**Case C-28/08 P**

**European Commission**

**v**

**The Bavarian Lager Co. Ltd**

(Appeal – Access to the documents of the institutions – Document concerning a meeting held in the context of a procedure for failure to fulfil obligations – Protection of personal data – Regulation (EC) No 45/2001 – Regulation (EC) No 1049/2001)

Summary of the Judgment

1.        *European Communities – Institutions – Right of public access to documents – Regulation No 1049/2001*

*(Art. 6 EU; European Parliament and Council Regulations No 45/2001 and No 1049/2001, Art. 4(1)(b))*

2.        *Approximation of laws – Protection of natural persons in relation to the processing of personal data – Processing of those
data by Community institutions and bodies – Regulation No 45/2001*

*(European Parliament and Council Regulations No 45/2001, Arts 2(a), and 8(b), and No 1049/2001)*

1.        Article 4(1)(b) of Regulation No 1049/2001 regarding public access to European Parliament, Council and Commission documents,
which provides for an exception to access to a document where disclosure would undermine the protection of privacy and the
integrity of the individual, in particular in accordance with EU legislation regarding the protection of personal data, establishes
a specific and reinforced system of protection of a person whose personal data could, in certain cases, be communicated to
the public. That provision is indivisible and requires that any undermining of privacy and the integrity of the individual
must always be examined and assessed in conformity with that legislation, and in particular with Regulation No 45/2001 on
the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and
on the free movement of such data.

Whilst, according to Article 1(1) of Regulation No 45/2001, the purpose of that regulation is to ‘protect the fundamental
rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal
data’, that provision does not allow cases of processing of personal data to be separated into two categories, namely a category
in which that treatment is examined solely on the basis of Article 8 of the European Court of Human Rights (ECHR) and the
case-law of the European Court of Human Rights relating to that article and another category in which that processing is subject
to the provisions of Regulation No 45/2001. In that regard, whilst it is clear from the first sentence of recital 15 of Regulation
No 45/2001 that the Union legislature has pointed to the need to apply Article 6 EU and, by that means, Article 8 of the ECHR,
where such processing is carried out by Community institutions or bodies in the exercise of activities falling outside the
scope of that regulation, in particular those laid down in Titles V and VI of the EU Treaty in its version prior to the Treaty
of Lisbon, such a reference has not been found necessary for processing carried out in the exercise of activities within the
scope of that regulation, given that, in such cases, it is clearly Regulation No 45/2001 itself which applies.

It follows that, where a request based on Regulation No 1049/2001 seeks to obtain access to documents including personal data,
the provisions of Regulation No 45/2001 become applicable in their entirety, including Articles 8 and 18 thereof, which constitute
essential provisions of the system of protection established by that regulation.

(see paras 57, 59-64)

2.        The list of participants at a meeting held in the context of proceedings for failure to fulfil obligations appearing in the
minutes of that meeting contains personal data for the purposes of Article 2(a) of Regulation No 45/2001, since the persons
who participated in that meeting can be identified.

By requiring that, in respect of persons who have not given their express consent to the disclosure of their personal data
contained in those minutes, the need for transfer of those personal data be established, the Commission complies with the
provisions of Article 8(b) of that regulation.

Where, in the context of a request for access to those minutes under Regulation No 1049/2001, no express and legitimate justification
or any convincing argument is provided in order to demonstrate the need for those personal data to be transferred, the Commission
is not able to weigh up the various interests of the parties concerned. Nor is it able to verify whether there is any reason
to assume that such transfer might prejudice the data subjects’ legitimate interests, as it is required to do by Article 8(b)
of Regulation No 45/2001.

(see paras 70, 77-78)

JUDGMENT OF THE COURT (Grand Chamber)

29 June 2010 (*)

(Appeal – Access to the documents of the institutions – Document concerning a meeting held in the context of a procedure for failure to fulfil obligations –Protection of personal data – Regulation (EC) No 45/2001 – Regulation (EC) No 1049/2001)

In Case C‐28/08 P,

APPEAL under Article 56 of the Statute of the Court of Justice, brought on 23 January 2008,

**European Commission,** represented by C. Docksey and P. Aalto, acting as Agents, with an address for service in Luxembourg,

applicant,

supported by:

**United Kingdom of Great Britain and Northern Ireland,** represented by E. Jenkinson and V. Jackson, acting as Agents, assisted by J. Coppel, Barrister,

**Council of the European Union,** represented by B. Driessen and C. Fekete, acting as Agents,

interveners in the appeal,

the other parties to the proceedings being:

**The Bavarian Lager Co. Ltd,** established in Clitheroe (United Kingdom), represented by J. Webber and M. Readings, Solicitors,

applicant at first instance,

supported by:

**Kingdom of Denmark,** represented by B. Weis Fogh, acting as Agent,

**Republic of Finland,** represented by J. Heliskoski, acting as Agent,

**Kingdom of Sweden,** represented by K. Petkovska, acting as Agent,

interveners in the appeal,

**European Data Protection Supervisor,** represented by H. Hijmans, A. Scirocco and H. Kranenborg, acting as Agents,

intervener at first instance,

THE COURT (Grand Chamber),

composed of V. Skouris, President, A. Tizzano, J.N. Cunha Rodrigues, K. Lenaerts, R. Silva de Lapuerta and C. Toader, Presidents
of Chambers, A. Rosas, K. Schiemann, E. Juhász (Rapporteur), G. Arestis and T. von Danwitz, Judges,

Advocate General: E. Sharpston,

Registrar: H. von Holstein, Deputy Registrar,

having regard to the written procedure and further to the hearing on 16 June 2009,

after hearing the Opinion of the Advocate General at the sitting on 15 October 2009,

gives the following

**Judgment**

1        By its appeal, the Commission of the European Communities seeks the annulment of the judgment of the Court of First Instance
of the European Communities (now ‘the General Court’) of 8 November 2007 in Case T-194/04 *Bavarian Lager* v *Commission*[2007] ECR II‐4523; ‘the judgment under appeal’), in so far as that judgment annulled the Commission’s decision of 18 March
2004 (‘the contested decision’), rejecting the request by The Bavarian Lager Co. Ltd (‘Bavarian Lager’) for access to the
full minutes of a meeting of 11 October 1996, held in the context of a procedure for failure to fulfil obligations (‘the meeting
of 11 October 1996’).

