EN Official Journal of the European Union C 2/7

Opinion of the European Data Protection Supervisor on the Proposal for a Regulation of the European Parliament and of the Council regarding public access to European Parliament, Council and Commission documents

(2009/C 2/03)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), and in particular its Article 41,

Having regard to the request for an opinion in accordance with Article 28(2) of Regulation (EC) No 45/2001 received on 15 May 2008 from the European Commission,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

The proposal

1. On 30 April 2008, the Commission adopted a Proposal for a Regulation of the European Parliament and of the Council regarding public access to European Parliament, Council and Commission documents (hereinafter: ‘the proposal’) (3). The proposal was sent by the Commission to the EDPS for consultation, in accordance with Article 28(2) of Regulation (EC) No 45/2001 and was received by the EDPS on 15 May 2008.

2. The aim of the proposal is to make a number of substantive changes to Regulation (EC) No 1049/2001 of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (4). In its Explanatory Memorandum, the Commission gives reasons for reviewing the existing Regulation. It mentions the ‘European Transparency Initiative’ (5) which calls for more transparency, the Regulation applying the Århus Convention (6) to the institutions and bodies of the European Community, which interacts with Regulation (EC) No 1049/2001 as regards access to documents containing environmental information, as well as the case law of the Court of Justice and complaints settled by the European Ombudsman, relating to Regulation (EC) No 1049/2001.

Consultation of the EDPS

3. The EDPS welcomes that he is consulted and recommends that reference to this consultation be made in the recitals of the proposal, in a similar way as included in a number of other legislative texts on which the EDPS has been consulted, in accordance with Regulation (EC) No 45/2001.

4. The attention of the EDPS has in particular been triggered by the fact that the proposal contains a provision dealing with the delicate relation between access to documents and the rights to privacy and to the protection of personal data, namely the proposed Article 4(5). The analysis of this provision will be the central part of this opinion.

5. However, the opinion will not be limited to this analysis. The analysis will be preceded by observations on the context of the proposal and its scope. After the analysis of Article 4(5), other issues will be addressed, such as the right of access to personal data under Regulation (EC) No 45/2001.

II. CONTEXT AND SCOPE OF THE PROPOSAL

The context

6. The proposal was preceded by a public consultation. In the Explanatory Memorandum, the Commission mentions that it has taken into account the views of the majority of the respondents in this public consultation.

7. After the adoption of the proposal, on 2 June 2008, a public hearing took place in the European Parliament, organised by the LIBE-Committee. This was the occasion for a number of stakeholders to express an opinion on the proposal. The EDPS also made some provisional comments. On that occasion, the representatives of the European Commission — in a reaction to the different comments — emphasised that the proposal reflected the current state of thinking, but that the Commission was open to discuss the text and consider input for the improvement of the proposal, not excluding alternatives.

8. The EDPS sees this open approach as an opportunity and envisages enriching the discussion with an alternative text for the proposed Article 4(5). Moreover, such an open approach perfectly fits in the notion of transparency: promoting good governance and ensuring participation of civil society (see for instance Article 15(1)) of the Treaty on the Functioning of the European Union).

9. Despite the uncertainty about the fate of the Lisbon Treaty at the moment of issuing this opinion, the perspective of the legal framework under the new Treaty should not be ignored.

10. The proposal is based on Article 255 of the EC Treaty that grants a right of access to European Parliament, Council and Commission documents. When the Lisbon Treaty enters into force, this Article will be replaced by Article 15 of the Treaty on the European Union. Article 15 extends the right of access to documents of all Union institutions, bodies, offices and agencies. It modifies Article 255 inter alia by introducing a general principle of openness (Article 15(1)) and by obliging the European Parliament and the Council to ensure publication of documents relating to the legislative procedures.

The scope: the notion of documents

11. The proposal applies to all documents within the definition of the proposed Article 3(a). This definition reads as follows: ‘“document” shall mean any content whatever its medium (written on paper or stored in electronic form or as a sound, visual or audiovisual recording) drawn-up by an institution and formally transmitted to one or more recipients or otherwise registered, or received by an institution; data contained in electronic storage, processing and retrieval systems are documents if they can be extracted in the form of a printout or electronic-format copy using the available tools for the exploitation of the system’.

12. The reason for fully quoting this definition is that it raises a few essential questions as to the scope of the Regulation: — the object of the right to access: is it a piece of paper (or its electronic equivalent) or does it have a broader meaning: information about the activities of EU institutions or the information held by them, disregarding the existence of a document? — what is the meaning of the limitation of the scope of application of the Regulation to documents that have been formally transmitted to one or more recipients or otherwise registered, or received by an institution? — the difference in scope between Regulation (EC) No 1049/2001 and Regulation (EC) No 45/2001.

