EUROPEAN COMMISSION
Brussels, 26.01.2021
C(2021) 542 final
Mr Alexander Fanta
netzpolitik.org
Rue de la Loi 155
1040 Bruxelles
DECISION OF THE EUROPEAN COMMISSION PURSUANT TO ARTICLE 4 OF THE
IMPLEMENTING RULES TO REGULATION (EC) NO 1049/20011
Subject:
Your confirmatory application for access to documents under
Regulation (EC) No 1049/2001 - GESTDEM 2020/6032
Dear Mr Fanta,
I refer to your letter of 24 November 2020, registered on the same day, in which you
submitted a confirmatory application in accordance with Article 7(2) of Regulation (EC)
No 1049/2001 regarding public access to European Parliament, Council and Commission
documents2 (hereafter ‘Regulation (EC) No 1049/2001’).
1.
SCOPE OF YOUR REQUEST
In your initial application of 9 October 2020, addressed to the Directorate-General for
Economic and Financial Affairs, you requested access to ‘[a]ll documents related to the
video call between Commission Vice-President Valdis Dombrovskis and Huawei on July
23rd, 2020’.
The European Commission has identified the following documents as falling under the
scope of your request, registered in file EVP4/2020/1353, briefing from the Secretariat-
General to Cabinet of Executive Vice-President Dombrovskis, 17 July 2020, reference
Ares(2020)4066319:
Table of contents of the briefing file (hereafter ‘document 1’);
The steering brief (hereafter ‘document 2’);
1
OJ L 345, 29.12.2001, p. 94.
2
OJ L 145, 31.5.2001, p. 43.
3
Please note that what was referenced in the initial reply as ‘document 1’ is a reference to the briefing
file and not an actual document.
Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIË - Tel. +32 22991111
The economic impact of Huawei in Europe (hereafter ‘document 3’);
Digital finance (hereafter ‘document 4’);
CVs (hereafter ‘document 5’);
In its initial reply of 23 November 2020, Directorate A of the Secretariat-General
partially refused access to these documents based on the exceptions of Article 4(1)(b)
(protection of the privacy and integrity of the individual) and the second paragraph of
Article 4(3) (protection of the decision-making process) of Regulation (EC) No
1049/2001.
In your confirmatory application, you request a review of this position. In particular, you
contest the full identification of documents, the apparent refusal of one document, but
also the insufficient reasoning accompanying the application of the exception in
Article 4(3) of Regulation (EC) No 1049/2001. You underpin your request with detailed
arguments, which I will address, to the extent needed, in the corresponding sections
below.
2.
ASSESSMENT AND CONCLUSIONS UNDER REGULATION (EC) NO 1049/2001
When assessing a confirmatory application for access to documents submitted pursuant
to Regulation (EC) No 1049/2001, the Secretariat-General conducts a fresh review of the
reply given by the Directorate-General concerned at the initial stage.
In your confirmatory application, you first note that, what was identified in the initial
reply as ‘document 1’ was refused without any argumentation. Please note that this
reference is to the entire briefing file and not to a specific document. The documents
contained in the file are listed above as documents 1-5.
Second, you note that no minutes were identified for this meeting or any other emails or
communication in preparation to the meeting.
Against this background, the European Commission has carried out a renewed, thorough
search for the documents requested and the following document has been identified at
confirmatory stage as falling within the scope of your request:
- Email exchange between Huawei and the Cabinet of Vice-President
Dombrovskis, Ares(2020)2316482 (hereafter ‘document 6’).
Following this review, I can inform you that:
- further partial access is granted to documents 3 and 4, and
- wide partial access is granted to document 6, subject to redactions based on
Article 4(1)(b) (protection of the privacy and integrity of the individual) of
Regulation (EC) No 1049/2001.
As regards the redacted parts of documents 1-5, I regret to inform you that I have to
refuse access, based on the exceptions of the first indent of Article 4(1)(a) (protection of
the public interest as regards public security), the third indent of Article 4(1)(a)
2
(protection of the public interest as regards international relations), Article 4(1)(b)
(protection of the privacy and integrity of the individual), the first indent of Article 4(2)
(protection of commercial interests of a natural or legal person) and Article 4(3)
(protection of the decision-making process) of Regulation (EC) No 1049/2001, for the
reasons set out below.
2.1. Protection of the public interest as regards public security
The first indent of Article 4(1)(a) of Regulation (EC) No 1049/2001 provides that ‘[t]he
institutions shall refuse access to a document where disclosure would undermine the
protection of the public interest as regards public security’.
