Fusión offers.
– €5 million (2023) for further breaches including DAZN-related clauses.
– €20 million (2025) for extending permanencia to devices (2021-2023).
– Earlier fines include €5 million (2022) for information obligations and others from 2019 onward.
– An expediente opened in November 2024 for additional possible breaches.

– Virgin Media O2 (UK joint venture) fined £23.8 million by Ofcom (2025) for failures in digital landline migrations affecting vulnerable customers (unrelated to state influence).

These company penalties (paid to regulators/treasury, not victims) highlight harms to competitors/consumers from persistent distortions, supporting vicarious State liability arguments for compensation to tort victims, as no direct redress occurred yet.

---

The probability that COCOO.uk would be granted **locus standi** to initiate a judicial review (or contencioso-administrativo equivalent) challenging the ongoing failure to initiate an **acción de regreso** (despite prior notification letter resulting in negative administrative silence) is approximately **60-75%** in Spain and **70-85%** in the UK, based on liberal standing trends for public interest charities in competition/consumer protection matters where no directly harmed individual claimant predominates, and the challenge targets a continuing omission affecting public accountability and victim compensation.

In Spain (contencioso-administrativo under Ley 29/1998), associations/ONGs with relevant objects (like consumer/competition advocacy) often secure standing for collective/public interests, especially against administrative silence (silencio negativo), which fictionally enables recourse while harm persists; courts assess legitimacy of the entity’s interest, favoring admission where broader rule of law/transparency issues arise, as in ongoing regulatory accountability failures.

In the UK (sufficient interest under Senior Courts Act 1981 s.31), charities like COCOO frequently obtain standing in public interest judicial reviews of ongoing omissions if genuine, expert, and no better-placed claimant exists (e.g., Greenpeace/World Development Movement cases); the sender’s role in prompting silence strengthens interest, with courts prioritizing vindication of law over strict personal harm.

Negative administrative silence from ignoring the duty-notification letter constitutes a challengeable decision (ongoing non-action), supporting rolling review viability.

To build locus standi further, COCOO can send targeted pre-action letters (PAP in UK; requerimiento previo or solicitud formal in Spain) to force explicit decisions:

– Request confirmation of risk assessments/publication of ultra vires risks in DORCAPS (e.g., CNMC omissions, SEPI influence), framing as transparency duty; response (or further silence) creates fresh/reviewable decision.

– Demand initiation of internal ex officio procedures for acción de regreso accountability.

– Seek pre-action disclosure of metadata (e.g., internal audit titles on oversight failures) to evidence bad faith non-disclosure.

This approach is viable: PAP letters prompt reconsideration/decisions, enabling JR of new grounds (time resets); in Spain, formal petitions trigger silence reviewable indefinitely while effects continue.

Using JR as public notification mechanism aligns with arguments on fiduciary breach for non-publication of risks/harms, as proceedings highlight foreseeable tort liabilities, aiding prevention and victim awareness/compensation claims via vicarious State liability.

---

The identified DORCAPS and their ultra vires probabilities are as follows:

Spanish Government/SEPI €2.3 billion investment for 10% stake in Telefónica (2023-2024): 65% probability of being ultra vires as illegal state aid under Article 107 TFEU, due to political motivations overriding the market economy investor principle, lack of prior notification to European Commission, and potential governance distortions in a regulated sector, despite no formal investigation opened yet and ongoing effects in 2025.

CNMC omissions in enforcing 2010/2015 merger remedies and refusing investigations despite evidence: 75% probability of ultra vires, given inconsistent and selective enforcement (pursuing some breaches but not others), arbitrary conduct violating rationality and equality principles under Spanish administrative law, and failure to act ex officio on ongoing competition distortions.

European Commission DG COMP omission in not investigating alleged illegal state aid: 55% probability of ultra vires failure to act under Article 265 TFEU, as complaints exist without formal probe, but threshold for serious breach is high and discretion in enforcement priorities applies.