13. The point of departure of the regulation is access to documents, not access to information as such. This is the notion as laid down in Article 255 EC. The Lisbon Treaty would not lead to a substantive change. The new Treaty just clarifies that the medium of the documents is not decisive. However, as the Court of First Instance stated in the WWF case, ‘it would be contrary to the requirement of transparency which underlies Regulation (EC) No 1049/2001 for institutions to rely on the fact that documents do not exist in order to avoid the application of that regulation’ (7). Therefore, according to the Court, the institutions concerned must, in so far as possible and in a non-arbitrary and predictable manner, draw up and retain documentation relating to their activities. Otherwise, the right of access to documents may not be exercised effectively.

14. Against this background, on the one hand the proposal explicitly includes in the concept of document ‘data contained in electronic storage, processing and retrieval systems’, when they can be extracted. The EDPS notes that this definition comes close to the definition of processing of personal data laid down in Regulation (EC) No 45/2001 and extends the possible overlap with Regulation (EC) No 1049/2001. Requests for access to mere lists of names and/or other personal data are likely to increase — also in the light of the development of the tools available to exploit electronic systems — and it is therefore even more important to address the possible areas of tension between the Regulations as well as the relations with other available instruments, such as the right of access to personal data (see below, points 64-67).

15. On the other hand, the Commission proposes that a document only ‘exists’ if it has been sent to recipients or circulated within the institution or otherwise registered. The EDPS notes that it is far from being clear to which extent this formulation would restrict the scope of application of the Regulation and would therefore run counter to the principles of openness and public participation. Unfortunately, the explanatory memorandum provides little guidance in this regard. Therefore, the EDPS suggests that the concept of ‘document’ should be clarified in the Commission proposal, in the provision itself or in a recital.

16. Without entering into a detailed analysis of possible interpretations of these crucial provisions, the EDPS points out that, in spite of the changes in the concept of ‘document’ proposed by the Commission, there is still a difference in scope between Regulation (EC) No 1049/2001 and Regulation (EC) No 45/2001. The latter Regulation only applies, according to its Article 3(2), to ‘the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system’. Regulation (EC) No 1049/2001 applies to all documents held by an institution.

17. Although the manual processing of personal data becomes less important, it is necessary to consider that within the institutions and bodies of the European Union paper files are still used. If such paper files do not have a structured nature, they may not be fully covered by Regulation (EC) No 45/2001. However, such documents may contain personal data and it must be ensured that also in those cases the exception of Article 4(5) can be applied.

18. This difference in scope should be duly taken into account in order to ensure that the legitimate interest of the data subject is considered also in case of paper files. This is an additional reason why the mere ‘referral’ to Regulation (EC) No 45/2001 — as explained below (see points 38-40) — is not satisfactory, since it would not provide guidance for those cases in which personal data contained in documents fall outside the scope of application of Regulation (EC) No 45/2001.

III. ARTICLE 4(5)

General appraisal of the provision

19. The proposed Article 4(5) deals with the relation between access to documents and the rights to privacy and the protection of personal data, and replaces the present Article 4(1)(b) that was widely criticized as being ambiguous about the precise relation between these fundamental rights. The present Article was also disputed before the Court of First Instance (8). An appeal on grounds of law is now pending before the Court of Justice (9).

20. In this perspective, there are good reasons for replacing Article 4(1)(b). The EDPS understands that the Commission used this occasion to propose a change of Article 4(1)(b). However, the EDPS does not support the proposed provision as drafted by the Commission.

21. In the first place, the EDPS is not convinced that this is the appropriate moment for change, while an appeal is pending before the Court of Justice. In this appeal fundamental issues are at stake.

22. In the second place, more importantly: the proposal does not provide the appropriate solution. It consists of a general rule (the second sentence of Article 4(5) that: — does not reflect the judgement of the Court of First Instance in Bavarian Lager, — does not do justice to the need for a right balance between the fundamental rights at stake, — is not viable since it refers to EC legislation on data protection that does not provide a clear answer when a decision on public access must be made. Moreover, it consists of a specific rule (the first sentence of Article 4(5)) that is in principle well defined, but with a scope that is far too limited.

This is not the appropriate moment for change

23. The EDPS is fully aware of the possible interactions — and possible tensions — between access to documents and the rights to privacy and the protection of personal data. In his Background Paper on public access to documents and data protection, published in July 2005, he made a careful analysis of the issues arising from the simultaneous application of Regulation (EC) No 1049/2001 and Regulation (EC) No 45/2001.