**Legal context**

2        Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with
regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) requires Member States
to ensure the protection of the fundamental rights and freedoms of natural persons, and in particular their privacy in relation
to the handling of personal data, in order to ensure the free movement of personal data in the European Community.

3        Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals
with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data
(OJ 2001 L 8, p. 1), was adopted on the basis of Article 286 EC.

4        Recitals 1, 2, 5, 7, 8, 12, 14 and 15 of Regulation No 45/2001, or certain parts thereof, read as follows:

(1)      Article 286 [EC] requires the application to the Community institutions and bodies of the Community acts on the protection
of individuals with regard to the processing of personal data and the free movement of such data.

(2)      A fully-fledged system of protection of personal data not only requires the establishment of rights for data subjects and
obligations for those who process personal data, but also appropriate sanctions for offenders and monitoring by an independent
supervisory body.

...

(5)      A Regulation is necessary to provide the individual with legally enforceable rights ...

...

(7)      The persons to be protected are those whose personal data are processed by Community institutions or bodies in any context
whatsoever ...

(8)      The principles of data protection should apply to any information concerning an identified or identifiable person. ...

...

(12)      Consistent and homogeneous application of the rules for the protection of individuals’ fundamental rights and freedoms with
regard to the processing of personal data should be ensured throughout the Community.

...

(14)      To this end measures should be adopted which are binding on the Community institutions and bodies. These measures should apply
to all processing of personal data by all Community institutions and bodies insofar as such processing is carried out in the
exercise of activities all or part of which fall within the scope of Community law.

(15)      Where such processing is carried out by Community institutions or bodies in the exercise of activities falling outside the
scope of this Regulation, in particular those laid down in Titles V and VI of the [EU Treaty, in its version prior to the
Treaty of Lisbon], the protection of individuals’ fundamental rights and freedoms shall be ensured with due regard to Article
6 of [that EU Treaty]. Access to documents, including conditions for access to documents containing personal data, is governed
by the rules adopted on the basis of Article 255 ... EC the scope of which includes Titles V and VI of [the said EU Treaty].’

5        Article 1 of Regulation No 45/2001 provides:

‘1.      In accordance with this Regulation, the institutions and bodies set up by, or on the basis of, the Treaties establishing the
European Communities, hereinafter referred to as “Community institutions or bodies”, shall protect the fundamental rights
and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data
and shall neither restrict nor prohibit the free flow of personal data between themselves or to recipients subject to the
national law of the Member States implementing Directive 95/46 ...

2.      The independent supervisory authority established by this Regulation, hereinafter referred to as the European Data Protection
Supervisor, shall monitor the application of the provisions of this Regulation to all processing operations carried out by
a Community institution or body.’

6        Article 2 of that regulation provides:

‘For the purposes of this Regulation:

(a)      “personal data” shall mean any information relating to an identified or identifiable natural person hereinafter referred to
as “data subject”; an identifiable person is one who can be identified, directly or indirectly, in particular by reference
to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural
or social identity;

(b)      “processing of personal data” ... any operation or set of operations which is performed upon personal data, whether or not by
automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation,
use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure
or destruction;

...’

7        Article 3 of the said regulation provides:

‘1.      This Regulation shall apply to the processing of personal data by all Community institutions and bodies insofar as such processing
is carried out in the exercise of activities all or part of which fall within the scope of Community law.

2.      This Regulation shall apply to the processing of personal data wholly or partly by automatic means, and to the processing
otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing
system.’

8        According to Article 4 of the same regulation:

‘1.      Personal data must be:

(a)      processed fairly and lawfully;

(b)      collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes
...

...’

9        Article 5 of Regulation No 45/2001 provides:

‘Personal data may be processed only if:

(a)      processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties establishing
the European Communities or other legal instruments adopted on the basis thereof or in the legitimate exercise of official
authority vested in the Community institution or body or in a third party to whom the data are disclosed, or

(b)      processing is necessary for compliance with a legal obligation to which the controller is subject, or

...

(c)      the data subject has unambiguously given his or her consent ...

...’

10      Article 8 of that regulation, headed ‘Transfer of personal data to recipients, other than Community institutions and bodies,
subject to Directive 95/46 ...’, provides:

‘Without prejudice to Articles 4, 5, 6 and 10, personal data shall only be transferred to recipients subject to the national
law adopted for the implementation of Directive 95/46:

(a)      if the recipient establishes that the data are necessary for the performance of a task carried out in the public interest
or subject to the exercise of public authority, or

(b)      if the recipient establishes the necessity of having the data transferred and if there is no reason to assume that the data
subject’s legitimate interests might be prejudiced.’

11      Article 18 of the said regulation, headed ‘The data subject’s right to object’, states:

‘The data subject shall have the right:

(a)      to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of
data relating to him or her, except in the cases covered by Article 5(b), (c) and (d). Where there is a justified objection,
the processing in question may no longer involve those data;

(b)      to be informed before personal data are disclosed for the first time to third parties or before they are used on their behalf
for the purposes of direct marketing, and to be expressly offered the right to object free of charge to such disclosure or
use.’

