Ref. Ares(2019)292870 - 18/01/2019
Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs
Modernisation of the Single Market
Service Policy for Consumers
By registered letter with
acknowledgment of receipt
Mr Olivier Hoedeman
Corporate Europe Observatory
Rue d'Edimbourg 26
Advance copy by email
Subject: Request for access to documents – GESTDEM No. 2018/6801
Dear Mr Hoedeman,
Thank you for your e-mail of 12.12.2018 which was registered on 18.12.2018, requesting access
to documents under Regulation (EC) No 1049/2001 regarding public access to European
Parliament, Council and Commission documents (OJ L145, 31 May 2001, page 43 and
SCOPE OF YOUR REQUEST
Your e-mail requested access to documents as follows:
“… I would - with reference to Regulation 1049/2001, like to request a list of all companies and
organisations that sent a submission to the consultation.”
DESCRIPTION OF DOCUMENTS IDENTIFIED
We have identified 1 document that match the scope of your request which is annexed to the
Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIË - Tel. +32 22991111
Office: N107 - 01/017 - Tel. direct line +32 229-60531 - Fax +32 229-57712
FULL DISCLOSURE OF REQUESTED INFROMATION
We would like to inform you that the information you have requested is fully disclosed1.
The document to which you have requested access contains names of companies and organisations
but also of private persons which have replied to the public online consultation run by the European
Commission from 26 January to 19 April 2016 on proposal to reform notifications of new regulatory
requirements for services providers.
Among the list of 126 submissions 27 are from private persons which are out of the scope of the
access to documents request and therefore will not be disclosed.
Furthermore, the document to which you have requested access contains personal data.
Pursuant to Article 4(1)(b) of Regulation (EC) No 1049/2001, access to a document has to be refused
if its disclosure would undermine the protection of privacy and the integrity of the individual, in
particular in accordance with European Union legislation regarding the protection of personal data.
The applicable legislation in this field is Regulation (EC) No 2018/1725 of the European
Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard
to the processing of personal data by the Union institutions, bodies, offices and agencies and on the
free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No
1247/2002/EC2 (‘Regulation 2018/1725’).
Article 3(1) of Regulation 2018/1725 provides that personal data ‘means any information relating to
an identified or identifiable natural person […]’. The Court of Justice has specified that
information, which by reason of its content, purpose or effect, is linked to a particular person is to be
considered as personal data.3
In its judgment in Case C-28/08 P (Bavarian Lager
)4, the Court of Justice ruled that when a request
is made for access to documents containing personal data, the Data Protection Regulation becomes
Pursuant to Article 9(1)(b) of Regulation 2018/1725, ‘personal data shall only be transmitted to
recipients established in the Union other than Union institutions and bodies if ‘[t]he recipient
establishes that it is necessary to have the data transmitted for a specific purpose in the public interest
and the controller, where there is any reason to assume that the data subject’s legitimate interests
might be prejudiced, establishes that it is proportionate to transmit the personal data for that specific
purpose after having demonstrably weighed the various competing interests’.
1 Except for redaction of personal data. Please see reference below.
2 Official Journal L 205 of 21.11.2018, p. 39.
3 Judgment of the Court of Justice of the European Union of 20 December 2017 in Case C-434/16, Peter
Nowak v Data Protection Commissioner
, request for a preliminary ruling, paragraphs 33-35, ECLI:EU:C:2017:994.
4 Judgment of 29 June 2010 in Case C-28/08 P, European Commission v The Bavarian Lager Co. Ltd
EU:C:2010:378, paragraph 59.
5 Whereas this judgment specifically related to Regulation (EC) No 45/2001 of the European Parliament
and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of
personal data by the Community institutions and bodies and on the free movement of such data, the
principles set out therein are also applicable under the new data protection regime established by
Only if these conditions are fulfilled and the processing constitutes lawful processing in accordance
with the requirements of Article 5 of Regulation 2018/1725, can the transmission of personal data
According to Article 9(1)(b) of Regulation 2018/1725, the European Commission has to examine the
further conditions for a lawful processing of personal data only if the first condition is fulfilled,
namely if the recipient has established that it is necessary to have the data transmitted for a specific
purpose in the public interest. It is only in this case that the European Commission has to examine
whether there is a reason to assume that the data subject’s legitimate interests might be prejudiced
and, in the affirmative, establish the proportionality of the transmission of the personal data for that
specific purpose after having demonstrably weighed the various competing interests.
In your request, you do not put forward any arguments to establish the necessity to have the data
transmitted for a specific purpose in the public interest. Therefore, the European Commission does
not have to examine whether there is a reason to assume that the data subject’s legitimate interests
might be prejudiced.
Notwithstanding the above, please note that there are reasons to assume that the legitimate interests
of the data subjects concerned would be prejudiced by disclosure of the personal data reflected in the
documents, as there is a real and non-hypothetical risk that such public disclosure would harm their
privacy and subject them to unsolicited external contacts.
Consequently, I conclude that, pursuant to Article 4(1)(b) of Regulation 1049/2001, access cannot be
granted to the personal data, as the need to obtain access thereto for a purpose in the public interest
has not been substantiated and there is no reason to think that the legitimate interests of the
individuals concerned would not be prejudiced by disclosure of the personal data concerned.
In case you would disagree with the assessment that the expunged data are personal data which can
only be disclosed if such disclosure is legitimate under the rules of personal data protection, you are
entitled, in accordance with Article 7(2) of Regulation 1049/2001, to make a confirmatory
application requesting the Commission to review this position.
Such a confirmatory application should be addressed within 15 working days upon receipt of this
letter to the Secretary-General of the Commission at the following address:
Unit C.1. ‘Transparency, Document Management and Access to Documents’
or by email to: [email address]
Head of Unit
Annexes: Document – Public consultation submissions
Electronically signed on 18/01/2019 10:49 (UTC+01) in accordance with article 4.2 (Validity of electronic documents) of Commission Decision 2004/563