24. In particular, the EDPS highlighted that public access on the one hand and privacy and data protection on the other hand are fundamental rights which are laid down in different legal instruments at European level and represent key elements of ‘good governance’. There is no hierarchical order between these rights and in certain cases the simultaneous application of the Regulations does not lead to an obvious answer. According to the EDPS background paper, the solution can be found in the privacy exception laid down by the present Article 4(1)(b) of Regulation (EC) No 1049/2001. As the background paper explains, this provision imposes three conditions, all of which have to be fulfilled for the exception to public access to apply: — the privacy of the data subject must be at stake, — public access must substantially affect the data subject, — public access is not allowed by the data protection legislation.

25. The main lines of the EDPS analysis were confirmed by the Court of First Instance in the Bavarian Lager case, in which the Court of First Instance was called to interpret the relationship between Regulation (EC) No 45/2001 and Regulation (EC) No 1049/2001, and the exception regarding the protection of personal data contained in the latter Regulation. The main elements of this judgement will be used to substantiate the present opinion. The Commission decided to lodge an appeal against the judgement of the CFI; the case is now pending before the Court of Justice. In this case before the Court of Justice, the EDPS takes the position that the judgement of the CFI should be upheld.

26. It is therefore questionable whether this is the appropriate moment to amend the provision on the relation between access to documents and protection of personal data, now that the case is pending before the Court of Justice. This case is not only about the interpretation of the present wording of Article 4(1)(b) (10) but also raises more fundamental questions relating to the balance between the fundamental rights at stake (11). Under those circumstances, it would be better to wait for the judgement and not adopt the Regulation before.

The amendment does not reflect the judgement of the Court of First Instance

27. The preference to wait for the judgement of the Court of Justice is also motivated by the substance of the proposed provision. The Commission claims, in its explanatory memorandum, that the proposed amendments are also aimed at addressing the judgement of the CFI in the Bavarian Lager case. However, the amendment does not reflect the position of the CFI.

28. In particular, the EDPS notes that the Commission proposal deletes any reference to the harm to ‘the privacy and the integrity’ of the individual as a necessary threshold to justify a refusal to access documents containing personal data. In this way, the Commission proposal strongly alters the balance so far reached by the legislator, as interpreted by the CFI. The proposal shifts the focus of access to documents containing personal data from Regulation (EC) No 1049/2001 to Regulation (EC) No 45/2001.

29. It is important, at least as long as the judgement of the CFI remains the point of reference in this delicate area, that the proposed amendments genuinely take into account this judgement and do not substantially depart from it. The judgement of the Court of First Instance not only gives an interpretation of some relevant provisions of both Regulation (EC) No 1049/2001 and Regulation (EC) No 45/2001, but it also strikes a right balance between the rights protected by these two Regulations. The EDPS underlines the importance for the legislator to preserve this balance, while possibly clarifying the relevant provisions.

30. In the following paragraphs of this opinion, the EDPS will further clarify why — contrary to the point of view expressed by the Commission — the proposed Article 4(5) does not reflect the case law of the Court.

The second sentence of Article 4(5) does not do justice to the need for a right balance

31. The second sentence of Article 4(5) states: ‘Other personal data shall be disclosed in accordance with the conditions regarding lawful processing of such data laid down in EC legislation on the protection of individuals with regard to the processing of personal data’.

32. This provision implies that the authority deciding on a request for public access needs to base its decision not on Regulation (EC) No 1049/2001, but on Regulation (EC) No 45/2001. The provision thus contains the so called ‘referral theory’ (12) as defended by the Commission before the Court of First Instance in Bavarian Lager.

33. This theory was rejected by that Court on the basis of the present wording of Article 4(1)(b) of Regulation (EC) No 1049/2001. The Court based this rejection on this wording: disclosure can only be denied if the privacy or the integrity of a person would be undermined. However, this reasoning of the Court is not just a textual interpretation, but reflects the result of a balancing between the two fundamental rights at stake: public access and data protection.

34. This need for a right balance between these fundamental rights — or a ‘balanced approach’ as it is usually defined — has also been emphasised in a number of documents dealing with the collision between those two rights. This was for example the case in Opinion 5/2001 of the Article 29 Working Party (13) and in the EDPS Background Paper. A similar approach is also taken in the Draft Convention of the Council of Europe on Access to Official Documents, which establishes that contracting parties may limit the right of access to official documents to the aim of protecting, inter alia, ‘privacy and other legitimate private interests’ (14).

