EUROPEAN COMMISSION
Brussels, 04.03.2022
C(2022) 1467 final
Ms Rachel Hanna
Calle de Vinaroz 2, 1g
xxxxx xxxxxx
Spain
DECISION OF THE EUROPEAN COMMISSION PURSUANT TO ARTICLE 4 OF THE
IMPLEMENTING RULES TO REGULATION (EC) NO 1049/20011
Subject:
Your confirmatory application for access to documents under
Regulation (EC) No 1049/2001 - GESTDEM 2021/347
Dear Ms Hanna,
I refer to your e-mail of 28 March 2021, registered on 29 March 2021, in which you
submitted a confirmatory application in accordance with Article 7(2) of Regulation (EC)
No 1049/2001 regarding public access to European Parliament, Council and Commission
documents2 (hereafter ‘Regulation (EC) No 1049/2001’).
Please accept our apologies for the delay in the handling of your request.
1.
SCOPE OF YOUR REQUEST
In your initial application of 20 January 2021, you requested access to ‘all documents
relating to the impact assessment carried out on the classification of company and
company ownership data as a high value data set under the Open Data Directive,
including:
1. All documents relating to the cost-benefit analysis (including the impact assessment
study on high value datasets by Deloitte et al);
2. All documents, including emails, relating to the methodology of the above-mentioned
impact assessment study;
1 OJ L 345, 29.12.2001, p. 94.
2 OJ L 145, 31.5.2001, p. 43.
Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIË - Tel. +32 22991111
3. All documents relating to the impact on personal data and balance with the GDPR,
including any legal opinions’.
By your email dated 11 February 2021, you narrowed down the scope of your request to
the following documents:
- The Impact Assessment Study on High Value Datasets by Deloitte et al.
- All documents relating to the impact on personal data and balance with the GDPR,
including any legal opinions.
The Directorate-General for Communications Networks, Content and Technology
identified nine documents as falling within the scope of the request:
- Impact Assessment study on the list of High Value Datasets to be made available
by the Member States under the Open Data Directive (‘Document 1’)
- Impact Assessment study on the list of High Value Datasets to be made available
by the Member States under the Open Data Directive – Executive Summary
(‘Document 2’)
- Email dated 23 September 2020 received from a Member State (‘Document 3’)
and its attachment, a position paper submitted by this Member State with regard
to the protection of personal data in High-Value Datasets (HVDs) (‘Document
4’)
- Email exchanges between DG CONNECT and the EDPS in the period from 16
December 2020 to 13 January 2021 (‘Document 5’) and the attachments:
- a) Commission Staff Working Document Impact Assessment accompanying the
document Proposal for a Commission Implementing Regulation laying down a
list of High Value Datasets (‘Document 6’) and
- b) Impact Assessment study on the list of High Value Datasets to be made
available by the Member States under the Open Data Directive. Please note that
this document is already listed above as ‘Document 1’.
- Letter from the European Family Businesses (EFB) to DG CONNECT, dated 6
November 2020 (‘Document 7’)
- Emails dated November 2020 received from two Member States (‘Document 8’)
and the attached joint non-paper (‘Document 9’).
In its initial reply of 8 March 2021, the Directorate-General for Communications
Networks, Content and Technology granted
- full access to documents 1, 2 and 6
- granted partial access to documents 5 and 7 based on the exceptions laid down in
Article 4(1)(b) (protection of privacy and integrity of the individual) of
Regulation (EC) No 1049/2001 and first subparagraph (protection of the decision-
making) of Article 4(3) of Regulation (EC) No 1049/2001
- refused access documents 3, 4, 8 and 9 on the basis of the exceptions laid down in
Article 4(1)(b) (protection of privacy and integrity of the individual) and the first
subparagraph (protection of the decision-making) of Article 4(3) of Regulation
(EC) No 1049/2001.
2
In your confirmatory application, you request a review of the initial reply of the
Directorate-General for Communications Networks, Content and Technology.
2.
ASSESSMENT AND CONCLUSIONS UNDER REGULATION (EC) NO 1049/2001
When assessing a confirmatory application for access to documents submitted pursuant
to Regulation (EC) No 1049/2001, the Secretariat-General conducts a fresh review of the
reply given by the Directorate-General concerned at the initial stage.
Following this review, I can inform you that:
- Full access is granted to documents 4 and 9;
- Partial access is herewith granted to documents 3, 5 and 8, subject to the
exception laid down in Article 4(1)(b) (protection of privacy and integrity of the
individual) of Regulation (EC) No 1049/2001;
- As regards the redacted parts of document 7, I have to confirm the initial decision
of the Directorate-General for Communications Networks, Content and
Technology based on the exception laid down in Article 4(1)(b) (protection of
privacy and the integrity of the individual) of Regulation (EC) No 1049/2001.
The detailed reasons underpinning the assessment are set out below.
2.1. Protection of privacy and the integrity of the individual
Article 4(1)(b) of Regulation (EC) No 1049/2001 provides that ‘[t]he institutions shall
refuse access to a document where disclosure would undermine the protection of […]
privacy and the integrity of the individual, in particular in accordance with Community
legislation regarding the protection of personal data’.
In its judgment in Case C-28/08 P (
Bavarian Lager)3, the Court of Justice ruled that
when a request is made for access to documents containing personal data, Regulation
(EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000
on the protection of individuals with regard to the processing of personal data by the
Community institutions and bodies and on the free movement of such data4
(hereafter ‘Regulation (EC) No 45/2001’) becomes fully applicable.
