Ref. Ares(2016)1069937 - 02/03/2016
Ref. Ares(2016)5416325 - 16/09/2016
TRANSPARENCY
Access to documents
European Commission– SG B4
Newsletter n° 26
02 March 2016
REQUESTS BY CONSULTED THIRD PARTIES TO KNOW THE
NAME OF THE APPLICANT UNDER REGULATION 1049/2001
When consulting third parties under Article 4(4) and (5) of Regulation 1049/2001, Commissions
services are sometimes asked to provide details about the identity of the applicant.
The request of consulted third parties to know the name of the applicant is a request for information.
Disclosure of the applicant's name would entail a transfer of personal data, falling under the
provisions of Regulation 45/2001.
For transfers of personal data within the EU1, Article 8(b) of Regulation 45/2001 requires the
recipient to establish, through the provision of one or more express and legitimate reasons, the
necessity of the transfer of the personal data. Once the necessity has been substantiated, the
institution examines whether there are reasons to think that the personal data transfer might
prejudice the legitimate interests of the data subjects concerned. Such an examination could entail
the consultation of the individual concerned2 3.
It will not be easy for the consulted third party to demonstrate the necessity of the data transfer.
Indeed, in the context of an access-to-document request, the identity of the applicant is irrelevant, as
access is not given to this individual personally, but to the public at large (
erga omnes). This is why
the applicant for access to documents is not obliged to state reasons for the application, according to
Article 6(1) of Regulation 1049/2001. It follows that he/she is not obliged to reveal his/her identity to
third parties consulted by the institutions according to article 4(4) or (5) of Regulation 1049/2001.
Therefore, there will usually be no necessity to disclose the applicant's name to consulted third
parties in the context of Regulation 1049/2001. Consequently, if the necessity to transfer this
personal data is not substantiated, services do not need to verify whether the privacy or integrity of
the applicant might be undermined, for instance by asking the applicant whether s/he agrees to the
disclosure of their name.
For more information :
send an email to xxxxxxxxxxxxxxxxx@xx.xxxxxx.xx
In case a Member State has specific, legitimate reasons to request information about the identity of
an applicant in the framework of that Member State's consultation under Article 4(4) and (5), such a
request has to be examined carefully. In the light of the principle of sincere cooperation, you could
consider providing information on the category to which the applicant belongs (i.e. academia, law
firm, NGO, etc), unless such information (taken together with the information already available to
the Member State) would make the applicant identifiable. In the latter case, such information (or any
other personal data of the applicant) cannot be provided without the applicant's express consent.
1
For transfer of personal data to recipients outside the EU, article 9 of Regulation 45/2001 applies. According to Article
9(1), personal data shall only be transferred to recipients, other than Community institutions and bodies, which are not
subject to national law adopted pursuant to Directive 95/46/EC, if an adequate level of protection is ensured in the
country of the recipient or within the recipient international organisation and the data are transferred solely to allow
tasks covered by the competence of the controller to be carried out.
2
In its Judgement of 29 June 2010, in Case C 28/08 P, Commission v Bavarian Lager, the Court stated: [a]s Bavarian
Lager has not provided any express and legitimate justification or any convincing argument in order to demonstrate the
necessity for those personal data to be transferred, the Commission has not been able to weigh up the various interests
of the parties concerned. Nor was it able to verify whether there was any reason to assume that the data subjects’
legitimate interests might be prejudiced, as required by Article 8(b) of Regulation No 45/2001 (para. 78).
3
In its Judgment of 21 October 2010 in Case T-439/08, Agapiou Joséphidès v Commission and EACEA, the General
Court accepted the following argument of the Commission: n’ayant pas obtenu, dans le délai imparti, la certitude que
les données en cause étaient publiques, l’EACEA a estimé par prudence devoir occulter ces données pour qu’il soit
satisfait au principe de protection de la vie privée et de l’intégrité de l’individu (para 115).