OCM(2019)8472 - 10/04/2019
Directorate C: Investigation Support
Barbara PELO
Director
Slotermeerlaan 13
1063 Amsterdam
Netherlands
E-mail:
ask+request-6482-
xxxxxxxx@xxxxxxxx.xxx
ask+request-6483-
xxxxxxxx@xxxxxxxx.xxx
Via e-mail and registered mail with
AR
Subject:
Your application for public access to documents
Dear Ms Pelo,
We refer to your e-mails of 2 March 2019 addressed to the Secretariat-General of the
Commission and registered in OLAF on 13 March 2019 under OCM(2019)5897, by which you
requested access to the travel expenses of Mr G. Kessler (DG BUDG advisor, former Director
General of OLAF), E. Bianchi (OLAF Director B), Francesco Albore (OLAF staff member) for
the period 1 January 2015 to 31 December 2018 inclusive. In particular you asked for
documents that contain, for each of the trips, the following information:
- place of origin and destination, and the amount spent on travel or transportation;
- exact dates and duration of the trip;
- amount spent on accommodation;
- amount spent on subsistence;
- other information, such as possible miscellaneous costs.
If the travel was by air taxi and a team of people were travelling, you also asked for
documents with details on other travellers, at minimum their names and job titles.
You further remarked that that you seek only for name and surname of the relevant persons,
something that, as you say, is already in the public domain. You do not seek for bank
accounts, office addresses, signatures or telephone numbers.
Taking into account the information you requested, we consider your request as an
application for access to documents under Regulation (EC) No 1049/20011 regarding public
access to European Parliament, Council and Commission documents.
1
Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding
public access to European Parliament, Council and Commission documents, OJ L145, 31.05.2001, page
43.
OLAF Rue Joseph II, 30 B-1049 Brussels (Belgium) Tel: +32 (0)2 299 11 11 Web: http://ec.europa.eu/anti_fraud
OCM(2019)8472 - 10/04/2019
1.
Assessment of the documents under Regulation (EC) 1049/2001 - relevant
applicable exceptions
Having carefully considered your application, OLAF regrets to inform you that your application
cannot be granted, as disclosure is prevented by the exceptions to the right of access laid down
in Article 4 of Regulation (EC) 1049/2001 based on the following considerations.
1.1
Protection of the privacy and integrity of the individual
Article 4(1)(b) of Regulation 1049/2001 provides that the institutions shall refuse access to a
document where disclosure would undermine the protection of (…) privacy and the integrity of
the individual, in particular in accordance with Community legislation regarding the protection
of personal data.
According to the definition provided for in Article 3(1) of Regulation 2018/17252, personal data
means any information relating to an identified or identifiable natural person (‘data subject’);
an identifiable natural person is one who can be identified, directly or indirectly, in particular
by reference to an identifier such as a name, an identification number, location data, an online
identifier or to one or more factors specific to the physical, physiological, genetic, mental,
economic, cultural or social identity of that natural person.
Consequently, the information requested, by its very nature constitutes personal data within
the meaning quoted above. Indeed, your request concerns concrete and clearly identified
natural persons.
As far as your request forming the subject of this decision is concerned, the information
requested is included in the cost statements relating to the official assignments (business trips)
of the former Director-General of OLAF, Directors and some other staff members you
mentioned. These cost statements contain information directly related to the concrete
individuals and therefore constitute personal data.
Public disclosure of the above-mentioned personal data, through the release of the documents
(i.e. the cost statements) containing it, or through disclosure of a general description, would
constitute processing (transfer) of personal data within the meaning of Article 3(3) of
Regulation 2018/1725.
In its judgment in Case C-28/08 P
(Bavarian Lager)3, the Court of Justice ruled that when a
request is made for access to documents containing personal data, Regulation (EC) No
45/2001 (now replaced by, Regulation (EU) 2018/1725) becomes fully applicable.
Pursuant to Article 9(1)(b) of Regulation (EU) 2018/1725, ‘personal data shall only be
transmitted to recipients established in the Union other than Union institutions and bodies if
‘[t]he recipient establishes that it is necessary to have the data transmitted for a specific
purpose in the public interest and the controller, where there is any reason to assume that the
data subject’s legitimate interests might be prejudiced, establishes that it is proportionate to
transmit the personal data for that specific purpose after having demonstrably weighed the
various competing interests’.
