Opinion of the European Data Protection Supervisor on the Proposal for a Regulation of the European Parliament and of the Council regarding public access to European Parliament, Council and Commission documents
Date: 2009-01-07
Institutions: European Data Protection Supervisor
Subjects: Council of the European Union, European Data Protection Supervisor, European Parliament, access to EU information, application of EU law, provision of documents

7.1.2009

EN

Official Journal of the European Union

C 2/7

Opinion of the European Data Protection Supervisor on the Proposal for a Regulation of the
European Parliament and of the Council regarding public access to European Parliament, Council
and Commission documents

(2009/C 2/03)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Com-
munity, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the
European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament
and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and
on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and on
the free movement of such data (2), and in particular
its
Article 41,

Having regard to the request for an opinion in accordance with
Article 28(2) of Regulation (EC) No 45/2001 received on
15 May 2008 from the European Commission,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

The proposal

1. On 30 April 2008, the Commission adopted a Proposal for
a Regulation of the European Parliament and of the Council
regarding public access to European Parliament, Council
and Commission documents (hereinafter: ‘the proposal’) (3).
The proposal was sent by the Commission to the EDPS for
consultation, in accordance with Article 28(2) of Regulation
(EC) No 45/2001 and was received by the EDPS on 15 May
2008.

2. The aim of the proposal is to make a number of substantive
changes to Regulation (EC) No 1049/2001 of 30 May
2001 regarding public access to European Parliament,
Council and Commission documents (4). In its Explanatory
Memorandum, the Commission gives reasons for reviewing
the existing Regulation. It mentions the ‘European Transpar-
ency Initiative’ (5) which calls for more transparency, the
Regulation applying the Århus Convention (6) to the institu-
tions and bodies of the European Community, which inter-
acts with Regulation (EC) No 1049/2001 as regards access

(1) OJ L 281, 23.11.1995, p. 31.
(2) OJ L 8, 12.1.2001, p. 1.
(3) COM(2008) 229 final.
(4) OJ L 145, 31.5.2001, p. 43.
(5) Minutes of the Commission's meeting No 1721 of 9 November 2005,
item 6; see also documents SEC(2005) 1300 and SEC(2005) 1301.
(6) Regulation (EC) No 1367/2006 of the European Parliament and of the
Council of 6 September 2006 on the application of the provisions of
the Århus Convention to Community institutions and bodies (OJ L 264,
25.9.2006, p. 13).

information, as
to documents containing environmental
well as the case law of the Court of Justice and complaints
settled by the European Ombudsman, relating to Regulation
(EC) No 1049/2001.

Consultation of the EDPS

3. The EDPS welcomes that he is consulted and recommends
that reference to this consultation be made in the recitals of
the proposal, in a similar way as included in a number of
legislative texts on which the EDPS has been
other
consulted, in accordance with Regulation (EC) No 45/2001.

4. The attention of the EDPS has in particular been triggered
by the fact that the proposal contains a provision dealing
with the delicate relation between access to documents and
the rights to privacy and to the protection of personal data,
namely the proposed Article 4(5). The analysis of
this
provision will be the central part of this opinion.

5. However, the opinion will not be limited to this analysis.
The analysis will be preceded by observations on the
context of the proposal and its scope. After the analysis of
Article 4(5), other issues will be addressed, such as the
right of access to personal data under Regulation (EC)
No 45/2001.

II. CONTEXT AND SCOPE OF THE PROPOSAL

The context

6. The proposal was preceded by a public consultation. In the
Explanatory Memorandum, the Commission mentions that
it has taken into account the views of the majority of the
respondents in this public consultation.

7. After the adoption of the proposal, on 2 June 2008, a
public hearing took place in the European Parliament, orga-
nised by the LIBE-Committee. This was the occasion for a
number of stakeholders to express an opinion on the
proposal. The EDPS also made some provisional comments.
On that occasion,
the European
Commission — in a reaction to the different comments —
emphasised that the proposal reflected the current state of
thinking, but that the Commission was open to discuss the
text and consider
the
for
proposal, not excluding alternatives.

the representatives of

the improvement of

input

C 2/8

EN

Official Journal of the European Union

7.1.2009

8. The EDPS sees this open approach as an opportunity and
envisages enriching the discussion with an alternative text
for the proposed Article 4(5). Moreover, such an open
transparency:
approach perfectly fits in the notion of
promoting good governance and ensuring participation of
civil society (see for instance Article 15(1)) of the Treaty on
the Functioning of the European Union).