The Court of Justice has confirmed that it ‘is clear from the wording of Article 4(1)(a) of
Regulation No 1049/2001 that, as regards the exceptions to the right of access provided
for by that provision, refusal of access by the institution is mandatory where disclosure of
a document to the public would undermine the interests which that provision protects,
without the need, in such a case and in contrast to the provisions, in particular, of Article
4(2), to balance the requirements connected to the protection of those interests against
those which stem from other interests4’.
The General Court has acknowledged that ‘the institutions enjoy a wide discretion when
considering whether access to a document may undermine the public interest and,
consequently, […] the Courts review of the legality of the institutions’ decisions refusing
access to documents on the basis of the mandatory exceptions relating to the public
interest must be limited to verifying whether the procedural rules and the duty to state
reasons have been complied with, the facts have been accurately stated, and whether
there has been a manifest error of assessment of the facts or a misuse of powers’5.
Moreover, the General Court recently ruled that, as regards the interests protected by
Article 4(1)(a) of Regulation (EC) No 1049/2001, ‘it must be accepted that the
particularly sensitive and fundamental nature of those interests, combined with the fact
that access must, under that provision, be refused by the institution if disclosure of a
document to the public would undermine those interests, confers on the decision which
must thus be adopted by the institution a complexity and delicacy that call for the
exercise of particular care. Such a decision requires, therefore, a margin of
appreciation’6.
The Commission has recognised 5G deployment of network technologies as a major
enabler for future digital services and a priority for the Digital Single Market strategy,
with many critical services becoming dependant on 5G networks. Consequently, ensuring
the cybersecurity of the 5G networks is an issue of strategic importance for the European
4
Judgement of the Court of Justice of 1 February 2007,
Sison v
Council, C-266/05 P, EU:C:2007:75
paragraph 46.
5
Judgment of the General Court of 25 April 2007,
WWF European Policy Programme v
Council,
T-264/04, EU:T:2007:114, paragraph 40.
6
Judgment of the General Court of 11 July 2018,
Client Earth v European Commission, T-644/16,
EU:T:2018:429, paragraph 23.
3
Union and its Member States, at a time when cyber-attacks are increasing in frequency
and sophistication.
The redacted passage on page 6 of document 3 contains an assessment about the sensitive
systems in certain sectors. Disclosure of this passage would put in the public domain an
evaluation of what certain Commission officials view as critical systems and would
enable third parties to use this information to exploit security weaknesses in these
systems. This could have negative consequences for the security of present and future
networks and digital infrastructures and lead to potential security risks for the society as a
whole.
Based on the foregoing, there is a real and non-hypothetical risk that disclosure of the
relevant redacted passage of document 3 would undermine the protection of public
interest as regards public security, as provided for in the first indent of Article 4(1)(a) of
Regulation (EC) No 1049/2001.
2.2. Protection of the public interest as regards international relations
The third indent of Article 4(1)(a) of Regulation (EC) No 1049/2001 provides that ʻ[t]he
institutions shall refuse access to a document where disclosure would undermine the
protection of […] the public interest as regards […] international relations […]ʼ.
As far as the protection of international relations is concerned, the General Court has
acknowledged that ‘the institutions enjoy a wide discretion when considering whether
access to a document may undermine the public interest and, consequently, […] the
Court’s review of the legality of the institutions’ decisions refusing access to documents
on the basis of the mandatory exceptions relating to the public interest must be limited to
verifying whether the procedural rules and the duty to state reasons have been complied
with, the facts have been accurately stated, and whether there has been a manifest error of
assessment of the facts or a misuse of powers’7.
The redacted paragraphs on pages 1 and 4 of document 3 contain statements presenting
the position of Commission staff members regarding European or foreign policy
initiatives concerning Huawei and China, and possible positions of European ICT
companies in relation with Huawei and China whose disclosure would have a direct
impact on the EU-China relations.
Similarly, the redaction of the part of the first bullet point the in the defensives of
document 4 concerns an evaluation made by Commission staff members of ICT third
parties. Its disclosure can be detrimental to the EU-China relations.
Please note that, given the limited volume of the relevant redacted parts, it is not possible
to give more detailed reasons justifying the need for confidentiality without disclosing
the opinion of the staff members and, thereby, depriving the exception of its very
purpose.
7
Judgment of the General Court of 25 April 2007,
WWF European Policy Programme v
Council of the
EU, T-264/04, EU:T:2007:114, paragraph 40.
4
In light of the above, I must conclude that the use of the exception under the third indent
of Article 4(1)(a) (protection of the public interest as regards international relations) of
Regulation (EC) No 1049/2001 is justified, and that the relevant undisclosed passages of
documents 3 and 4 must be refused on that basis.