35. On the one hand, the right to public access must be respected, which means in any event that: — the purpose of Regulation (EC) No 1049/2001 should be respected. The Regulation should give the fullest possible effect to the right to public access (15). This means that, in principle, all documents of the Institutions should be accessible by the public (16). As a consequence, exceptions to the right must be construed and applied restrictively so as not to defeat the general principle enshrined in the Regulation (17), — given the nature of the right to public access, a person may not be required to justify his request and therefore does not have to demonstrate any interest in having access to the document requested (18).

36. On the other hand, the right to data protection must be respected: — the protection of personal data is laid down in a system of checks and balances which does not prohibit the processing of personal data, but subjects the processing to safeguards and guarantees. The processing of personal data is allowed if the data subject gives his unambiguous consent or if the processing is necessary for other public and private interests (Article 5 of Regulation (EC) No 45/2001), — the provisions of Regulation (EC) No 45/2001 must necessarily be interpreted in the light of fundamental rights, in particular the right to privacy (19), — the processing of personal data must therefore be in accordance with the principle of proportionality and not actually and specifically undermine a legitimate interest of the data subject.

37. Such a balance can not be guaranteed by a simple referral to Regulation (EC) No 45/2001, which ‘is designed to ensure the protection of the freedoms and fundamental rights of individuals, particularly their private life, in the handling of personal data’ (20). This solution may respect the right to data protection, but does not respect the right to public access.

The second sentence of Article 4(5) does not offer a viable solution

38. Regulation (EC) No 45/2001 does not provide a clear answer when a Community institution or body has to decide on a request for public access. In short (21), Article 5 of the Regulation allows processing of personal data if this is ‘necessary for the performance of a task carried out in the public interest’ or if this is ‘necessary for compliance with a legal obligation to which the controller is subject’. In other words, the lawfulness of the processing is not determined by the interest of data protection itself, but by the necessity of the processing for another interest (whether laid down in a legal obligation or not). This leads to the conclusion that since the necessity is not determined by Article 5 of Regulation (EC) No 45/2001 itself (nor by any other provision of this Regulation), the law designed to protect the other interest — in this case, the right to have access to documents — should give adequate guidance.

39. However, according to the proposal, all the requests for access to documents containing personal data — unless the specific provision of the first sentence of Article 4(5) applies — should be assessed on the basis of a reference to Regulation (EC) No 45/2001. Such a reference would not provide for the necessary guidance in balancing the interests. This would result in an undesirable outcome (a ‘catch-22’ situation).

40. Finally, it should be noted that the reference to Regulation (EC) No 45/2001 does not solve the incompatibility between the right to public access and the obligation to prove the need to transfer of personal data, laid down by Article 8(b) of Regulation (EC) No 45/2001. As stated by the Court of First Instance in Bavarian Lager: ‘If one were to require the applicant to demonstrate the necessity of having the data transferred, as an additional condition imposed in Regulation (EC) No 45/2001, that requirement would be contrary to the objective of Regulation (EC) No 1049/2001, namely the widest possible public access to documents held by the institutions’ (22).

The scope of the first sentence of Article 4(5) is far too limited

41. The first sentence of Article 4(5) of the proposal reads as follows: ‘Names, titles and functions of public office holders, civil servants and interest representatives in relation with their professional activities shall be disclosed unless, given the particular circumstances, disclosure would adversely affect the persons concerned’. It gives a specific rule for certain types of data, relating to a specified group of persons.

42. As a first preliminary remark, the EDPS notes that there is no doubt that the first sentence of Article 4(5) respects the right to public access. In the situations addressed by this sentence, normally public access will be given to documents. In the view of the EDPS, the provision also respects the right to data protection. It covers the situation dealt with by the Court of First Instance in Bavarian Lager, as well as comparable situations. As that Court states: in those situations, disclosure of names does not lead to an interference with the private life of the persons, nor would those persons have any ground to believe that they enjoyed confidential treatment (23).

43. As a second preliminary remark, one can state that the provision is in principle well defined and fulfils the condition of legal certainty. The provision defines the different capacities in which the persons act and limits the personal data that can be disclosed. Irrespective of the question whether these limitations are appropriate, they are clearly drafted. They also comply with Regulation (EC) No 45/2001: the disclosure of the data constitutes lawful processing — as it is based on the legal obligation laid down in Article 4(5) — and the purpose is limited, namely granting of public access.