CMA/Ofcom omissions in assessing/investigating foreign state influence risks in Virgin Media O2 post-SEPI stake: 70% probability of ultra vires breach of statutory duties to protect critical infrastructure and competition from governance risks, given persistent foreign state involvement since 2024 without framework or action.

For the high-probability DORCAPS (all above 55%), no public notices, reports, or URLs from the relevant bodies disclose ultra vires risks, illegal state aid probabilities, or mandatory assessments of such foreseeability harms: no SEPI or Spanish Government risk registers publish investment illegality risks; CNMC annual reports or transparency portals lack entries on enforcement omission risks; CMA/Ofcom corporate risk registers (published annually) contain no references to state influence in telecoms; DG COMP state aid register shows no case on SEPI-Telefónica. This non-disclosure increases tort claim risks against the State via vicarious liability for harms to competitors/consumers, as victims lack constructive notice to mitigate damages.

The probability of successfully arguing contributory liability solely on the regulator/public body (excluding State vicarious liability, limiting victim compensation to personal claims against officials) is 15-25% in Spain/UK/EU law: State bears primary strict/objective responsibility for agent torts (misfeasance, reckless non-disclosure); acción de regreso allows State recovery internally but rarely pursued, with personal liability requiring proven dolo/mala fe, and non-disclosure alone insufficient to shift full burden from State.

---

 

 

---

fois

### FOI Requests to Spanish Bodies (under Ley 19/2013 de Transparencia)

For Spanish public bodies (CNMC, SEPI, Spanish Government/Ministerio de Economía), requests are submitted via the **Portal de Transparencia** (transparencia.gob.es) or specific portals. Use your details: Oscar Moya LLedo, DNI: 11820221S, Dirección: Paseo de la chopera, 9, Madrid 28045, Email: contact@cocoo.uk.

#### Request to CNMC (Strategic Knowledge Probe on enforcement omissions and state influence risks)

Oscar Moya LLedo
DNI: 11820221S
Dirección: Paseo de la chopera, 9, Madrid 28045
Email: contact@cocoo.uk

Fecha: 16 December 2025

Solicitud de acceso a la información pública conforme a la Ley 19/2013

Estimados señores,

Solicito la siguiente información relativa a entradas en el registro de riesgos estratégicos o corporativos de la CNMC relacionadas con riesgos de omisiones en la aplicación de remedios de concentraciones (como los de 2010 y 2015 en telecomunicaciones y audiovisual), inconsistencias en la aplicación de la normativa de competencia, o influencia estatal en operadores regulados (post-inversión SEPI en Telefónica desde 2024):

1. Títulos, descripciones breves y responsables (risk owners) de las entradas relevantes en el registro de riesgos.
2. Evolución de las puntuaciones de riesgo (inherente vs residual) en los últimos 24 meses.
3. Declaración de apetito de riesgo respecto al cumplimiento legal y racionalidad en decisiones regulatorias.

Además, solicito información sobre si se ha iniciado alguna acción de regreso contra responsables de posibles DORCAP ultravires que hayan causado daños compensados por el Estado, y si no, las razones.

Atentamente,
Oscar Moya LLedo

#### Request to SEPI (Operational Failure Probe on state investment risks)

Oscar Moya LLedo
DNI: 11820221S
Dirección: Paseo de la chopera, 9, Madrid 28045
Email: contact@cocoo.uk

Fecha: 16 December 2025

Solicitud de acceso a la información pública conforme a la Ley 19/2013

Estimados señores,

Solicito información relativa a evaluaciones de impacto o riesgos operacionales asociados a la inversión del 10% en Telefónica (decisión 2023-2024):

1. Fechas de creación y finalización de cualquier evaluación de impacto, y cargo del aprobador.
2. Número de meses en que el proyecto/inversión ha sido reportado como “rojo” o de alto riesgo al consejo o board.

Además, información sobre acciones de regreso iniciadas por posibles daños derivados de la inversión, y si no, razones.