9. Despite the uncertainty about the fate of the Lisbon Treaty
at the moment of issuing this opinion, the perspective of
the legal framework under the new Treaty should not be
ignored.

13. The point of departure of the regulation is access to docu-
ments, not access to information as such. This is the notion
as laid down in Article 255 EC. The Lisbon Treaty would
not lead to a substantive change. The new Treaty just clari-
fies that the medium of the documents is not decisive.
However, as the Court of First Instance stated in the WWF
case,
‘it would be contrary to the requirement of transparency
which underlies Regulation (EC) No 1049/2001 for institutions
to rely on the fact that documents do not exist in order to avoid
the application of that regulation’ (7). Therefore, according to
the Court, the institutions concerned must,
in so far as
possible and in a non-arbitrary and predictable manner,
draw up and retain documentation relating to their activ-
ities. Otherwise, the right of access to documents may not
be exercised effectively.

10. The proposal is based on Article 255 of the EC Treaty that
grants a right of access to European Parliament, Council
and Commission documents. When the Lisbon Treaty
enters into force, this Article will be replaced by Article 15
of the Treaty on the European Union. Article 15 extends
the right of access to documents of all Union institutions,
bodies, offices and agencies. It modifies Article 255 inter
alia by introducing a general principle of openness
(Article 15(1)) and by obliging the European Parliament
and the Council
to ensure publication of documents
relating to the legislative procedures.

The scope: the notion of documents

‘“document”

shall mean any content whatever

11. The proposal applies to all documents within the definition
the proposed Article 3(a). This definition reads as
of
follows:
its
medium (written on paper or stored in electronic form or as a
sound, visual or audiovisual recording) drawn-up by an institution
and formally transmitted to one or more recipients or otherwise
registered, or received by an institution; data contained in elec-
tronic storage, processing and retrieval systems are documents if
they can be extracted in the form of a printout or electronic-
format copy using the available tools for the exploitation of the
system’.

12. The reason for fully quoting this definition is that it raises a
few essential questions as to the scope of the Regulation:

— the object of the right to access: is it a piece of paper
(or its electronic equivalent) or does it have a broader
meaning: information about the activities of EU institu-
tions or the information held by them, disregarding the
existence of a document?

— what is the meaning of the limitation of the scope of
application of the Regulation to documents that have
been formally transmitted to one or more recipients or
otherwise registered, or received by an institution?

in the concept of document

14. Against this background, on the one hand the proposal
‘data
explicitly includes
contained in electronic storage, processing and retrieval
systems’, when they can be extracted. The EDPS notes that
this definition comes close to the definition of processing
of personal data laid down in Regulation (EC) No 45/2001
and extends the possible overlap with Regulation (EC)
No 1049/2001. Requests for access to mere lists of names
and/or other personal data are likely to increase — also in
the light of
the tools available to
exploit electronic systems — and it is therefore even more
important to address the possible areas of tension between
the Regulations as well as the relations with other available
instruments, such as the right of access to personal data
(see below, points 64-67).

the development of

15. On the other hand, the Commission proposes that a docu-
ment only ‘exists’ if it has been sent to recipients or circu-
lated within the institution or otherwise registered. The
EDPS notes that it is far from being clear to which extent
this formulation would restrict the scope of application of
the Regulation and would therefore run counter to the
principles of openness and public participation. Unfortu-
nately,
little
guidance in this regard. Therefore, the EDPS suggests that
the concept of
should be clarified in the
Commission proposal, in the provision itself or in a recital.

explanatory memorandum provides

‘document’

the

16. Without entering into a detailed analysis of possible inter-
pretations of these crucial provisions, the EDPS points out
that, in spite of the changes in the concept of ‘document’
proposed by the Commission, there is still a difference in
scope between Regulation (EC) No 1049/2001 and Regu-
lation (EC) No 45/2001. The latter Regulation only applies,

— the difference

in scope between Regulation (EC)

No 1049/2001 and Regulation (EC) No 45/2001.

(7) Judgement of 25 April 2007, WWF European Policy Programme v

Council, Case T-264/04, paragraph 61.