2.3. Protection of privacy and the integrity of the individual
Article 4(1)(b) of Regulation (EC) No 1049/2001 provides that ‘[t]he institutions shall
refuse access to a document where disclosure would undermine the protection of […]
privacy and the integrity of the individual, in particular in accordance with Community
legislation regarding the protection of personal data’.
In its judgment in Case C-28/08 P (
Bavarian Lager)8, the Court of Justice ruled that
when a request is made for access to documents containing personal data, Regulation
(EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000
on the protection of individuals with regard to the processing of personal data by the
Community institutions and bodies and on the free movement of such data9
(hereafter ‘Regulation (EC) No 45/2001’) becomes fully applicable.
Please note that, as from 11 December 2018, Regulation (EC) No 45/2001 has been
repealed by Regulation (EU) 2018/1725 of the European Parliament and of the Council
of 23 October 2018 on the protection of natural persons with regard to the processing of
personal data by the Union institutions, bodies, offices and agencies and on the free
movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No
1247/2002/EC10 (hereafter ‘Regulation (EU) 2018/1725’).
However, the case law issued with regard to Regulation (EC) No 45/2001 remains
relevant for the interpretation of Regulation (EU) 2018/1725.
In the above-mentioned judgment, the Court stated that Article 4(1)(b) of Regulation
(EC) No 1049/2001 ‘requires that any undermining of privacy and the integrity of the
individual must always be examined and assessed in conformity with the legislation of
the Union concerning the protection of personal data, and in particular with […] [the
Data Protection] Regulation’11.
Article 3(1) of Regulation (EU) 2018/1725 provides that
personal data ‘means any
information relating to an identified or identifiable natural person […]’.
8
Judgment of the Court of Justice of 29 June 2010,
European Commission v
The Bavarian Lager Co.
Ltd (hereafter referred to as
‘European Commission v
The Bavarian Lager judgment’) C-28/08 P,
EU:C:2010:378, paragraph 59.
9
OJ L 8, 12.1.2001, p. 1.
10 OJ L 295, 21.11.2018, p. 39.
11
European Commission v The Bavarian Lager judgment,
cited
above, paragraph 59.
5
As the Court of Justice confirmed in Case C-465/00 (
Rechnungshof), ‘there is no reason
of principle to justify excluding activities of a professional […] nature from the notion of
private life’12.
Documents 1-6 contain personal data such as the names and initials of persons who do
not form part of the senior management of the European Commission. Moreover, it
contains the names and functions of staff of Huawei.
The names13 of the persons concerned, as well as other data from which their identity can
be deduced, undoubtedly constitute personal data in the meaning of Article 3(1) of
Regulation (EU) 2018/1725.
Pursuant to Article 9(1)(b) of Regulation (EU) 2018/1725, ‘personal data shall only be
transmitted to recipients established in the Union other than Union institutions and bodies
if ‘[t]he recipient establishes that it is necessary to have the data transmitted for a specific
purpose in the public interest and the controller, where there is any reason to assume that
the data subject’s legitimate interests might be prejudiced, establishes that it is
proportionate to transmit the personal data for that specific purpose after having
demonstrably weighed the various competing interests’.
Only if these conditions are fulfilled and the processing constitutes lawful processing in
accordance with the requirements of Article 5 of Regulation (EU) 2018/1725, can the
transmission of personal data occur.
In Case C-615/13 P
(
ClientEarth), the Court of Justice ruled that the institution does not
have to examine by itself the existence of a need for transferring personal data14. This is
also clear from Article 9(1)(b) of Regulation (EU) 2018/1725, which requires that the
necessity to have the personal data transmitted must be established by the recipient.
According to Article 9(1)(b) of Regulation (EU) 2018/1725, the European Commission
has to examine the further conditions for the lawful processing of personal data only if
the first condition is fulfilled, namely if the recipient establishes that it is necessary to
have the data transmitted for a specific purpose in the public interest. It is only in this
case that the European Commission has to examine whether there is a reason to assume
that the data subject’s legitimate interests might be prejudiced and, in the affirmative,
establish the proportionality of the transmission of the personal data for that specific
purpose after having demonstrably weighed the various competing interests.
In your confirmatory application, you do not put forward any arguments to establish the
necessity to have the data transmitted for a specific purpose in the public interest.
Therefore, the European Commission does not have to examine whether there is a reason
to assume that the data subjects’ legitimate interests might be prejudiced.