44. As to the limitation of the scope ratione personae, certain data of public office holders, civil servants and interest representatives must be released. It seems that the provision merely aims at resolving the consequences of the Judgement of the Court of First Instance in Bavarian Lager. The question arises why the provision does not deal with a wider category of data subjects, in relation with their professional activities. The arguments supporting the presumption that in this relation personal data should normally be released, are for instance also valid in relation to: — employees in the private sector or self employed persons, not to be characterised as interest representatives, unless there is a reason to assume that disclosure would adversely affect that person, — academic researchers presenting the result of their research, — experts presenting their field of expertise in the public process, — teachers and professors in the exercise of their teaching or lecturing functions.

45. These examples suggest that it would have been useful to look for a wider provision, entailing data of different categories of persons, when acting in a professional capacity.

46. A second limitation — ratione materiae — in the first sentence of Article 4(5) of the proposal, relates to the data elements. Only names, titles and functions shall be disclosed. This excludes data which reveal elements of the private situation of the person concerned, even if those data do not qualify as sensitive data as meant in Article 10 of Regulation (EC) No 45/2001. One could think about home address, telephone and e-mail, or other data — such as salaries and expenses — relating to high ranking officials or politicians.

47. However, it also excludes data elements that have nothing to do with the private situation of the person concerned, such as the office address of the person concerned (physical and e-mail), as well as more generic information relating to the function of the person.

48. A more fundamental problem with the approach of the proposal is that a name is seldom included in a document on its own. The name is usually connected to other data relating to the person. For example, the Bavarian Lager case was about access to minutes of a meeting. One can imagine that the minutes not only mention the names of the persons present at the meeting, but also their contribution to the discussion during the meeting. This contribution could sometimes even qualify as sensitive data as meant in Article 10 of Regulation (EC) No 45/2001, for instance if a political opinion is expressed. It is doubtful therefore whether particular data could be considered in isolation.

IV. AN ALTERNATIVE SOLUTION

The need for clear guidance by the legislator

49. Regulation (EC) No 1049/2001 should itself give guidance to institutions and bodies that deal with requests for public access to documents containing personal data, whilst fully respecting the right balance between the two fundamental rights at stake.

50. According to the EDPS, a further discussion is needed about how to transpose this guidance into a specific legal provision. As the past has shown, this is an issue which includes difficult and fundamental considerations. It should be drafted as carefully as possible with input from the different stakeholders.

The alternative solution

51. As a contribution to the discussion, the EDPS proposes the following provision for public access to personal data: 1. personal data shall not be disclosed, if such disclosure would harm the privacy or the integrity of the person concerned. Such harm does not arise: (a) if the data solely relate to the professional activities of the person concerned unless, given the particular circumstances, there is a reason to assume that disclosure would adversely affect that person; (b) if the data solely relate to a public person unless, given the particular circumstances, there is a reason to assume that disclosure would adversely affect that person or other persons related to him or her; (c) if the data have already been published with the consent of the person concerned; 2. personal data shall nevertheless be disclosed, if an overriding public interest requires disclosure. In those cases, the institution or body shall have to specify the public interest. It shall give reasons why in the specific case the public interest outweighs the interests of the person concerned; 3. where an institution or body refuses access to a document on the basis of paragraph 1, it shall consider whether partial access to this document is possible.

52. This provision can be explained as follows.

53. The first part of paragraph 1 contains the basic rule and reflects the need for a right balance between the fundamental rights at stake. The exception to the right of public access shall only apply if disclosure would harm the privacy or the integrity of the person concerned. The provision refers to privacy (respect for private and family life as meant in Article 7 of the Charter of Fundamental Rights of the Union and Article 8 ECHR) and not to data protection (as meant in Article 8 of the Charter).

54. However, the right to protection of personal data — laid down in a system of checks and balances to protect the data subject, see also point 36 above — is fully taken into account. The provision specifies the legal obligation for the disclosure of the personal data, as foreseen in Article 5(b) of Regulation (EC) No 45/2001.

55. It has to be noted that Regulation (EC) No 45/2001 does not prohibit the processing of personal data, in so far as this is based on a legal ground for processing under Article 5(b) of Regulation (EC) No 45/2001. The application of such a legal ground in a specific case is to be examined in the light of Article 8 ECHR and the case law of the European Court for Human Rights. In this context reference should be made to the judgement of the Court of Justice in Österreichischer Rundfunk (24).The introduction of ‘harm the privacy or integrity of the person concerned’ in paragraph 1 of the provision specifies that it is precisely this test that decides whether public access shall be given to personal data.

56. The term integrity was also included in the present text of Article 4(1)(b) and refers to the physical integrity of a person. It can have added value for instance in cases where disclosure of personal data could lead to a threat to the physical integrity of the person without a direct relation to his or her privacy.

