Ref. Ares(2016)4162935 - 05/08/2016
Fiche 9 Third-parties' personal data (names, signatures, contact details, ...) 1
Main issues:
Documents fully or partially released under Regulation 1049/2001 may contain the
personal data of outside entities'2 staff
and/or of other individuals external to the Commission.
As regards names, the possible disclosure depends on the degree of seniority of the individual concerned.
As regards signatures and other personal data, access is in principle denied unless specific conditions are fulfilled.
Current administrative practice:
The
name of the main representative3 of an external entity is normally
disclosed (unless the person concerned
explicitly objects to such disclosure; and/or there are other reasons to think that the legitimate rights of that
person would be prejudiced).
Names of outside
individuals other than the above are normally
withheld, unless the following two
(cumulative, successive) conditions are fulfilled:
o the applicant substantiates a need (demonstrated by express and legitimate justifications or
convincing arguments4) to obtain access to these names; and
o there is no reason to think that the transfer would prejudice the legitimate rights of the individuals
concerned(for instance, if the data subject has unambiguously given his/her consent)5.
If these conditions are not fulfilled, services should redact the respective names with reference to Article 4(1)(b) of
Regulation 1049/2001.6 The same applies to
functions to the extent that these enable the individuals to be
identified.
Hand-written signatures, being biometric data, are withheld following a similarly restrictive approach
regardless
of the person's level of seniority. This is justified by the specific risks (forgery, identity theft) involved.
The same applies to
contact details (address, telephone number,…) and
other personal data as defined in Article
2(a) of Regulation 45/2001.
7
1 As regards the names and functions of Commissioners, their Cabinets and Commission staff, a speci
fic Guidance note exists.
2 Private firm, NGO, association, other institution, body, agency, Member State, third country…
3 In case of a private body: CEO, President, Director or equivalent. In case of a Member State/third country or its administration: Head of State,
Minister, State Secretary, Director-General, Ambassador, Permanent Representative.
4 Including by setting off the proposed transfer against less invasive measures.
5 If the applicant has not established a need, the institution does not have to examine the absence of any prejudice to the person's legitimate
interests.
6 Cf standard letter "Personal data redacted", available on the dedicated website:
https://myintracomm.ec.europa.eu/corp/sg/en/docinter/Pages/lettres.aspx.
7 The two last bullet points apply to information which is not yet in the public domain. If names are released, the other personal data in the
documents requested which are already in the public domain can also be released.
Case-law:
Case C-615/13, ClientEarth v EFSA, judgment of 16 July 2015;
Case C-127/13,
Strack v Commission, judgment of 2 October 2014;
Case T-115/13,
Gert-Jan Dennekamp v Commission, judgment of 15 July 2015;
Case C-28/08 P,
Bavarian Lager v Commission, judgment of 29 June 2010.
Reference documents/links:
Examples of confirmatory decisions and a summary of relevant case-law are available on the Commission's access-
to-documents webpages on
My Intracomm8;
The full text of judgments of the EU Courts can be consulted on the website of the ECJ
: www.curia.eu.
March 2016
8 https://myintracomm.ec.europa.eu/sg/docinter/Pages/tools.aspx.