12      Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European
Parliament, Council and Commission documents (OJ 2001 L 145, p. 43), defines the principles, conditions and limits for the
right of access to documents of those institutions laid down by Article 255 EC. That regulation has applied since 3 December
2001.

13      According to recital 1 of Regulation No 1049/2001:

‘The second subparagraph of Article 1 of the [EU Treaty in its version prior to the Lisbon Treaty] enshrines the concept of
openness, stating that the Treaty marks a new stage in the process of creating an ever closer union among the peoples of Europe,
in which decisions are taken as openly as possible and as closely as possible to the citizen.’

14      According to recital 2 of Regulation No 1049/2001:

‘Openness enables citizens to participate more closely in the decision-making process and guarantees that the administration
enjoys greater legitimacy and is more effective and more accountable to the citizen in a democratic system. Openness contributes
to strengthening the principles of democracy and respect for fundamental rights as laid down in Article 6 of the EU Treaty
[in its version prior to the Treaty of Lisbon] and in the Charter of Fundamental Rights of the European Union [“the Charter”].’

15      Recitals 4 and 11 of Regulation No 1049/2010 state:

‘(4)      The purpose of this Regulation is to give the fullest possible effect to the right of public access to documents and to lay
down the general principles and limits on such access in accordance with Article 255(2) ... EC.

...

(11)      In principle, all documents of the institutions should be accessible to the public. However, certain public and private interests
should be protected by way of exceptions. The institutions should be entitled to protect their internal consultations and
deliberations where necessary to safeguard their ability to carry out their tasks. In assessing the exceptions, the institutions
should take account of the principles in Community legislation concerning the protection of personal data, in all areas of
Union activities.’

16      According to Article 2 of Regulation No 1049/2001, headed ‘Beneficiaries and scope’:

‘1.      Any citizen of the Union, and any natural or legal person residing or having its registered office in a Member State, has
a right of access to documents of the institutions, subject to the principles, conditions and limits defined in this Regulation.

2.      The institutions may, subject to the same principles, conditions and limits, grant access to documents to any natural or legal
person not residing or not having its registered office in a Member State.

3.      This Regulation shall apply to all documents held by an institution, that is to say, documents drawn up or received by it
and in its possession, in all areas of activity of the European Union.

4.      Without prejudice to Articles 4 and 9, documents shall be made accessible to the public either following a written application
or directly in electronic form or through a register. In particular, documents drawn up or received in the course of a legislative
procedure shall be made directly accessible in accordance with Article 12.

5.      Sensitive documents as defined in Article 9(1) shall be subject to special treatment in accordance with that Article.

...’

17      According to Article 4 of Regulation No 1049/2001, concerning exceptions to the right of access:

The institutions shall refuse access to a document where disclosure would undermine the protection of:

...

b)      privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection
of personal data.

2.      The institutions shall refuse access to a document where disclosure would undermine the protection of:

...

–        the purpose of inspections, investigations and audits,

unless there is an overriding public interest in disclosure.

...’

18      Article 6(1) of Regulation No 1049/2001 provides that ‘[t]he applicant is not obliged to state reasons for the application’.

**Factual background to the dispute**

19      The facts behind the present dispute are set out in paragraphs 15 to 28 and 34 to 37 of the judgment under appeal as follows:

‘15      [Bavarian Lager] was established on 28 May 1992 for the importation of German beer for public houses and bars in the United
Kingdom, situated primarily in the North of England.

16      However, Bavarian Lager was not able to sell its product, since a large number of publicans in the United Kingdom were tied
by exclusive purchasing contracts obliging them to obtain their supplies of beer from certain breweries.

17      Under the Supply of Beer (Tied Estate) Order 1989 SI 1989/2390, British breweries holding rights in more than 2 000 pubs are
required to allow the managers of those establishments the possibility of buying a beer from another brewery, on condition,
according to Article 7(2)(a) of the order, that it is conditioned in a cask and has an alcohol content exceeding 1.2% by volume.
That provision is commonly known as the “Guest Beer Provision” (“the GBP”).

18      However, most beers produced outside the United Kingdom cannot be regarded as “cask-conditioned beers”, within the meaning
of the GBP, and thus do not fall within its scope.

19      Considering that the GBP constituted a measure having equivalent effect to a quantitative restriction on imports, and was
thus incompatible with Article 30 of the EC Treaty (now, after amendment, Article 28 EC), [Bavarian Lager] lodged a complaint
with the Commission by letter of 3 April 1993, registered under reference P/93/4490/UK.

20      Following its investigation, the Commission decided, on 12 April 1995, to institute proceedings against the United Kingdom
of Great Britain and Northern Ireland under Article 169 of the EC Treaty (now Article 226 EC). It notified the applicant on
28 September 1995 of that investigation and of the fact that it had sent a letter of formal notice to the United Kingdom on
15 September 1995. On 26 June 1996, the Commission decided to send a reasoned opinion to the United Kingdom and, on 5 August
1996, issued a press release announcing that decision.

21      On 11 October 1996, ... [the meeting of 11 October 1996 was held] which was attended by officers of the Directorate-General
(DG) for the Internal Market and Financial Services, officials of the United Kingdom Government Department of Trade and Industry
and representatives of the Confederation des Brasseurs du Marche Commun (“CBMC”). [Bavarian Lager] had requested the right
to attend the meeting [of 11 October 1996] in a letter dated 27 August 1996, but the Commission refused to grant permission
to attend.