7.1.2009

EN

Official Journal of the European Union

C 2/9

according to its Article 3(2), to ‘the processing of personal
data wholly or partly by automatic means, and to the
processing otherwise than by automatic means of personal
data which form part of a filing system or are intended to
form part of a filing system’. Regulation (EC) No 1049/2001
applies to all documents held by an institution.

17. Although the manual processing of personal data becomes
less important, it is necessary to consider that within the
institutions and bodies of the European Union paper files
are still used. If such paper files do not have a structured
nature, they may not be fully covered by Regulation (EC)
No 45/2001. However,
such documents may contain
personal data and it must be ensured that also in those
cases the exception of Article 4(5) can be applied.

18. This difference in scope should be duly taken into account
in order to ensure that the legitimate interest of the data
subject is considered also in case of paper files. This is an
additional reason why the mere ‘referral’ to Regulation (EC)
No 45/2001 — as explained below (see points 38-40) — is
not satisfactory, since it would not provide guidance for
those cases in which personal data contained in documents
fall outside the scope of application of Regulation (EC)
No 45/2001.

III. ARTICLE 4(5)

General appraisal of the provision

to documents and the rights

19. The proposed Article 4(5) deals with the relation between
access
to privacy and
the protection of personal data, and replaces the present
Article 4(1)(b) that was widely criticized as being ambig-
uous about the precise relation between these fundamental
rights. The present Article was also disputed before the
Court of First Instance (8). An appeal on grounds of law is
now pending before the Court of Justice (9).

20. In this perspective, there are good reasons for replacing
Article 4(1)(b). The EDPS understands that the Commission
used this occasion to propose a change of Article 4(1)(b).
However, the EDPS does not support the proposed provi-
sion as drafted by the Commission.

21. In the first place, the EDPS is not convinced that this is the
appropriate moment for change, while an appeal is pending
before the Court of
fundamental
issues are at stake.

In this appeal

Justice.

22. In the second place, more importantly: the proposal does
It consists of a

not provide the appropriate solution.
general rule (the second sentence of Article 4(5) that:

— does not reflect the judgement of the Court of First

Instance in Bavarian Lager,

— does not do justice to the need for a right balance

between the fundamental rights at stake,

— is not viable since it refers to EC legislation on data
protection that does not provide a clear answer when a
decision on public access must be made.

Moreover, it consists of a specific rule (the first sentence of
Article 4(5)) that is in principle well defined, but with a
scope that is far too limited.

This is not the appropriate moment for change

23. The EDPS is fully aware of the possible interactions — and
possible tensions — between access to documents and the
rights to privacy and the protection of personal data. In his
Background Paper on public access to documents and data
protection, published in July 2005, he made a careful
analysis of the issues arising from the simultaneous applica-
tion of Regulation (EC) No 1049/2001 and Regulation (EC)
No 45/2001.

24. In particular, the EDPS highlighted that public access on the
one hand and privacy and data protection on the other
hand are fundamental
rights which are laid down in
different legal instruments at European level and represent
key elements of ‘good governance’. There is no hierarchical
order between these rights and in certain cases
the
simultaneous application of the Regulations does not lead
to an obvious answer. According to the EDPS background
paper, the solution can be found in the privacy exception
laid down by the present Article 4(1)(b) of Regulation (EC)
No 1049/2001. As the background paper explains, this
provision imposes three conditions, all of which have to be
fulfilled for the exception to public access to apply:

— the privacy of the data subject must be at stake,

— public access must substantially affect the data subject,

(8) Judgement of 8 November 2007, Bavarian Lager v Commission,

T-194/04. Two other still pending cases concern the same issue.

(9) Pending Case C-28/08 P, Commission v Bavarian Lager, OJ C 79, p. 21.

— public access is not allowed by the data protection

legislation.

C 2/10

EN

Official Journal of the European Union

7.1.2009

25. The main lines of the EDPS analysis were confirmed by the
Court of First Instance in the Bavarian Lager case, in which
the Court of First Instance was called to interpret the rela-
tionship between Regulation (EC) No 45/2001 and Regu-
lation (EC) No 1049/2001, and the exception regarding the
protection of personal data contained in the latter Regu-
lation. The main elements of this judgement will be used to
substantiate the present opinion. The Commission decided
to lodge an appeal against the judgement of the CFI; the
case is now pending before the Court of Justice. In this case
before the Court of Justice, the EDPS takes the position that
the judgement of the CFI should be upheld.