Atentamente,
Oscar Moya LLedo

#### Request to Spanish Government/Ministerio de Economía (Systemic Flaw Probe on oversight)

Oscar Moya LLedo
DNI: 11820221S
Dirección: Paseo de la chopera, 9, Madrid 28045
Email: contact@cocoo.uk

Fecha: 16 December 2025

Solicitud de acceso a la información pública conforme a la Ley 19/2013

Estimados señores,

Solicito lista de títulos de informes de auditoría interna encargados en los últimos 2 años relacionados con supervisión de reguladores (CNMC) o inversiones públicas estatales en sectores regulados (como telecomunicaciones post-SEPI en Telefónica).

Además, porcentaje de personal formado en políticas de evaluación de riesgos ultravires o ayudas estatales ilegales, y detalles sobre procedimientos internos ex officio para perseguir responsabilidades regulatorias causantes de daños compensados por el Estado (acciones de regreso), incluyendo si se han iniciado y razones si no.

Atentamente,
Oscar Moya LLedo

### FOI Requests to UK Bodies (under Freedom of Information Act 2000)

For UK bodies (CMA, Ofcom), send by email. Use your details: oscar moya, Director of Competition & Consumer Organisation Party Limited (COCOO.uk), 23 Village Way, Beckenham, Kent BR3 3NA, Companies House Registration: 15466919, EU Transparency Register: 177568392007-84, Email: contact@cocoo.uk.

#### Request to CMA (Strategic Knowledge Probe on foreign state influence risks)

oscar moya
Director of Competition & Consumer Organisation Party Limited (COCOO.uk)
23 Village Way, Beckenham, Kent BR3 3NA
Email: contact@cocoo.uk

Date: 16 December 2025

Freedom of Information Act 2000 Request

Dear Information Access Team,

I request the following information relating to entries in the CMA corporate risk register concerning risks from foreign state influence on critical infrastructure or competition (e.g., post-SEPI 10% stake in Telefónica affecting Virgin Media O2 since 2024):

1. Titles, brief descriptions, and risk owners of relevant entries.
2. Movement of risk scores (inherent vs residual) over the last 24 months.
3. Risk appetite statement regarding legal compliance and assessment of state-influenced governance distortions.

Yours sincerely,
oscar moya

#### Request to Ofcom (Operational Failure Probe on infrastructure risks)

oscar moya
Director of Competition & Consumer Organisation Party Limited (COCOO.uk)
23 Village Way, Beckenham, Kent BR3 3NA
Email: contact@cocoo.uk

Date: 16 December 2025

Freedom of Information Act 2000 Request

Dear information.requests@ofcom.org.uk,

I request information relating to impact assessments or operational risks associated with foreign state influence in UK telecoms infrastructure (post-2024 SEPI investment in Telefónica/Virgin Media O2):

1. Dates of creation and finalisation of any relevant impact assessment, and job title of approver.
2. Number of months the issue has been reported as “red” or high risk to the Board.

Yours sincerely,
oscar moya

### Request to European Commission DG COMP (under Regulation 1049/2001)

Submit via EU portal or email to DG COMP access to documents.

Oscar Moya
Director of Competition & Consumer Organisation Party Limited (COCOO.uk)
Email: contact@cocoo.uk

Date: 16 December 2025

Application for access to documents under Regulation (EC) No 1049/2001

Dear DG Competition,

I request access to metadata from risk registers or assessments relating to risks of non-investigation of potential illegal state aid (SEPI 10% stake in Telefónica, 2023-2024) or state influence distortions in telecoms competition: titles/descriptions of entries, risk score movements over 24 months, and risk appetite for compliance with Article 107 TFEU.

Also, list of internal audit report titles in last 2 years on state aid enforcement omissions.

Yours sincerely,
Oscar Moya

These requests focus on metadata (existence, scores, dates, titles) to prove awareness of ultra vires risks/omissions without triggering privileges, evidencing misfeasance/reckless conduct if risks were high but unaddressed, and failure to pursue internal accountability (no regreso actions), supporting vicarious State liability for ongoing harms to competitors/consumers.