22      On 15 March 1997 the Department of Trade and Industry in the United Kingdom announced a proposal to amend the GBP under which
a bottle-conditioned beer could be sold as a guest beer, as well as cask-conditioned beer. After the Commission had, on two
occasions, namely 19 March 1997 and 26 June 1997, suspended its decision to issue a reasoned opinion to the United Kingdom,
the head of Unit 2 “Application of Articles 30 to 36 of the EC Treaty (notification, complaints, infringements etc.) and removal
of trade barriers” of Directorate B “Free movement of goods and public procurement” of DG “Internal Market and Financial Services”,
in a letter of 21 April 1997, informed [Bavarian Lager] that, in view of the proposed amendment of the GBP, the Article 169
procedure had been suspended and the reasoned opinion had not been served on the United Kingdom Government. He indicated that
the procedure would be discontinued entirely as soon as the amended GBP came into force. The new version of the GBP became
applicable on 22 August 1997. Consequently, the reasoned opinion was never sent to the United Kingdom and the Commission finally
decided on 10 December 1997 to take no further action in the infringement procedure.

23      By fax of 21 March 1997, [Bavarian Lager] asked the Director-General of DG “Internal Market and Financial Services” for a
copy of the “reasoned opinion”, in accordance with the Code of Conduct [concerning public access to Council and Commission
documents (OJ 1993 L 340, p. 41)]. That request, despite being repeated, was refused.

24      By [decision] of 18 September 1997 ..., the Secretary-General of the Commission confirmed the refusal of the application sent
to DG “Internal Market and Financial Services”.

25      [Bavarian Lager] brought an action, registered as Case T‐309/97, before the [General Court] against the decision of 18 September
1997. In its judgment of 14 October 1999 in Case T‐309/97 *Bavarian Lager* v *Commission* [1999] ECR II‐3217, the [General Court] dismissed the action, stating that the preservation of the aim in question, namely
allowing a Member State to comply voluntarily with the requirements of the Treaty, or, where necessary, to give it the opportunity
to justify its position, justified, for the protection of the public interest, the refusal of access to a preparatory document
relating to the investigation stage of the procedure under Article 169 of the Treaty ...

26      On 4 May 1998, [Bavarian Lager] addressed a request to the Commission under the Code of Conduct for access to all of the submissions
made under file reference P/93/4490/UK by 11 named companies and organisations and by three defined categories of person or
company. The Commission refused the initial application on the ground that the [said] Code of Conduct applies only to documents
of which the Commission is the author. The confirmatory application was rejected on the grounds that the Commission was not
the author of the document in question and that any application had to be sent to the author.

27      On 8 July 1998, [Bavarian Lager] complained to the European Ombudsman under reference 713/98/IJH, stating, by letter dated
2 February 1999, that it wished to obtain the names of the delegates of the CBMC who had attended the meeting on 11 October
1996 and the names of the companies and any persons who fell into one of the 14 categories identified in the original request
for access to documents containing the communications to the Commission under file reference P/93/4490/UK.

28      Following an exchange of letters between the Ombudsman and the Commission, the latter indicated to the Ombudsman in October
and November 1999 that, of the 45 letters that it had written to the persons concerned requesting approval to disclose their
identities to [Bavarian Lager], 20 replies had been received, of which 14 were positive and 6 were negative. The Commission
supplied the names and addresses of those that had responded positively. [Bavarian Lager] stated to the Ombudsman that the
information provided by the Commission was still incomplete.

...

34      By e-mail of 5 December 2003, [Bavarian Lager] sent a request to the Commission for access to the documents referred to in
paragraph 26 above, based on Regulation No 1049/2001.

35      The Commission replied to that request by letter of 27 January 2004 stating that certain documents relating to the meeting
[of 11 October 1996] could be disclosed, but drawing [Bavarian Lager’s] attention to the fact that five names had been blanked
out from the minutes of the meeting of 11 October 1996, following two express refusals by persons to consent to the disclosure
of their identity and the Commission’s failure to contact the remaining three attendees.

36      By e-mail of 9 February 2004, [Bavarian Lager] made a confirmatory application within the meaning of Article 7(2) of Regulation
No 1049/2001, in which it requested the full minutes of the meeting of 11 October 1996, including all of the names.

37      By [the contested decision], the Commission rejected the confirmatory application of [Bavarian Lager]. It confirmed that Regulation
No 45/2001 applied to the request for disclosure of the names of the other participants. As [Bavarian Lager] had not established
an express and legitimate purpose or need for such a disclosure, the conditions set out by Article 8 of that regulation had
not been met and the exception provided for in Article 4(1)(b) of Regulation No 1049/2001 applied. It added that, even if
the rules on the protection of personal data did not apply, it would nevertheless have had to refuse to disclose the other
names under Article 4(2), third indent, of Regulation No 1049/2001 so as not to compromise its ability to conduct inquiries.’

**Procedure before the General Court and the judgment under appeal**

20      By the judgment under appeal, the General Court annulled the contested decision.

21      Regarding access to the full minutes of the meeting of 11 October 1996, the General Court took the view, in paragraphs 90
to 95 of the judgment under appeal, that Bavarian Lager’s request was based on Regulation No 1049/2001. Whilst pointing out
that, according to Article 6(1) of Regulation No 1049/2001, a person requesting access is not required to justify his request
and therefore does not have to demonstrate any interest in having access to the documents requested, the Court examined the
exception to communication laid down in Article 4(1)(b) of that regulation, where disclosure of such a document might undermine
the protection of privacy and the integrity of the individual.

22      In paragraphs 96 to 119 of the judgment under appeal, the General Court examined the relationship between Regulations Nos
45/2001 and 1049/2001. While stating that recital 15 of Regulation No 45/2001 indicates that access to documents, including
those containing personal data, is governed by Article 255 EC, the Court emphasised that, according to recital 11 of Regulation
No 1049/2001, in assessing the need for an exception, the institutions should take account of the principles in Community
legislation concerning the protection of personal data in all areas of activity of the Union, thus including principles laid
down in Regulation No 45/2001.

