Fiche 9 Third-parties' personal data (names, signatures, contact details, ...)
Documents fully or partially released under Regulation (EC) No 1049/2001 may contain the personal data
of staff of outside
entities2 and/or of other individuals external to the Commission.
As regards signatures and other personal data, access is in principle denied unless specific conditions are fulfilled. Current administrative practice:
Names of outside individuals, who are not public figures
3 acting in their public capacity,
are normally withheld
unless the following (successive) conditions are fulfilled4:
o the applicant substantiates a necessity for a specific purpose in the public interest5 (demonstrated
by express and legitimate justifications or convincing arguments) to obtain access to these names;
o the institution considers that there is no reason to think that the transmission would prejudice the
legitimate rights of the individuals concerned (for instance, if the data subject has unambiguously
given his/her consent or his name is proactively published under the applicable rules6)7;
o or, where there is any reason to assume that the data subject’s legitimate interests might be
prejudiced, the institution considers the transmission proportionate for the specific purpose
brought forward by the applicant, after having demonstrably weighed the various competing
interests; there must be no less invasive measures available, taking into account the principle of
If these conditions are not fulfilled, services should redact the respective names with reference to Article 4(1)(b) of
Regulation (EC) No 1049/20018. The same applies to functions
to the extent that these enable the individuals to be
If consultations are not possible for lack of time or other practical constraints, the institution has to assess the
possible prejudice and weigh the various competing interests based on the information available, and taking
into account whether the individuals concerned have, in their personal capacity, an institutionalised role in the
EU’s policy-making process9. In case of doubt, it is advisable to err on the side of caution, so as to avoid
potentially adverse consequences for the data subject concerned of which it has not been possible to
substantiate the likelihood and magnitude set off against the purpose of the transmission.
are withheld following a similarly restrictive approach regardless of the person's level
. This is justified by the specific risks (forgery, identity theft) involved.
1 As regards the names and functions of Commission staff, a specific Guidance note e
2 Private company/ firm, NGO, association, other institution, body, agency, Member State, third country, international organisation.
3 As regards the names of a public figure acting in his or her public capacity (such as President, Head of State, Minister, State Secretary,
Ambassador, Permanent Representative, head of the regional administration, mayor, Ombudsman, MEP, Secretary-General, Director-
General, etc.), their names are in principle disclosed, as indicated by the 2010 opinion of the European Data Protection Supervisor.
Principal Church officials such as Cardinals, the Apostolic Nuncios (Heads of the Mission of the Holy See to the European Union or to other
countries), the Archbishop of Canterbury (who is the principal leader of the Church of England) etc. are also considered public figures; their
names are in principle disclosed. On the contrary, the names of lower church officials should be protected.
4 As required by Article 9(1)(b) of Regulation (EU) 2018/1725.
5 As specified in Recital 28 of Regulation (EU) 2018/1725, ‘[t]he specific purpose in the public interest could relate to the transparency of
Union institutions and bodies’.
6 This is, for instance, the case as regards the publication of the names of self-employed individuals in the Transparency Register.
7 If the applicant has not established that it is necessary to have the data transmitted for a specific purpose in the public interest, the
institution does not have to examine the absence of any prejudice to the person's legitimate interests.
8 Cf. standard letter “Partial access personal data redacted EU EEA third countries", available on the dedicated website:
9 As was the case for the expert groups to which the Borax
The same applies to contact details
(address, telephone number,…) and other personal data
as defined in point (1)
of Article 3 of Regulation (EU) 2018/172510.
Case T-121/05, Borax
, judgment of 11 March 2009;
Case C-28/08 P, Bavarian Lager
, judgment of 29 June 2010;
Case C-127/13, Strack
, judgment of 2 October 2014;
Case C-615/13, ClientEarth
, judgment of 16 July 2015;
Case T-115/13, Gert-Jan Dennekamp
, judgment of 15 July 2015;
Joined Cases T-639/15 to T-666/15 and T-94/16, Psara et al.
v European Parliament
, judgment of 25 September
Examples of confirmatory decisions and a summary of relevant case-law are available on the Commission's access-
to-documents webpages on My Intracomm
The full text of judgments of the EU Courts can be consulted on the website of the ECJ: www.curia.eu.
Mise à jour : 30 March 2020
10 The two last bullet points apply to information which is not yet in the public domain. If names are released, the other personal data in the
documents requested which are already in the public domain can also be released.