12 Judgment of
the Court of Justice of 20 May 2003,
Rechnungshof and Others v
Österreichischer
Rundfunk, Joined Cases C-465/00, C-138/01 and C-139/01, EU:C:2003:294, paragraph 73.
13.
European Commission v
The Bavarian Lager judgment, cited above, paragraph 68.
14 Judgment of the Court of Justice of 16 July 2015,
ClientEarth v
European Food Safety Agency,
C-615/13 P, EU:C:2015:489, paragraph 47.
6
Notwithstanding the above, there are reasons to assume that the legitimate interests of the
data subjects concerned would be prejudiced by the disclosure of the personal data
reflected in the documents, as there is a real and non-hypothetical risk that such public
disclosure would harm their privacy and subject them to unsolicited external contacts.
Consequently, I conclude that, pursuant to Article 4(1)(b) of Regulation (EC) No
1049/2001, access cannot be granted to the personal data, as the need to obtain access
thereto for a purpose in the public interest has not been substantiated and there is no
reason to think that the legitimate interests of the individuals concerned would not be
prejudiced by the disclosure of the personal data concerned.
2.4. Protection of commercial interests of a natural or legal person
The first indent of Article 4(2) of Regulation (EC) No 1049/2001 provides that ‘[t]he
institutions shall refuse access to a document where disclosure would undermine the
protection of commercial interests of a natural or legal person, including intellectual
property, […] unless there is an overriding public interest in disclosure’.
The second undisclosed sentence on page 1 of document 2 and two redactions on pages 5
and 6 of document 3 contain certain value judgments of Commission staff members
regarding the Oxford Economics study commissioned by Huawei. The third undisclosed
sentence on page 1 of document 2 refers to a possible new initiative prepared by Huawei,
which has not yet been made public by the company. The undisclosed paragraph on page
7 of document 3 refers to the names and market split of vendors on the European market
and the evolution of the European market.
Indeed, the General Court confirmed on several occasions that the protection of a
commercial undertaking’s reputation can require the (partial) refusal of documents based
on the first indent of Article 4(2) of Regulation 1049/200115.
There is reasonably foreseeable risk that public disclosure of this information could be
misinterpreted and in consequence instrumentally used against the reputation of the
company. That in turn, would have a negative impact on its market position and would
clearly undermine its commercial interests. Furthermore, disclosing the names and
information regarding the market split of vendors and the evolution of the market would
undermine their commercial interests by revealing their commercial strategies.
I conclude, therefore, that access to the relevant undisclosed sentences of documents 2
and 3 must be denied on the basis of the exception laid down in the first indent of Article
4(2) of Regulation (EC) No 1049/2001.
15 Judgments of the General Court of 15 January 2013, Case T-392/07,
Strack v Commission,
EU:T:2013:8, paragraph 228 and of 26 April 2016, Case T-221/08,
Strack v Commission,
EU:T:2016:242, paragraph 210.
7
2.5. Protection of the decision-making process
The first subparagraph of Article 4(3) of Regulation (EC) No 1049/2001 provides that
‘[a]ccess to a document, drawn up by an institution for internal use or received by an
institution, which relates to a matter where the decision has not been taken by the
institution, shall be refused if disclosure of the document would seriously undermine the
institution's decision-making process, unless there is an overriding public interest in
disclosure’.
Pursuant to settled case-law, the above-mentioned exception may be applied where
disclosure of preparatory documents containing a critical assessment by Commission
staff members would result in a serious, non-hypothetical and objectively justified risk of
self-censorship16.
It is to be noted that the decision-making exception in Article 4(3) of Regulation (EC) No
1049/2001 does not refer only to decisions having legal effect. The wording in Article
4(3) of Regulation (EC) No 1049/2001 includes neither a definition of the
decision-making process,
nor any indication that would enable to establish the legislator's
intention to limit the scope of the decision-making process protected by that exception
only to the legislative process.
Indeed, the decision-making process has to be interpreted
in a broad sense, encompassing also processes relating to administrative and other
functions of the Institutions. The European Ombudsman has agreed that the exception
can also apply to non-legislative documents17 and established case law of the EU courts
confirms the possibility to apply Article 4(3) both to legislative and to administrative
procedures18.
Documents 2-4 were clearly drawn-up for internal use. They are part of an internal
steering brief prepared by the staff of the Secretariat-General in cooperation with other
services for Executive Vice-President Dombrovskis in preparation for his meeting with
Huawei. They are meant to provide Vice-President Dombrovskis with individual
opinions and suggestions on the line to take with the purpose of preparing him for the
meeting. Internal opinions of Commission services on similar subjects may diverge in
view of the various policies they are pursuing. Consequently, the opinions of the
services, expressed in internal briefings, reflect the perspective of Commission staff
members and their individual observations on policy suggestions.