23      Referring to the definitions of ‘personal data’ and ‘processing of personal data’ mentioned in Article 2(a) and (b) of Regulation
No 45/2001, in paragraph 105 of the judgment under appeal, the General Court concluded that communication of data, by transmission,
dissemination or otherwise making available, falls within the definition of ‘processing’, and thus Regulation No 45/2001 itself
provides, independently of Regulation No 1049/2001, for the possibility of making certain personal data public.

24      In paragraph 106 of the judgment under appeal, the General Court stated that the processing of personal data must be lawful
under Article 5(a) or (b) of Regulation No 45/2001, according to which the processing must be necessary for the performance
of a task carried out in the public interest or for compliance with a legal obligation to which the controller is subject.
The Court then pointed out that the right of access to documents of the institutions recognised to citizens of the European
Union and to any natural or legal person residing in or having its registered office in a Member State, laid down by Article 2
of Regulation No 1049/2001, constitutes a legal obligation for the purposes of Article 5(b) of Regulation No 45/2001. Therefore,
if Regulation No 1049/2001 requires the communication of data, which constitutes ‘processing’ within the meaning of Article 2(b)
of Regulation No 45/2001, Article 5 of that same regulation makes such communication lawful in that respect.

25      Ruling on the question of the obligation to prove the need to transfer, laid down by Article 8(b) of Regulation No 45/2001,
and of the data subject’s right to object pursuant to Article 18 of that regulation, the General Court held, in particular,
in paragraphs 107 to 109 of the judgment under appeal, as follows:

107      As regards the obligation to prove the need to transfer, laid down by Article 8(b) of Regulation No 45/2001, it should be
remembered that access to documents containing personal data falls within the application of Regulation No 1049/2001, and
that, according to Article 6(1) of the latter, a person requesting access is not required to justify his request and therefore
does not have to demonstrate any interest in having access to the documents requested ... Therefore, where personal data are
transferred in order to give effect to Article 2 of Regulation No 1049/2001, laying down the right of access to documents
for all citizens of the Union, the situation falls within the application of that regulation and, therefore, the applicant
does not need to prove the necessity of disclosure for the purposes of Article 8(b) of Regulation No 45/2001. If one were
to require the applicant to demonstrate the necessity of having the data transferred, as an additional condition imposed in
Regulation No 45/2001, that requirement would be contrary to the objective of Regulation No 1049/2001, namely the widest possible
public access to documents held by the institutions.

108      Moreover, given that access to a document will be refused under Article 4(1)(b) of Regulation No 1049/2001 where disclosure
would undermine protection of the privacy and the integrity of the individual, a transfer that does not fall under that exception
cannot, in principle, prejudice the legitimate interests of the person concerned within the meaning of Article 8(b) of Regulation
No 45/2001.

109      As regards the data subject’s right to object, Article 18 of Regulation No 45/2001 provides that that person has the right
to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of
data relating to him or her, except in cases covered by, in particular, Article 5(b) of that regulation. Therefore, given
that the processing envisaged by Regulation No 1049/2001 constitutes a legal obligation for the purposes of Article 5(b) of
Regulation No 45/2001, the data subject does not, in principle, have a right to object. However, since Article 4(1)(b) of
Regulation No 1049/2001 lays down an exception to that legal obligation, it is necessary to take into account, on that basis,
the impact of the disclosure of data concerning the data subject.’

26      Finally, the General Court held that the exception under Article 4(1)(b) of Regulation No 1049/2001 had to be interpreted
restrictively and concerned only personal data that were capable of actually and specifically undermining the protection of
privacy and the integrity of the individual. Examination as to whether a person’s private life might be undermined had to
be carried out in the light of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms,
signed in Rome on 4 November 1950 (‘the ECHR’) and the case-law based thereon.

27      The Court concluded generally in paragraph 133, and specifically in paragraph 139 of the judgment under appeal, that the Commission
had erred in law by holding that Bavarian Lager had not established either an express and legitimate purpose or any need to
obtain the names of the five persons who participated in the meeting of 11 October 1996 and who, after that meeting, objected
to communication of their identity to Bavarian Lager.

28      As regards the exception concerning protection of the purpose of inspections, investigations and audits laid down in Article
4(2), third indent, of Regulation No 1049/2001, the General Court found in general that that provision could not be applied
to the present case, and, in particular, it held that confidential treatment could not be granted to persons other than the
complainant and that that protection was justified only if the procedure in question was still in progress.

**Procedure before the Court and forms of order sought**

29      By order of the President of the Court of Justice of 13 June 2008, the United Kingdom of Great Britain and Northern Ireland
and the Council of the European Union were granted leave to intervene in support of the Commission. The Republic of Finland
and the Kingdom of Sweden were granted leave to intervene in support of Bavarian Lager, and the Kingdom of Denmark was granted
leave to intervene in support of Bavarian Lager and the European Data Protection Supervisor.

30      The Commission claims that the Court should:

–        set aside the judgment under appeal, in so far as it annuls the contested decision;

–        give a final ruling on the questions which form the subject-matter of the present appeal; and

–        order Bavarian Lager to pay the costs incurred by it at first instance and in the current appeal, or, should it be unsuccessful,
order it to pay half the costs incurred by Bavarian Lager at first instance.

31      The Council contends that the Court should:

–        set aside the judgment under appeal, and

–        order Bavarian Lager to pay the costs.

32      The United Kingdom contends that the Court should:

–        uphold the appeal by the Commission and grant the forms of order sought by the latter.