2
Regulation (EU) 2018/1725 of the European parliament and of the Council of 23
October 2018 on the protection of natural persons with regard to the processing of personal data by the
Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing
Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, OJ L295, 21.11.2018, page 39.
3
Judgment of the Court of Justice of 29 June 2010, European Commission v The Bavarian Lager Co. Ltd,
C-28/08 P, EU:C:2010:378, paragraph 59.
2
OCM(2019)8472 - 10/04/2019
In your application you do not put forward any arguments to establish the necessity to have
the data transmitted for a specific purpose in the public interest. Therefore, OLAF does not
have to examine whether there is a reason to assume that the data subjects’ legitimate
interests might be prejudiced.
Only if conditions set out under Article 9(1)(b) of Regulation (EU) 2018/1725 are fulfilled and
the transfer constitutes lawful processing in accordance with the requirements of Article 5 of
Regulation 2018/1725, can the processing (transfer) of personal data occur.
In that context, whoever requests such a transfer must first establish that it is necessary for a
specific purpose in the public interest. If it is demonstrated to be necessary, it is then for the
Institution concerned to determine that there is no reason to assume that that transfer might
prejudice the legitimate interests of the data subject4. Where there is any reason to assume
that the data subject’s legitimate interests might be prejudiced, the controller of personal data
then, establishes whether it is proportionate to transmit the personal data for that specific
purpose after having demonstrably weighed the various competing interests.
Indeed, in the recent judgment in the
ClientEarth case, the Court of Justice ruled that “
whoever
requests such a transfer must first establish that it is necessary. If it is demonstrated to be
necessary, it is then for the institution concerned to determine that there is no reason to
assume that that transfer might prejudice the legitimate interests of the data subject. If there
is no such reason, the transfer requested must be made, whereas, if there is such a reason,
the institution concerned must weigh the various competing interests in order to decide on the
request for access”5. We refer also to the
Strack case, where the Court of Justice ruled that the
Institution does not have to examine by itself the existence of a need for transferring personal
data6.
The EU Court has also confirmed that a mere
interest of members of the public in obtaining
certain personal data cannot be equated with a
necessity to obtain the said data in the meaning
of Regulation 45/20017. Furthermore, according to the
Dennekamp judgement, if the condition
of necessity laid down by Article 8(b) of Regulation No 45/2001, which is to be interpreted
strictly, is to be fulfilled, it must be established that the transfer of personal data is the most
appropriate means for attaining the applicant's objective, and that it is proportionate to that
objective8.
In any case, the travel costs of Commission staff members are regulated by Articles 11 - 13 of
Annex VII to the Staff Regulations9 and are subject to the audit and control procedures.
Furthermore, the officials of the Commission are not considered to be public office holders but
exercise supportive functions allowing the Institutions to perform their mission.
Nonetheless, OLAF publishes information on its activities on its website, including where
appropriate about missions of its staff. We consider that through the above-mentioned
initiative, the appropriate level of public transparency with regard to the travels of top officials
is ensured.
4
Ibid.
5
Judgment of the Court of Justice of 16 July 2015 in case C-615/13 P,
ClientEarth v EFSA,
(ECLI:EU:C:2015:219), paragraph 47.
6
Judgment of the Court of Justice of 2 October 2014 in case C-127/13 P,
Strack v Commission,
(ECLI:EU:C:2014:2250), paragraph 106.
7 Ibid, paragraphs 107 and 108.
8
Judgment of the General Court of 15 July 2015 in case T-115/13,
Dennekamp v European Parliament,
(ECLI:EU:T:2015:497), paragraph 77.
9
Staff Regulations of Officials and conditions of employment for other Servants of the EU.
3
OCM(2019)8472 - 10/04/2019
In the light of the above, we have to conclude that the transfer of personal data through the
public disclosure of the personal data included in the relevant costs statements cannot be
considered as fulfilling the requirements of Regulation 2018/1725. In consequence, the use of
the exception under Article 4(1)(b) of Regulation 1049/2001 is justified, as there is no need to
publicly disclose the personal data included therein and it can be assumed that the legitimate
rights of the data subjects concerned would be prejudiced by such disclosure.
