Ref. Ares(2016)4162935 - 05/08/2016
Fiche 9 Third-parties' personal data (names, signatures, contact details, ...)
Documents fully or partially released under Regulation 1049/2001 may contain the personal data
of outside entities'2 staff
and/or of other individuals external to the Commission.
As regards names, the possible disclosure depends on the degree of seniority of the individual concerned.
As regards signatures and other personal data, access is in principle denied unless specific conditions are fulfilled.
Current administrative practice:
The name of the main representative
3 of an external entity is normally disclosed
(unless the person concerned
explicitly objects to such disclosure; and/or there are other reasons to think that the legitimate rights of that
person would be prejudiced).
Names of outside individuals other than the above
are normally withheld
, unless the following two
(cumulative, successive) conditions are fulfilled:
o the applicant substantiates a need (demonstrated by express and legitimate justifications or
convincing arguments4) to obtain access to these names; and
o there is no reason to think that the transfer would prejudice the legitimate rights of the individuals
concerned(for instance, if the data subject has unambiguously given his/her consent)5.
If these conditions are not fulfilled, services should redact the respective names with reference to Article 4(1)(b) of
Regulation 1049/2001.6 The same applies to functions
to the extent that these enable the individuals to be
, being biometric data, are withheld following a similarly restrictive approach regardless
of the person's level of seniority
. This is justified by the specific risks (forgery, identity theft) involved.
The same applies to contact details
(address, telephone number,…) and other personal data
as defined in Article
2(a) of Regulation 45/2001. 7
1 As regards the names and functions of Commissioners, their Cabinets and Commission staff, a specific Guidance note
2 Private firm, NGO, association, other institution, body, agency, Member State, third country…
3 In case of a private body: CEO, President, Director or equivalent. In case of a Member State/third country or its administration: Head of State,
Minister, State Secretary, Director-General, Ambassador, Permanent Representative.
4 Including by setting off the proposed transfer against less invasive measures.
5 If the applicant has not established a need, the institution does not have to examine the absence of any prejudice to the person's legitimate
6 Cf standard letter "Personal data redacted", available on the dedicated website: https://myintracomm.ec.europa.eu/corp/sg/en/docinter/Pages/lettres.aspx.
7 The two last bullet points apply to information which is not yet in the public domain. If names are released, the other personal data in the
documents requested which are already in the public domain can also be released.
Case C-615/13, ClientEarth v EFSA, judgment of 16 July 2015;
Case C-127/13, Strack v Commission
, judgment of 2 October 2014;
Case T-115/13, Gert-Jan Dennekamp v Commission
, judgment of 15 July 2015;
Case C-28/08 P, Bavarian Lager v Commission
, judgment of 29 June 2010.
Examples of confirmatory decisions and a summary of relevant case-law are available on the Commission's access-
to-documents webpages on My Intracomm
The full text of judgments of the EU Courts can be consulted on the website of the ECJ: www.curia.eu.