33      Bavarian Lager contends that the Court should:

–        dismiss the Commission’s appeal in its entirety, and

–        order the Commission to pay the costs incurred by Bavarian Lager at first instance and in the present appeal, or, should the
appeal be upheld, order each of the parties to bear its own costs.

34      The Kingdom of Denmark, the Republic of Finland, the Kingdom of Sweden and the European Data Protection Supervisor contend
that the Court should:

–        dismiss the appeal in its entirety.

**The application for reopening of the oral procedure**

35      By letters of 11 and 13 November 2009, the Commission and the European Data Protection Supervisor applied for the reopening
of the oral procedure.

36      The Court may of its own motion, or on a proposal from the Advocate General, or at the request of the parties, order the reopening
of the oral procedure in accordance with Article 61 of the Rules of Procedure if it considers that it lacks sufficient information,
or that the case must be dealt with on the basis of an argument which has not been debated between the parties (Case C‐42/07
*Liga Portuguesa de Futebol Profissional and Bwin International* [2009] ECR I-0000, paragraph 31 and case-law cited).

37      In their applications, the Commission and the European Data Protection Supervisor restrict themselves to claiming that the
Advocate General’s Opinion was based on arguments that were not debated either before the General Court or before the Court
of Justice.

38      The Court considers that it has all the material necessary for it to decide the dispute before it and that the case does not
have to be examined in the light of an argument that has not been the subject of discussion before it.

39      Therefore, there is no need to reopen the oral procedure.

**The appeal**

40      In support of its appeal, the Commission puts forward three grounds, namely:

–        the General Court, by declaring that Article 8(b) of Regulation No 45/2001 was not applicable to this case, misinterpreted
and misapplied Article 4(1)(b) of Regulation No 1049/2001;

–        by interpreting restrictively the condition in Article 4(1)(b) of Regulation No 1049/2001, the General Court erred in law
by excluding from its scope the Community legislation on protection of personal data contained in a document; and

–        as regards the interpretation of Article 4(2), third indent, of Regulation No 1049/2001, the General Court wrongly limited
the protection of confidentiality of investigations to complainants only, and, for that confidentiality to be maintained,
required that the investigation be still current.

*Findings of the Court*

41      Since the first two pleas largely overlap, it will be convenient to examine them together.

42      The Commission, supported by the United Kingdom and the Council, argues in essence that the General Court made errors of law
in its findings concerning the application of the exemption in Article 4(1)(b) of Regulation No 1049/2001 and thereby rendered
certain provisions of Regulation No 45/2001 ineffective.

43      The Commission considers that the General Court ruled without reference to the second part of the sentence in Article 4(1)(b)
of Regulation No 1049/2001, which provides that institutions are to refuse access to a document where disclosure would undermine
the protection of privacy and the integrity of the individual, ‘in particular in accordance with Community legislation regarding
the protection of personal data’. The General Court interpreted the exception laid down in Article 4(1)(b) of Regulation No
1049/2001 only in the light of Article 8 of the ECHR and the case-law based thereon.

44      That erroneous interpretation of the exception laid down by the said Article 4(1)(b) had the consequence of rendering ineffective
several provisions of Regulation No 45/2001, and in particular Articles 8(b) and 18(a) of that regulation.

45      It is precisely, the Commission argues, by giving precedence to Article 6(1) of Regulation No 1049/2001, which provides that,
in the context of requests from the public for access to documents, the applicant is not obliged to state reasons for the
application, that the General Court renders ineffective Article 8(b) of Regulation No 45/2001, which requires the recipient
of a transfer of personal data to demonstrate the need for their disclosure.

46      The obligation on a recipient of a transfer of personal data to demonstrate that a legitimate purpose is being pursued, contained
in Article 8(b) of Regulation 45/2001 is, the Commission submits, one of the key provisions of the whole of the Union legislation
concerning data protection. Thus, communication of personal data appearing in a document held by an institution constitutes
not only public access to a document under Regulation No 1049/2001, but also a processing of personal data under Regulation
No 45/2001, which the General Court did not take into account.

47      The Commission adds that the General Court, in holding that any request for personal data must comply with the legal obligation
arising from the right of public access, within the meaning of Article 5(b) of Regulation No 45/2001, renders devoid of purpose
Article 18(a) of that regulation, which confers on the data subject the right to object at any time, on compelling legitimate
grounds relating to his or her particular situation, to the processing of data relating to him or her.

48      It should be noted that the General Court devotes a significant part of its reasoning, and in particular paragraphs 96 to
119 of the judgment under appeal, to the relationship between Regulations Nos 45/2001 and 1049/2001 and then applies, in paragraphs
121 to 139 of that judgment, the criteria which it inferred therefrom to this case.

49      As the General Court rightly states in paragraph 98 of the judgment under appeal, when examining the relationship between
Regulations Nos 1049/2001 and 45/2001 for the purpose of applying the exception under Article 4(1)(b) of Regulation No 1049/2001
to the case in point, it must be borne in mind that those regulations have different objectives. The first is designed to
ensure the greatest possible transparency of the decision-making process of the public authorities and the information on
which they base their decisions. It is thus designed to facilitate as far as possible the exercise of the right of access
to documents, and to promote good administrative practices. The second is designed to ensure the protection of the freedoms
and fundamental rights of individuals, particularly their private life, in the handling of personal data.

50      As stated in recital 2 of Regulation No 45/2001, the Union legislature intended to establish a ‘fully-fledged system’ of protection
of personal data, and considered it necessary, in the words of recital 12 thereof, to ensure throughout the Community ‘consistent
and homogeneous application of the rules for the protection of individuals’ fundamental rights and freedoms with regard to
the processing of personal data’.