57. The second part of paragraph 1 of the proposed provision aims to give guidance to the institution or body deciding on a request for public access. It distinguishes three situations where the disclosure of personal data will normally not lead to any harm to the data subject. — the first situation is the one covered by the first sentence of Article 4(5) of the proposal of the Commission. It is worded in a much wider and more functional fashion, taking into account the critical observations the EDPS made on the present text. The provision recognises that also in this situation there might be a reason to assume that disclosure would adversely affect that person. In that case the Community institution or body must examine whether it is likely that this effect will occur. In other words, the presumption is access. Finally, the wording ‘a reason to assume’ (etc.) is taken from Article 8(b) of Regulation (EC) No 45/2001, — the second situation provides that an even wider access is allowed when data of public persons are involved. One could consider politicians or other persons whose functions or behaviour normally justify a wider access by the public based on its right to know. This is again subject to the restriction that the conclusion may be different in a specific case. In this situation a possible adverse effect to relatives should also be taken into account, — the third situation relates to data that are already in the public sphere, with consent of the data subject. One can for instance imagine that personal data have been published on a website or a blog.

58. Paragraph 2 recognises the fact that there can be an overriding interest requiring public access. Certain data can be indispensable for the public to develop an informed opinion on the legislative process or the functioning of the European institutions more in general. One can for instance think about the (financial) relations between an institution and certain lobby groups. Since this paragraph contains an exception to an exception, additional safeguards are included. On a case by case basis, the institution or body must specify the application of the provision.

59. Paragraph 3 obliges the institution or body to consider partial access — for instance by blanking out names in documents — as an additional instrument to ensure a right balance between the fundamental rights at stake, which should only be used if there is a ground for refusal.

60. Finally, the EDPS underlines that this solution would avoid the ‘catch-22’ situation as mentioned above in point 39.

V. SHOULD REGULATION (EC) No 45/2001 BE CHANGED?

61. It follows from the Judgement of the Court of First Instance in Bavarian Lager that the need for clarification of the relation between public access and data protection is also urgent because of the different interpretations that can be given in this context to Article 8(b) of Regulation (EC) No 45/2001. The controversy, inter alia in the Bavarian Lager case before the Court of First Instance, related to the meaning of ‘establishes the necessity of having the data transferred’ in the context of public access. If one takes this clause literally, it would mean that the applicant for a document under Regulation (EC) No 1049/2001 would have to establish a convincing reason for requiring a document, which would be contrary to one of the objectives of the public access Regulation, namely the widest possible access to documents held by institutions (25). In order to solve this problem, the Court of First Instance decided that when personal data are transferred in order to give effect to the right of access to documents, the applicant does not need to prove the necessity of disclosure. Equally, it stated that a transfer of data that does not fall under the exception of Article 4(1)(b) can not prejudice the data subject's legitimate interests (26).

62. This solution was needed in order to reconcile both Regulations in a satisfactory way, but it is challenged by the Commission in its appeal before the Court of Justice. The Commission states that ‘no provision of either Regulation (EC) No 45/2001 or Regulation (EC) No 1049/2001 requires or permits this provision (Article 8(b)) to be disabled in order to permit a norm under Regulation (EC) No 1049/2001 to have effect’ (27).

63. According the EDPS this tension could best be solved by the introduction of a recital in the amended Regulation (EC) No 1049/2001, codifying the decision of the Court of First Instance. Such a recital could read as follows: ‘Where personal data are transferred in order to give effect to the right of access to documents, the applicant does not need to prove the necessity of disclosure for the purpose of Article 8(b) of Regulation (EC) No 45/2001’.

VI. RIGHT OF ACCESS TO DOCUMENTS AND RIGHT OF ACCESS TO OWN PERSONAL DATA

64. The right of access to documents as provided for in Regulation (EC) No 1049/2001 must be differentiated from Article 13 of Regulation (EC) No 45/2001. The right of access as provided in Regulation (EC) No 1049/2001 grants a general right of access to everyone concerning documents in view of guaranteeing transparency of public bodies. Article 13 of Regulation (EC) No 45/2001 is more limited as regards the beneficiaries of the right of access, as it grants this right only to the person concerned to information relating to him/her, notably with a view of enabling data subjects to control of information relating to them. Furthermore, the right of access under Article 13 of Regulation (EC) No 45/2001 is referred to in Article 8(2) of the Charter of Fundamental Rights of the European Union.