26. It is therefore questionable whether this is the appropriate
moment to amend the provision on the relation between
access to documents and protection of personal data, now
that the case is pending before the Court of Justice. This
case is not only about the interpretation of the present
wording of Article 4(1)(b) (10) but also raises more funda-
mental questions relating to the balance between the funda-
mental rights at stake (11). Under those circumstances,
it
would be better to wait for the judgement and not adopt
the Regulation before.

proposed amendments genuinely take into account
this
judgement and do not substantially depart from it. The
judgement of the Court of First Instance not only gives an
interpretation of some relevant provisions of both Regu-
lation
(EC)
No 45/2001, but it also strikes a right balance between the
rights protected by these two Regulations. The EDPS under-
lines the importance for the legislator to preserve this
balance, while possibly clarifying the relevant provisions.

and Regulation

1049/2001

(EC) No

30. In the following paragraphs of this opinion, the EDPS will
further clarify why — contrary to the point of view
expressed by the Commission — the proposed Article 4(5)
does not reflect the case law of the Court.

The second sentence of Article 4(5) does not do justice to the
need for a right balance

The amendment does not reflect the judgement of the Court of
First Instance

31. The second sentence of Article 4(5) states:

‘Other personal
data shall be disclosed in accordance with the conditions regarding
lawful processing of such data laid down in EC legislation on the
protection of individuals with regard to the processing of personal
data’.

27. The preference to wait for the judgement of the Court of
Justice is also motivated by the substance of the proposed
in its explanatory
provision. The Commission claims,
the proposed amendments are also
memorandum,
that
aimed at addressing the judgement of
in the
Bavarian Lager case. However, the amendment does not
reflect the position of the CFI.

the CFI

32. This provision implies that the authority deciding on a
request for public access needs to base its decision not on
Regulation (EC) No 1049/2001, but on Regulation (EC)
No 45/2001. The provision thus contains the so called
‘referral theory’ (12) as defended by the Commission before
the Court of First Instance in Bavarian Lager.

28. In particular, the EDPS notes that the Commission proposal
deletes any reference to the harm to ‘the privacy and the
integrity’ of
the individual as a necessary threshold to
justify a refusal to access documents containing personal
data. In this way, the Commission proposal strongly alters
the balance so far reached by the legislator, as interpreted
by the CFI. The proposal shifts the focus of access to
documents containing personal data from Regulation (EC)
No 1049/2001 to Regulation (EC) No 45/2001.

33. This theory was rejected by that Court on the basis of the
present wording of Article 4(1)(b) of Regulation (EC)
No 1049/2001. The Court based this rejection on this
wording: disclosure can only be denied if the privacy or the
integrity of a person would be undermined. However, this
reasoning of the Court is not just a textual interpretation,
but reflects the result of a balancing between the two
fundamental
access and data
protection.

stake: public

rights at

29. It is important, at least as long as the judgement of the CFI
remains the point of reference in this delicate area, that the

(10) It is clear that it is within the discretion of the legislator to change a
text of a legislative instrument. The fact that the interpretation of the
text is subject of a dispute before the Court does not change this.

(11) See on this balance, points 31-37 below.

34. This need for a right balance between these fundamental
rights — or a ‘balanced approach’ as it is usually defined —
has also been emphasised in a number of documents
dealing with the collision between those two rights. This

(12) Because it shifts the test from Regulation (EC) No 1049/2001 to Regu-

lation (EC) No 45/2001.

7.1.2009

EN

Official Journal of the European Union

C 2/11

was for example the case in Opinion 5/2001 of
the
Article 29 Working Party (13) and in the EDPS Background
Paper. A similar approach is also taken in the Draft
Convention of the Council of Europe on Access to Official
Documents, which establishes that contracting parties may
limit the right of access to official documents to the aim of
protecting,
‘privacy and other legitimate private
interests’ (14).

inter alia,

— the provisions of Regulation (EC) No 45/2001 must
necessarily be interpreted in the light of fundamental
rights, in particular the right to privacy (19),

— the processing of personal data must therefore be in
accordance with the principle of proportionality and
not actually and specifically undermine a legitimate
interest of the data subject.