51      According to that same recital 12, the rights conferred on data subjects for their protection with regard to the processing
of personal data constitute rules for the protection of fundamental rights and freedoms. In the mind of the Union legislature,
the Union legislation on the processing of personal data serves to protect fundamental rights and freedoms.

52      According to recitals 7 and 14 of Regulation No 45/2001, the measures in question are ‘binding measures’ which apply to ‘all
processing of personal data by all Community institutions and bodies’ and ‘in any context whatsoever’.

53      As indicated in recital 1 thereof, Regulation No 1049/2001 forms part of the intention expressed in the second paragraph of
Article 1 EU to mark a new stage in the process of creating an ever closer union among the peoples of Europe, in which decisions
are taken as openly as possible and as closely as possible to the citizen.

54      According to recital 2 of that regulation, openness enables citizens to participate more closely in the decision-making process
and guarantees that the administration enjoys greater legitimacy and is more effective and more accountable to the citizen
in a democratic system.

55      Regulation No 1049/2001 lays down as a general rule that the public may have access to the documents of the institutions,
but provides for exceptions by reason of certain public and private interests. In particular, recital 11 of that regulation
states that, ‘[i]n assessing the exceptions, the institutions should take account of the principles in Community legislation
concerning the protection of personal data, in all areas of Union activities’.

56      Regulations Nos 45/2001 and 1049/2001 were adopted on dates very close to each other. They do not contain any provisions granting
one regulation primacy over the other. In principle, their full application should be ensured.

57      The only express link between those two regulations is established in Article 4(1)(b) of Regulation No 1049/2001, which provides
for an exception to access to a document where disclosure would undermine the protection of privacy and the integrity of the
individual, in particular in accordance with Community legislation regarding the protection of personal data.

58      In this case, in paragraphs 111 to 120 of the judgment under appeal, the General Court limits the application of the exception
under Article 4(1)(b) of that regulation to situations in which privacy or the integrity of the individual would be infringed
for the purposes of Article 8 of the ECHR and the case-law of the European Court of Human Rights, without taking into account
the legislation of the Union concerning the protection of personal data, particularly Regulation No 45/2001.

59      It should be observed that, in acting in that way, the General Court disregards the wording of Article 4(1)(b) of Regulation
No 1049/2001, which is an indivisible provision and requires that any undermining of privacy and the integrity of the individual
must always be examined and assessed in conformity with the legislation of the Union concerning the protection of personal
data, and in particular with Regulation No 45/2001.

60      Article 4(1)(b) of Regulation No 1049/2001 establishes a specific and reinforced system of protection of a person whose personal
data could, in certain cases, be communicated to the public.

61      According to Article 1(1) of Regulation No 45/2001, the purpose of that regulation is to ‘protect the fundamental rights and
freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data’. That
provision does not allow cases of processing of personal data to be separated into two categories, namely a category in which
that treatment is examined solely on the basis of Article 8 of the ECHR and the case-law of the European Court of Human Rights
relating to that article and another category in which that processing is subject to the provisions of Regulation No 45/2001.

62      It is clear from the first sentence of recital 15 of Regulation No 45/2001 that the Union legislature has pointed to the need
to apply Article 6 EU and, by that means, Article 8 of the ECHR, ‘[w]here such processing is carried out by Community institutions
or bodies in the exercise of activities falling outside the scope of this Regulation, in particular those laid down in Titles
V and VI of the [EU Treaty in its version prior to the Treaty of Lisbon]’. By contrast, such a reference was not found necessary
for processing carried out in the exercise of activities within the scope of that regulation, given that, in such cases, it
is clearly Regulation No 45/2001 itself which applies.

63      It follows that, where a request based on Regulation No 1049/2001 seeks to obtain access to documents including personal data,
the provisions of Regulation No 45/2001 become applicable in their entirety, including Articles 8 and 18 thereof.

64      By not taking account of the reference in Article 4(1)(b) of Regulation No 1049/2001 to the legislation of the Union concerning
the protection of personal data and thus to Regulation No 45/2001, the General Court dismissed at the outset, in paragraph
107 of the judgment under appeal, the application of Article 8(b) of Regulation No 45/2001, and, in paragraph 109 of the judgment
under appeal, the application of Article 18 of Regulation No 45/2001. And yet those articles constitute essential provisions
of the system of protection established by Regulation No 45/2001.

65      Consequently, the particular and restrictive interpretation which the General Court gave to Article 4(1)(b) of Regulation
No 1049/2001 does not correspond to the equilibrium which the Union legislature intended to establish between the two regulations
in question.

66      In this case, it is apparent from the information on the file, and in particular from the contested decision, that, following
the requests by Bavarian Lager of 4 May 1998, 5 December 2003 and 9 February 2004, the Commission sent the latter a document
containing the minutes of the meeting of 11 October 1996, with five names removed. Of those five names, three persons could
not be contacted by the Commission in order to give their consent, and two others expressly objected to the disclosure of
their identity.

67      In refusing full access to that document, the Commission based its reasoning on Article 4(1)(b) of Regulation No 1049/2001
and Article 8 of Regulation No 45/2001.

68      It should be noted that, in paragraph 104 of the judgment under appeal, the General Court, in examining Article 2(a) of Regulation
No 45/2001, that is to say the definition of the concept of ‘personal data’, correctly held that surnames and forenames may
be regarded as personal data.

69      It also correctly established, in paragraph 105 of that judgment, in examining Article 2(b) of that regulation, that is to
say the definition of the concept of ‘processing of personal data’, that the communication of such data falls within the definition
of ‘processing’, for the purposes of that regulation.

70      The General Court was right to conclude, in paragraph 122 of the judgment under appeal, that the list of participants in the
meeting of 11 October 1996 appearing in the minutes of that meeting thus contains personal data for the purposes of Article 2(a)
of Regulation No 45/2001, since the persons who participated in that meeting can be identified.