65. Against this background, the EDPS considers that Regulation (EC) No 1049/2001 should clarify that the existence of the right of access to documents is without prejudice to the right of access to own personal data under Regulation (EC) No 45/2001.

66. Furthermore, the EDPS recommends the legislator to consider introducing in the amended Regulation an ex officio access to the data subject's own personal data. Indeed, it happens in practice that people may not be aware of the existence of the right of access to his/her own personal data, as stipulated in Article 13 of Regulation (EC) No 45/2001, and therefore they ask for access in the light of Regulation (EC) No 1049/2001. They may be refused access to the document if one of the exceptions in Regulation (EC) No 1049/2001 applies, or it may be considered that a request for specific access is not within the scope of that Regulation. In such a case, when the institution or body knows the ratio of such request for access (i.e. access to petitioner's own personal data), the institution should be obliged to provide access ex officio to the petitioner's personal data.

67. Both aspects could be clarified by introducing specific statements to the Recitals to the amended Regulation (EC) No 1049/2001, possibly in connection with Recital 11 of the existing regulation. A first recital (or part of a recital) could state that the right of access to public documents is without prejudice to the right of access to personal data under Regulation (EC) No 45/2001. A second recital (or part of a recital) could include the notion of ex officio access of an applicant to his or her own personal data. When a person requests access to data concerning him or her, the institution should on its own initiative examine whether that person is entitled to access under Regulation (EC) No 45/2001.

VII. FURTHER USE OF PERSONAL DATA CONTAINED IN PUBLIC DOCUMENTS

68. Another issue to be considered and possibly clarified in the Commission proposal is the further use of personal data contained in public documents. Indeed, when access to documents is granted, the use of personal data contained therein may be subject to the applicable rules on the protection of personal data, and in particular to Regulation (EC) No 45/2001 and to the national legislations implementing Directive 95/46/EC. Re-use, dissemination and further processing of these personal data by the applicant, by the institutions granting access or by third parties having access to the document should be carried out in the framework of the applicable data protection legislation.

69. For example, should a list of names and contact details of public officials be disclosed further to an access request, this list should not be used in order to target the concerned officials with a marketing campaign or to profile them, unless in accordance with applicable data protection legislation.

70. Therefore, it would be advisable that the legislator uses this occasion in order to highlight this relation. This approach would be consistent with the choice of the legislator in Directive 2003/98/EC of the European Parliament and of the Council of 17 November 2003 on the re-use of public sector information. Indeed, in the latter Directive full compliance with the principles relating to the protection of personal data in accordance with Directive 95/46/EC is one of the conditions that are explicitly mentioned for the re-use of public sector information (28).

71. In this perspective, the EDPS suggests introducing a recital stating that ‘when access to documents is granted, the further use of personal data contained therein is subject to the applicable rules on the protection of personal data, and in particular to the national legislations implementing Directive 95/46/EC’.

VIII. CONCLUSION

72. The attention of the EDPS has in particular been triggered by the fact that the Proposal for a Regulation of the European Parliament and of the Council regarding public access to European Parliament, Council and Commission documents contains a provision dealing with the delicate relation between access to documents and the rights to privacy and to the protection of personal data, the proposed Article 4(5). This opinion supports the reasons behind replacing the present Article 4(1)(b) by a new provision to some extent, but does not support the provision itself.

73. This provision is criticized for the following reasons: 1. the EDPS is not convinced that this is the appropriate moment for change, while an appeal is pending before the Court of Justice. Fundamental issues are at stake in this appeal; 2. the proposal does not provide the appropriate solution. It consists of a general rule (the second sentence of Article 4(5)) that: — does not reflect the judgement of the Court of First Instance in Bavarian Lager, — does not do justice to the need for a right balance between the fundamental rights at stake, — is not viable since it refers to EC legislation on data protection that does not provide a clear answer when a decision on public access must be made; 3. it consists of a specific rule (the first sentence of Article 4(5)) that is in principle well defined, but with a scope that is far too limited.

74. As a contribution to the discussion, the EDPS proposes the following exception to public access to personal data: 1. personal data shall not be disclosed, if such disclosure would harm the privacy or the integrity of the person concerned. Such harm does not arise: (a) if the data solely relate to the professional activities of the person concerned unless, given the particular circumstances, there is a reason to assume that disclosure would adversely affect that person; (b) if the data solely relate to a public person unless, given the particular circumstances, there is a reason to assume that disclosure would adversely affect that person or other persons related to him or her; (c) if the data have already been published with the consent of the person concerned; 2. personal data shall nevertheless be disclosed, if an overriding public interest requires disclosure. In those cases, the institution or body shall have to specify the public interest. It shall give reasons why in the specific case the public interest outweighs the interests of the person concerned; 3. where an institution or body refuses access to a document on the basis of paragraph 1, it shall consider whether partial access to this document is possible.