1.2
Presumption of non-accessibility to OLAF investigation documents
The requested documents concern in part the investigation related travels. For this reason they
additionally fall under exception from public access to documents under Article 4(2), third
indent of Regulation 1049/2001 which stipulates that the institutions shall refuse access to a
document where disclosure would undermine the protection of the purpose of inspections,
investigations and audits as well as the protection of the decision-making process as referred
to Article 4(3) second sentence of the Regulation, unless there is an overriding public interest
in disclosure.
The General Court recognised in recent case-law10 a general presumption of non-accessibility
for documents in OLAF case files. It considers that the disclosure to the public under Regulation
1049/2001 of documents related to OLAF internal investigations could fundamentally
undermine the objectives of the investigative activities, as well as the decision making process,
both now and in the future.
The presumption is based on the consideration that, to determine the scope of Regulation
1049/2001, account must be taken of relevant sectoral rules governing the administrative
procedure under which the documents requested under Regulation 1049/2001 were
gathered11, in the case at hand, Regulation 883/2013, which governs OLAF's administrative
activity provides for the obligation of confidentiality with regard to all information gathered
during investigations.
OLAF is legally bound, pursuant to Article 339 of the Treaty on the Functioning of the European
Union, Article 10 of Regulation (EU, Euratom) No 883/2013, and Article 17 of the Staff
Regulations, to treat the information it obtains during an investigation as confidential and
subject to professional secrecy.
Moreover, the following provisions of Regulation 883/2013 regulate and restrict the use of
information in OLAF investigation files, before, during and after an OLAF investigation: Article
4 (internal investigations), 5 (opening of investigations), 6 (access to information in database
prior to the opening of an investigation), 7 (investigations procedure), 8 (Duty to inform OLAF),
9 (procedural guarantees), Article 10 (confidentiality and data protection); 11 (investigation
report and action to be taken following investigations), 12 (Exchange of information between
OLAF and the competent authorities of Member States), 13 (cooperation between OLAF and
Eurojust and Europol), 14 (cooperation with third countries and international organisations),
15 (Supervisory Committee) and 16 (exchange of views with the institutions), 17 (Director-
General).
In view of that regulatory context, the Court held that allowing public access to OLAF
investigation documents would be particularly detrimental to OLAF’s ability to fulfil its mission
of fight against fraud in the public interest. Some of the documents requested relate to the
investigation activities aiming at gathering evidence and verifying allegations.
10
Judgment of the General Court of 26 April 2016,
Strack v
Commission, T-221/08, EU:T:2016:242,
paragraph 162.
11
Judgment Court of Justice of 28 June 2012,
Agrofert Holding v
Commission, C-477/10 P,
EU:C:2012:394,
paragraphs 50-59; judgment of the Court of Justice of 29 June 2010,
Commission v
Technische Glaswerke
Ilmenau, C-139/07 P, EU:C:2010:376, paragraph 55 ff..
4
OCM(2019)8472 - 10/04/2019
The disclosure of the documents concerned would seriously affect the decision-making process
of OLAF, as it would seriously jeopardize the full independence of future OLAF investigations
and their objectives by revealing OLAF’s strategy and working methods. It could also
discourage individuals to send information concerning possible fraud thus depriving OLAF of
useful information to initiate investigations aiming at protecting the financial interests of the
Union. They must be reassured that their statements will be kept confidential otherwise, they
might be inclined to censor the information they give or to hold back sensitive information.12
The specific confidentiality rules regarding the documents related to OLAF investigations are
justified not only in so far as OLAF collects, as part of such an investigation, sensitive business
secrets and highly sensitive information on individuals whose disclosure could significantly
harm their reputation, but also to the extent that the access to documents relating to an
investigation by OLAF, even after the conclusion of the investigation in question might, as
explained above, seriously hamper the work of OLAF, disclose the methodology and strategy,
harm the availability of those involved in the procedure to collaborate in the future and,
therefore prejudice the proper functioning of the investigations in question and the
achievement of their objectives.
The protection of confidentiality of information in the legal framework applicable to OLAF
investigations aims, on the one hand, at safeguarding the successful conduct of an investigation
in the public interest and, on the other hand, at safeguarding the legitimate interests of the
individuals, so that the information they provide is used only for the purposes of the
investigation. The protection of confidentiality extends to closed cases13.
2.
Partial Access
OLAF has also examined the possibility of granting partial access to the requested
documents in accordance with Article 4(6) of Regulation (EC) No 1049/2001.