71      Therefore, the decisive question is whether the Commission could grant access to the document including the five names of
the participants in the meeting of 11 October 1996, in compliance with Article 4(1)(b) of Regulation No 1049/2001 and Regulation
No 45/2001.

72      First of all, it should be noted that Bavarian Lager was able to have access to all the information concerning the meeting
of 11 October 1996, including the opinions which those contributing expressed in their professional capacity.

73      The Commission, at the time of the first request by Bavarian Lager dated 4 May 1998, sought the agreement of the participants
at the meeting of 11 October 1996 to the disclosure of their names. As the Commission indicates in the decision of 18 March
2003, that procedure was in compliance with the requirements of Directive 95/46, in force at that time.

74      Following a new request by Bavarian Lager to the Commission, dated 5 December 2003, seeking communication of the full minutes
of the meeting of 11 October 1996, the Commission informed Bavarian Lager on 27 January 2004 that, having regard to the entry
into force of Regulations Nos 45/2001 and 1049/2001, it was henceforward obliged to treat that request under the specific
regime of those regulations, particularly Article 8(b) of Regulation No 45/2001.

75      Whether under the former system of Directive 95/46 or under the system of Regulations Nos 45/2001 and 1049/2001, the Commission
was right to verify whether the data subjects had given their consent to the disclosure of personal data concerning them.

76      This Court finds that, by releasing the expurgated version of the minutes of the meeting of 11 October 1996 with the names
of five participants removed therefrom, the Commission did not infringe the provisions of Regulation No 1049/2001 and sufficiently
complied with its duty of openness.

77      By requiring that, in respect of the five persons who had not given their express consent, Bavarian Lager establish the necessity
for those personal data to be transferred, the Commission complied with the provisions of Article 8(b) of Regulation No 45/2001.

78      As Bavarian Lager has not provided any express and legitimate justification or any convincing argument in order to demonstrate
the necessity for those personal data to be transferred, the Commission has not been able to weigh up the various interests
of the parties concerned. Nor was it able to verify whether there was any reason to assume that the data subjects’ legitimate
interests might be prejudiced, as required by Article 8(b) of Regulation No 45/2001.

79      It follows from the above that the Commission was right to reject the application for access to the full minutes of the meeting
of 11 October 1996.

80      Therefore, the General Court erred in law in concluding, in paragraphs 133 and 139 of the judgment under appeal, that in this
case the Commission had wrongly applied Article 4(1)(b) of Regulation No 1049/2001 and held that Bavarian Lager had not established
either an express and legitimate purpose in obtaining, or any need to obtain, the document at issue in its entirety.

81      In the light of those considerations as a whole, it is appropriate, without there being any need to examine the other arguments
and pleas of the parties, to set aside the judgment under appeal in so far as it annuls the contested decision.

**The consequences of the judgment under appeal being set aside**

82      In accordance with the first paragraph of Article 61 of the Statute of the Court of Justice, if the Court quashes the decision
of the General Court, it may itself give final judgment in the matter, where the state of the proceedings so permits.

83      That is the case here.

84      As the Court has found in paragraphs 69 and 73 of this judgment, the contested decision did not infringe the provisions of
Regulations Nos 45/2001 and 1049/2001.

85      The action for annulment by Bavarian Lager against that decision must therefore be dismissed.

**Costs**

86      Pursuant to the first paragraph of Article 122 of the Rules of Procedure, where the appeal is well founded and the Court of
Justice itself gives final judgment in the case, the Court is to make a decision as to costs. Under Article 69(2) of those
rules, which applies to appeal proceedings by virtue of Article 118 thereof, the unsuccessful party is to be ordered to pay
the costs, if they have been applied for in the successful party’s pleadings. Under Article 69(4) of those rules, which applies
to appeal proceedings by virtue of Article 118 thereof, Member States and institutions which intervene in the proceedings
are to bear their own costs. The Court may order an intervener to bear its own costs.

87      Since the Commission has applied for costs and Bavarian Lager has been unsuccessful in the appeal, Bavarian Lager must be
ordered to pay the costs relating to the appeal.

88      Since the Commission has also applied for an order that Bavarian Lager pay the costs of the procedure before the General Court
and the action before that Court has been dismissed, Bavarian Lager must be ordered to pay the costs relating to the procedure
at first instance.

89      The Kingdom of Denmark, the Republic of Finland, the Kingdom of Sweden, the United Kingdom, the Council and the European Data
Protection Supervisor must be ordered to bear their own costs.

On those grounds, the Court (Grand Chamber) hereby:

1.      **Sets aside the judgment of the Court of First Instance of the European Communities of 8 November 2007 in Case T-194/04 Bavarian Lager v Commission , in so far as it annuls the Commission’s decision of 18 March 2004, rejecting an application for access to the full minutes
of the meeting of 11 October 1996, including all the names, and in so far as it orders the European Commission to pay the
costs of The Bavarian Lager Co. Ltd;**

2.      **Dismisses the action of The Bavarian Lager Co. Ltd against the Commission’s decision of 18 March 2004, rejecting an application
for access to the full minutes of the meeting of 11 October 1996, including all the names;**

3.      **Orders The Bavarian Lager Co. Ltd to pay the costs incurred by the European Commission both in the context of the present
appeal proceedings and before the Court of First Instance;**

4.      **Orders the Kingdom of Denmark, the Republic of Finland, the Kingdom of Sweden, the United Kingdom of Great Britain and Northern
Ireland, the Council of the European Union and the European Data Protection Supervisor to bear their own costs.**

[Signatures]

---

- Language of the case: English.