35. On the one hand,

the right

to public access must be

respected, which means in any event that:

— the purpose of Regulation (EC) No 1049/2001 should
be respected. The Regulation should give the fullest
possible effect to the right to public access (15). This
means that, in principle, all documents of the Institu-
tions should be accessible by the public (16). As a conse-
quence, exceptions to the right must be construed and
applied restrictively so as not to defeat the general prin-
ciple enshrined in the Regulation (17),

— given the nature of the right to public access, a person
may not be required to justify his request and therefore
does not have to demonstrate any interest in having
access to the document requested (18).

36. On the other hand, the right to data protection must be

respected:

— the protection of personal data is laid down in a system
of checks and balances which does not prohibit the
processing of personal data, but subjects the processing
to safeguards
and guarantees. The processing of
personal data is allowed if the data subject gives his
unambiguous consent or if the processing is necessary
for other public and private interests (Article 5 of Regu-
lation (EC) No 45/2001),

(13) Opinion 5/2001 on the European Ombudsman Special Report to the
European Parliament following the draft recommendation to the
European Commission in complaint 713/98/IJH, 17 May 2001,
WP 44, available on the website of the Working Party.

(14) Article 3(f) of the draft Convention, that is presently being finalized
within the Council of Europe. The latest draft is available at the link:
http://assembly.coe.int/Main.asp?link=/Documents/WorkingDocs/
Doc08/EDOC11631.htm

(15) Article 1 and Recital 4 of the Regulation; Recital 4 will be renumbered
Recital 6, after modification of the Regulation according to the
proposal.

(16) Recital 11 of the Regulation; Recital 11 will be renumbered Recital 17,

after modification of the Regulation according to the proposal.

(17) Paragraph 94 of the Judgement of the Court of First Instance in

Bavarian Lager, and the case law mentioned there.

(18) Paragraph 107 of the Judgement of the Court of First Instance in

Bavarian Lager, elaborated in point 40 below.

37. Such a balance can not be guaranteed by a simple referral
to Regulation (EC) No 45/2001, which ‘is designed to
ensure the protection of the freedoms and fundamental
rights of individuals, particularly their private life,
in the
handling of personal data’ (20). This solution may respect
the right to data protection, but does not respect the right
to public access.

The second sentence of Article 4(5) does not offer a viable
solution

38. Regulation (EC) No 45/2001 does not provide a clear
answer when a Community institution or body has to
decide on a request for public access. In short (21), Article 5
of the Regulation allows processing of personal data if this
is ‘necessary for the performance of a task carried out in
the public interest’ or if this is ‘necessary for compliance
with a legal obligation to which the controller is subject’. In
other words, the lawfulness of the processing is not deter-
mined by the interest of data protection itself, but by the
necessity of the processing for another interest (whether
laid down in a legal obligation or not). This leads to the
conclusion that since the necessity is not determined by
Article 5 of Regulation (EC) No 45/2001 itself (nor by any
other provision of this Regulation), the law designed to
protect the other interest — in this case, the right to have
access to documents — should give adequate guidance.

39. However, according to the proposal, all the requests for
access to documents containing personal data — unless the
specific provision of
the first sentence of Article 4(5)
applies — should be assessed on the basis of a reference to
Regulation (EC) No 45/2001. Such a reference would not
the necessary guidance in balancing the
provide for
interests. This would result
in an undesirable outcome
(a ‘catch-22’ situation).

(19) See in this sense in particular the Judgement of the Court of Justice in

Österreichischer Rundfunk (mentioned in footnote 22).

(20) Paragraph 98 of the Judgement.
(21) See the EDPS Background Paper for more extensive explanation of

Article 5.

C 2/12

EN

Official Journal of the European Union

7.1.2009

40. Finally, it should be noted that the reference to Regulation
(EC) No 45/2001 does not
solve the incompatibility
between the right to public access and the obligation to
prove the need to transfer of personal data, laid down by
Article 8(b) of Regulation (EC) No 45/2001. As stated by
the Court of First Instance in Bavarian Lager:
‘If one were
to require the applicant to demonstrate the necessity of
having the data transferred, as an additional condition
imposed in Regulation (EC) No 45/2001, that requirement
would be contrary to the objective of Regulation (EC)
No 1049/2001, namely the widest possible public access to
documents held by the institutions’ (22).