75. The opinion identifies several other points where clarifications are needed of the public access regulation, mainly in its relation to the provisions of Regulation (EC) No 45/2001. These clarifications can be given by introducing recitals or possibly legislative provisions on the following subjects: (a) the concept of a document so as to ensure the widest possible application of the public access regulation; (b) the interpretation of Article 8(b) of Regulation (EC) No 45/2001 in the context of public access so as to ensure that the applicant for public access does not need to prove the necessity of disclosure; (c) the relation between the right of access to public documents and the right of access to own personal data under Regulation (EC) No 45/2001 so as to ensure that the right of access to public documents is without prejudice to the right of access to own personal data; (d) the obligation of an institution to examine on its own initiative whether that person is entitled to access under Regulation (EC) No 45/2001, when a person requests access to data concerning him or her under the public access regulation; (e) the further use of personal data contained in public documents, in order to ensure that this further use is subject to the applicable rules on the protection of personal data.

Done at Brussels, 30 June 2008. Peter HUSTINX European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) COM(2008) 229 final.

(4) OJ L 145, 31.5.2001, p. 43.

(5) Minutes of the Commission's meeting No 1721 of 9 November 2005, item 6; see also documents SEC(2005) 1300 and SEC(2005) 1301.

(6) Regulation (EC) No 1367/2006 of the European Parliament and of the Council of 6 September 2006 on the application of the provisions of the Århus Convention to Community institutions and bodies (OJ L 264, 25.9.2006, p. 13).

(7) Judgement of 25 April 2007, WWF European Policy Programme v Council, Case T-264/04, paragraph 61.

(8) Judgement of 8 November 2007, Bavarian Lager v Commission, T-194/04. Two other still pending cases concern the same issue.

(9) Pending Case C-28/08 P, Commission v Bavarian Lager, OJ C 79, p. 21.

(10) It is clear that it is within the discretion of the legislator to change a text of a legislative instrument. The fact that the interpretation of the text is subject of a dispute before the Court does not change this.

(11) See on this balance, points 31-37 below.

(12) Because it shifts the test from Regulation (EC) No 1049/2001 to Regulation (EC) No 45/2001.

(13) Opinion 5/2001 on the European Ombudsman Special Report to the European Parliament following the draft recommendation to the European Commission in complaint 713/98/IJH, 17 May 2001, WP 44, available on the website of the Working Party.

(14) Article 3(f) of the draft Convention, that is presently being finalized within the Council of Europe. The latest draft is available at the link:

http://assembly.coe.int/Main.asp?link=/Documents/WorkingDocs/Doc08/EDOC11631.htm

(15) Article 1 and Recital 4 of the Regulation; Recital 4 will be renumbered Recital 6, after modification of the Regulation according to the proposal.

(16) Recital 11 of the Regulation; Recital 11 will be renumbered Recital 17, after modification of the Regulation according to the proposal.

(17) Paragraph 94 of the Judgement of the Court of First Instance in Bavarian Lager, and the case law mentioned there.

(18) Paragraph 107 of the Judgement of the Court of First Instance in Bavarian Lager, elaborated in point 40 below.

(19) See in this sense in particular the Judgement of the Court of Justice in Österreichischer Rundfunk (mentioned in footnote 22).

(20) Paragraph 98 of the Judgement.

(21) See the EDPS Background Paper for more extensive explanation of Article 5.

(22) Paragraph 107 of the Judgement of the Court of First Instance. NB: Article 8 of Regulation (EC) No 45/2001 also imposes other obligations but they do not pose any problems in the present context.

(23) See in particular paragraphs 131, 132 and 136 of the Judgement.

(24) Judgement of the Court of 20 May 2003, Rechnungshof (C-465/00) v Österreichischer Rundfunk and Others and Christa Neukomm (C-138/01) and Joseph Lauermann (C-139/01) v Österreichischer Rundfunk. Joined Cases C-465/00, C-138/01 and C-139/01, ECR 2003, p. I-4989.

(25) See paragraph 107 of the judgement of the CFI.

(26) Paragraph 107 and 108 of the judgement of the CFI.

(27) See the application of the Commission in Case C-28/08 P mentioned in footnote 7.

(28) See Recital 21 and Article 1(4) of Directive 2003/98/EC of the European Parliament and of the Council of 17 November 2003 on the re-use of public sector information (OJ L 345, 31.12.2003, p. 90).