Please note that, as from 11 December 2018, Regulation (EC) No 45/2001 has been
repealed by Regulation (EU) 2018/1725 of the European Parliament and of the Council
of 23 October 2018 on the protection of natural persons with regard to the processing of
personal data by the Union institutions, bodies, offices and agencies and on the free
3 Judgment of the Court of Justice of 29 June 2010,
European Commission v
The Bavarian Lager Co.
Ltd (hereafter referred to as
‘European Commission v
The Bavarian Lager judgment’) C-28/08 P,
EU:C:2010:378, paragraph 59.
4 OJ L 8, 12.1.2001, p. 1.
3
movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No
1247/2002/EC5 (hereafter ‘Regulation (EU) 2018/1725’).
However, the case law issued with regard to Regulation (EC) No 45/2001 remains
relevant for the interpretation of Regulation (EU) 2018/1725.
In the above-mentioned judgment, the Court stated that Article 4(1)(b) of Regulation
(EC) No 1049/2001 ‘requires that any undermining of privacy and the integrity of the
individual must always be examined and assessed in conformity with the legislation of
the Union concerning the protection of personal data, and in particular with […] [the
Data Protection] Regulation’6.
Article 3(1) of Regulation (EU) 2018/1725 provides that
personal data ‘means any
information relating to an identified or identifiable natural person […]’.
As the Court of Justice confirmed in Case C-465/00 (
Rechnungshof), ‘there is no reason
of principle to justify excluding activities of a professional […] nature from the notion of
private life’7.
Documents 3, 5, 7 and 8 contain personal data such as the names, surnames, emails,
telephone numbers, functions and addresses of persons who do not form part of the
senior management of the European Commission and of other natural persons. Moreover,
they contain handwritten signatures.
The names8 of the persons concerned as well as other data from which their identity can
be deduced undoubtedly constitute personal data in the meaning of Article 3(1) of
Regulation (EU) 2018/1725.
Pursuant to Article 9(1)(b) of Regulation (EU) 2018/1725, ‘personal data shall only be
transmitted to recipients established in the Union other than Union institutions and bodies
if ‘[t]he recipient establishes that it is necessary to have the data transmitted for a specific
purpose in the public interest and the controller, where there is any reason to assume that
the data subject’s legitimate interests might be prejudiced, establishes that it is
proportionate to transmit the personal data for that specific purpose after having
demonstrably weighed the various competing interests’.
Only if these conditions are fulfilled and the processing constitutes lawful processing in
accordance with the requirements of Article 5 of Regulation (EU) 2018/1725, can the
transmission of personal data occur.
In Case C-615/13 P
(
ClientEarth), the Court of Justice ruled that the institution does not
have to examine by itself the existence of a need for transferring personal data9. This is
5 OJ L 295, 21.11.2018, p. 39.
6
European Commission v
The Bavarian Lager judgment,
cited
above, paragraph 59.
7 Judgment of the Court of Justice of 20 May 2003,
Rechnungshof and Others v
Österreichischer
Rundfunk, Joined Cases C-465/00, C-138/01 and C-139/01, EU:C:2003:294, paragraph 73.
8
European Commission v
The Bavarian Lager judgment, cited above, paragraph 68.
4
also clear from Article 9(1)(b) of Regulation (EU) 2018/1725, which requires that the
necessity to have the personal data transmitted must be established by the recipient.
According to Article 9(1)(b) of Regulation (EU) 2018/1725, the European Commission
has to examine the further conditions for the lawful processing of personal data only if
the first condition is fulfilled, namely if the recipient establishes that it is necessary to
have the data transmitted for a specific purpose in the public interest. It is only in this
case that the European Commission has to examine whether there is a reason to assume
that the data subject’s legitimate interests might be prejudiced and, in the affirmative,
establish the proportionality of the transmission of the personal data for that specific
purpose after having demonstrably weighed the various competing interests.
In your confirmatory application, you do not put forward any arguments to establish the
necessity to have the data transmitted for a specific purpose in the public interest.
Therefore, the European Commission does not have to examine whether there is a reason
to assume that the data subjects’ legitimate interests might be prejudiced.
Notwithstanding the above, there are reasons to assume that the legitimate interests of the
data subjects concerned would be prejudiced by the disclosure of the personal data
reflected in the documents, as there is a real and non-hypothetical risk that such public
disclosure would harm their privacy and subject them to unsolicited external contacts.
Consequently, I conclude that, pursuant to Article 4(1)(b) of Regulation (EC) No
1049/2001, access cannot be granted to the personal data, as the need to obtain access
thereto for a purpose in the public interest has not been substantiated and there is no
reason to think that the legitimate interests of the individuals concerned would not be
prejudiced by the disclosure of the personal data concerned.
3.
OVERRIDING PUBLIC INTEREST IN DISCLOSURE
Please note that Article 4(1)(b) of Regulation (EC) No 1049/2001 does not include the
possibility for the exceptions defined therein to be set aside by an overriding public
interest.
4.
PARTIAL ACCESS
In accordance with Article 4(6) of Regulation (EC) No 1049/2001, partial access has
been granted to the documents requested. No further partial access can be granted
without undermining the interest protected by Article 4(1)(b) (protection of privacy and
the integrity of the individual) of Regulation (EC) No 1049/2001.
9 Judgment of the Court of Justice of 16 July 2015,
ClientEarth v
European Food Safety Agency,
C-615/13 P, EU:C:2015:489, paragraph 47.
5
5.
MEANS OF REDRESS
Finally, I draw your attention to the means of redress available against this decision. You
may either bring proceedings before the General Court or file a complaint with the
European Ombudsman under the conditions specified respectively in Articles 263 and
228 of the Treaty on the Functioning of the European Union.
Yours sincerely,
For the Commission
Ilze JUHANSONE
Secretary-General
Enclosures: (6)
6
Document Outline