The scope of the first sentence of Article 4(5) is far too limited

down in Article 4(5) — and the purpose is limited, namely
granting of public access.

44. As to the limitation of the scope ratione personae, certain
data of public office holders, civil servants and interest
representatives must be released. It seems that the provision
merely aims at resolving the consequences of the Judge-
ment of the Court of First Instance in Bavarian Lager. The
question arises why the provision does not deal with a
in relation with their
wider category of data subjects,
professional
supporting the
presumption that
in this relation personal data should
normally be released, are for instance also valid in relation
to:

activities. The

arguments

— employees

in the private sector or

self employed
persons, not to be characterised as interest representatives,
unless there is a reason to assume that disclosure would
adversely affect that person,

41. The first sentence of Article 4(5) of the proposal reads as
follows: ‘Names, titles and functions of public office holders, civil
servants and interest representatives in relation with their profes-
sional activities shall be disclosed unless, given the particular
circumstances, disclosure would adversely affect
the persons
concerned’. It gives a specific rule for certain types of data,
relating to a specified group of persons.

— academic researchers presenting the result of

their

research,

— experts presenting their field of expertise in the public

process,

42. As a first preliminary remark, the EDPS notes that there is
no doubt that the first sentence of Article 4(5) respects the
right to public access. In the situations addressed by this
sentence, normally public access will be given to docu-
ments. In the view of the EDPS, the provision also respects
the right to data protection. It covers the situation dealt
with by the Court of First Instance in Bavarian Lager, as
well as comparable situations. As that Court states: in those
situations, disclosure of names does not lead to an interfer-
ence with the private life of the persons, nor would those
persons have any ground to believe that they enjoyed confi-
dential treatment (23).

43. As a second preliminary remark, one can state that the
provision is in principle well defined and fulfils the condi-
tion of legal certainty. The provision defines the different
capacities in which the persons act and limits the personal
data that can be disclosed.
the question
whether these limitations are appropriate, they are clearly
drafted.
(EC)
No 45/2001: the disclosure of the data constitutes lawful
processing — as it is based on the legal obligation laid

comply with Regulation

Irrespective of

They

also

(22) Paragraph 107 of the Judgement of the Court of First Instance.
NB: Article 8 of Regulation (EC) No 45/2001 also imposes other obli-
gations but they do not pose any problems in the present context.
(23) See in particular paragraphs 131, 132 and 136 of the Judgement.

— teachers and professors in the exercise of their teaching

or lecturing functions.

45. These examples suggest that it would have been useful to
look for a wider provision, entailing data of different cate-
gories of persons, when acting in a professional capacity.

titles and functions

46. A second limitation — ratione materiae — in the first
sentence of Article 4(5) of the proposal, relates to the data
elements. Only names,
shall be
disclosed. This excludes data which reveal elements of the
private situation of the person concerned, even if those
data do not qualify as sensitive data as meant in Article 10
of Regulation (EC) No 45/2001. One could think about
home address, telephone and e-mail, or other data — such
as salaries and expenses — relating to high ranking officials
or politicians.

47. However, it also excludes data elements that have nothing
to do with the private situation of the person concerned,
such as the office address of the person concerned (physical
and e-mail), as well as more generic information relating to
the function of the person.

7.1.2009

EN

Official Journal of the European Union

C 2/13

48. A more fundamental problem with the approach of the
proposal is that a name is seldom included in a document
on its own. The name is usually connected to other data
relating to the person. For example, the Bavarian Lager case
was about access to minutes of a meeting. One can imagine
that
the
the minutes not only mention the names of
persons present at the meeting, but also their contribution
to the discussion during the meeting. This contribution
could sometimes even qualify as sensitive data as meant in
Article 10 of Regulation (EC) No 45/2001, for instance if a
political opinion is expressed.
therefore
whether particular data could be considered in isolation.

is doubtful

It

(c) if the data have already been published with the

consent of the person concerned;

2. personal data shall nevertheless be disclosed, if an over-
riding public interest requires disclosure. In those cases,
the institution or body shall have to specify the public
interest. It shall give reasons why in the specific case the
public interest outweighs the interests of
the person
concerned;

3. where an institution or body refuses access to a docu-
it shall consider

ment on the basis of paragraph 1,
whether partial access to this document is possible.