A part of the first redaction on page 1 of document 3 refers to possible initiative in the
area of mobile communication equipment, which the Commission is considering in order
to address the security challenges. The last two redactions on page 2 of document 4 refer
to a possible initiative aimed at regulating third party service providers.
16 Judgment of the General Court of 18 December 2008,
Muñiz v European European Commission,
T-144/05, EU:T:2008:596, paragraphs 89 and 90. See also Order of the General Court of 10 January
2013,
My Travel v European Commission, T-403/05, EU:T:2008:316, paragraph 52.
17 Please see the Decision in case 70/2008/TS, paragraph 18 available
at https://europa.eu/!FV64Hj. 18
Judgment of the Court of Justice of 29 June 2010,
Commission v Technische Glaswerke Ilmenau,
C-139/07, EU:C:2010:376, paragraph 60.
8
It is important that the Commission can present, explain and defend its initiatives without
having to disclose internal views expressed from a particular perspective by individual
staff members. Indeed, Commission services working on cybersecurity and digital
finance are experiencing pressure from non-governmental organisations, the industry and
other stakeholders lobbying for or against the Commission proposal. The interest these
areas spark and the views of these actors can be partly seen in the results of the public
consultation on the new Digital Finance Strategy and on Cybersecurity.
Disclosing these specific parts of the briefing aiming to present the personal perspective
of the authors to Vice-President Dombrovskis would create unjustified expectations of
the public and interested parties. In turn, this would risk increasing undue pressure on the
Commission, thereby seriously undermining its current and future decision-making
process and its margin of manoeuvre.
Releasing these internal opinions is likely to bring a serious harm to the decision-making
process concerned, as it would deter staff members of the European Commission from
putting forward their views on this and other related matters in an open and independent
way and without being unduly influenced by the prospect of disclosure.
Indeed, as the General Court has held, ‘the possibility of expressing views independently
within an institution helps to encourage internal discussions with a view to improving the
functioning of that institution and contributing to the smooth running of the decision-
making process’.
Therefore, public release of the relevant withheld parts of documents 3 and 4 is likely to
bring a serious harm to the decision-making process by severely affecting the ability of
the European Commission to hold frank internal discussions on issues related to the
interaction with private stakeholders. Given the likelihood of the internal debate being
severely impoverished by the disclosure of the internal opinions, I consider that this risk
is reasonably foreseeable and non-hypothetical.
In light of the above, the relevant undisclosed parts of documents 3 and 4 should be
protected in accordance with the first subparagraph of Article 4(3) of Regulation (EC) No
1049/2001.
3.
OVERRIDING PUBLIC INTEREST IN DISCLOSURE
The exceptions laid down in Article 4(2) and (3) of Regulation (EC) No 1049/2001 must
be waived if there is an overriding public interest in disclosure. Such an interest must,
firstly, be public and, secondly, outweigh the harm caused by disclosure.
In your confirmatory application, you do not put forward any reasoning pointing to an
overriding public interest in disclosing the documents requested.
Nor have I been able to identify any public interest capable of overriding the public and
private interests protected by Article 4(2) and (3) of Regulation (EC) No 1049/2001.
9
The fact that the documents relate to an administrative procedure and not to any
legislative act, for which the Court of Justice has acknowledged the existence of wider
openness19, provides further support to this conclusion.
Please note also that Article 4(1)(a) and 4(1)(b) of Regulation (EC) No 1049/2001 do not
include the possibility for the exceptions defined therein to be set aside by an overriding
public interest.
4.
PARTIAL ACCESS
In accordance with Article 4(6) of Regulation (EC) No 1049/2001, I have considered the
possibility of granting (further) partial access to the documents requested.
As explained above, further partial access is granted to document 4, and wide partial
access is granted to document 6.
5.
MEANS OF REDRESS
Finally, I draw your attention to the means of redress available against this decision. You
may either bring proceedings before the General Court or file a complaint with the
European Ombudsman under the conditions specified respectively in Articles 263 and
228 of the Treaty on the Functioning of the European Union.
Yours sincerely,
For the Commission
Ilze JUHANSONE
Secretary-General
Enclosures: (3)
19 Judgment of the Court of Justice of 29 June 2010,
Commission v
Technische Glaswerke Ilmenau
Gmbh, C-139/07 P, EU:C:2010:376, paragraphs 53-55 and 60;
Commission v
Bavarian Lager
judgment, cited above, paragraphs 56-57 and 63.
10
Document Outline