No meaningful partial access to the cost statements concerned is possible, as the entirety
of the information falling under the scope of your application and included therein is covered
by the exception in Article 4(1)(b) of Regulation1049/2001, and in part additionally fall
entirely under the general presumption of applicability of Article 4(2), third indent and Article
4(3) of Regulation 1049/2001 in the context of inspections and audits.
3.
Overriding public interest in disclosure
The exception laid down in Article 4(1)(b) of Regulation 1049/2001 is an absolute exception,
i.e. its applicability does not need to be balanced against any possible overriding public
interest in disclosure.
The exceptions laid down in Article 4(2) and 4(3) of Regulation 1049/2001 apply unless
there is an overriding public interest in disclosure of the documents. For such an interest to
exist it, firstly, has to be a public interest and, secondly, it has to outweigh the interest
protected by the exception to the right of access.
OLAF understands the importance of transparency of the functioning of the EU institutions
and particularly of the European Commission. However, given the nature of the anti-fraud
investigations conducted by OLAF, and the confidential nature of information collected, such
as sources of information, content of case files and reputation of natural persons, an
application under Regulation (EC) No 1049/2001 would have to contain clear elements to
indicate the existence of an overriding interest to justify putting internal OLAF documents
and other information from the investigation file into the public domain.
12
See judgement in
Agrofert Holding v
Commission, cited above EU:C:2012:394, paragraph 66.
13
Judgment of the General Court of 26 April 2016,
Strack v
Commission, T-221/08, EU:T:2016:242,
paragraphs 150 to 164.
5
OCM(2019)8472 - 10/04/2019
4.
Confirmatory application
In accordance with Article 7(2) of Regulation 1049/2001, you are entitled to make a
confirmatory application requesting OLAF to review this position. Pursuant to Article 4 of
Commission Decision 2001/937/EC, ECSC, Euratom, such a confirmatory application should be
addressed within 15 working days upon receipt of this letter to the Director General of OLAF.
We also wish to inform you that with regard to the repetitive request, the review is limited only
to the assessment that the legal/factual circumstances have not relevantly changed since the
previous reply.
Any confirmatory application to OLAF should be sent to the following address:
Mr Ville ITÄLÄ
Director General OLAF
European Commission
B-1049 BRUXELLES
BELGIUM
Your attention is drawn to the statement concerning the transfer of personal data below.
Signed Electronically
on 10/04/2019 at 14:46 by
Maria Beatriz Sanz Redrado [DIRECTOR]
Privacy statement
Pursuant to Articles 15 and 16 of Regulation (EU) 2018/1725 on the protection of natural persons with regard to
the processing of personal data by Union Institutions, bodies, offices and agencies and of the free movement of
such data, please be informed that your personal data are stored in OLAF’s electronic and paper files concerning
this matter for the purposes of ensuring conformity with the requirements of Regulation 1049/2001 and
Commission Decision 2001/937/EC.
The categories of your personal data being processed are identification and contact data and any other personal
data provided by or to you in relation to your request. Officials within OLAF and other Commission services
responsible for dealing with requests for access to documents, and third parties, within the meaning of Articles
4(4) and 3(b) of Regulation 1049/2001, and Article 5 of Commission Decision 2001/937/EC, have access to your
personal data. Personal data that appear on the requested document may only be disclosed to the applicant
following an assessment under Article 9(b) of Regulation (EU) 2018/1725. There is no automated decision process
by OLAF concerning any data subject.
All documentation concerning OLAF investigations are stored in the relevant OLAF investigation files and are
retained for a maximum of 15 years. Thus personal data contained in requests for public access to documents
concerning OLAF investigations are retained for a maximum of 15 years.
You have the right to request access to your personal data, rectification or erasure of the data, or restriction of
their processing. Any request to exercise one of those rights should be directed to the Controller
(OLAF-FMB-DATA-
xxxxxxxxxx@xx.xxxxxx.xx). You may contact the Data Protection Officer of OLAF
(xxxxxxxxxxxx@xx.xxxxxx.xx)
with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.
You have the right to have recourse to the European Data Protection Supervisor (
xxxx@xxxx.xxxxxx.xx) if you
consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of
your personal data by OLAF.
The complete privacy statements for this and all other OLAF personal data processing operations are available at
http://ec.europa.eu/anti_fraud.
6