IV. AN ALTERNATIVE SOLUTION

The need for clear guidance by the legislator

52. This provision can be explained as follows.

49. Regulation (EC) No 1049/2001 should itself give guidance
to institutions and bodies that deal with requests for public
access to documents containing personal data, whilst fully
respecting the right balance between the two fundamental
rights at stake.

50. According to the EDPS, a further discussion is needed
about how to transpose this guidance into a specific legal
provision. As the past has shown, this is an issue which
includes difficult and fundamental considerations. It should
be drafted as carefully as possible with input from the
different stakeholders.

The alternative solution

53. The first part of paragraph 1 contains the basic rule and
reflects the need for a right balance between the funda-
mental rights at stake. The exception to the right of public
access shall only apply if disclosure would harm the privacy
or the integrity of the person concerned. The provision
for private and family life as
refers to privacy (respect
meant in Article 7 of the Charter of Fundamental Rights of
the Union and Article 8 ECHR) and not to data protection
(as meant in Article 8 of the Charter).

54. However, the right to protection of personal data — laid
down in a system of checks and balances to protect the
data subject, see also point 36 above — is fully taken into
account. The provision specifies the legal obligation for the
disclosure of the personal data, as foreseen in Article 5(b)
of Regulation (EC) No 45/2001.

51. As a contribution to the discussion, the EDPS proposes the
following provision for public access to personal data:

1. personal data shall not be disclosed, if such disclosure
would harm the privacy or the integrity of the person
concerned. Such harm does not arise:

(a) if the data solely relate to the professional activities
of the person concerned unless, given the particular
circumstances,
there is a reason to assume that
disclosure would adversely affect that person;

55. It has to be noted that Regulation (EC) No 45/2001 does
not prohibit the processing of personal data, in so far as
this is based on a legal ground for processing under
Article 5(b) of Regulation (EC) No 45/2001. The applica-
tion of such a legal ground in a specific case is to be exam-
ined in the light of Article 8 ECHR and the case law of the
European Court for Human Rights. In this context reference
should be made to the judgement of the Court of Justice in
Österreichischer Rundfunk (24).The introduction of ‘harm the
privacy or integrity of the person concerned’ in paragraph 1
of the provision specifies that it is precisely this test that
decides whether public access shall be given to personal
data.

(b) if the data solely relate to a public person unless,
given the particular circumstances, there is a reason
to assume that disclosure would adversely affect that
person or other persons related to him or her;

(24) Judgement of the Court of 20 May 2003, Rechnungshof (C-465/00) v
Österreichischer Rundfunk and Others and Christa Neukomm
(C-138/01) and Joseph Lauermann (C-139/01) v Österreichischer
Rundfunk.
Joined Cases C-465/00, C-138/01 and C-139/01,
ECR 2003, p. I-4989.

C 2/14

EN

Official Journal of the European Union

7.1.2009

56. The term integrity was also included in the present text of
Article 4(1)(b) and refers to the physical
integrity of a
person. It can have added value for instance in cases where
disclosure of personal data could lead to a threat to the
physical integrity of the person without a direct relation to
his or her privacy.

57. The second part of paragraph 1 of the proposed provision
aims to give guidance to the institution or body deciding
on a request for public access. It distinguishes three situa-
tions where the disclosure of personal data will normally
not lead to any harm to the data subject.

— the first situation is the one covered by the first
sentence of Article 4(5) of the proposal of the Commis-
sion. It is worded in a much wider and more functional
fashion, taking into account the critical observations the
EDPS made on the present text. The provision recog-
nises that also in this situation there might be a reason
to assume that disclosure would adversely affect that
person. In that case the Community institution or body
must examine whether it is likely that this effect will
occur.
the presumption is access.
Finally, the wording ‘a reason to assume’ (etc.) is taken
from Article 8(b) of Regulation (EC) No 45/2001,

In other words,

— the second situation provides that an even wider access
is allowed when data of public persons are involved.
One could consider politicians or other persons whose
functions or behaviour normally justify a wider access
by the public based on its right to know. This is again
subject to the restriction that the conclusion may be
different in a specific case. In this situation a possible
adverse effect to relatives should also be taken into
account,

— the third situation relates to data that are already in the
public sphere, with consent of the data subject. One can
for
instance imagine that personal data have been
published on a website or a blog.

and certain lobby groups. Since this paragraph contains an
exception to an exception,
are
included. On a case by case basis, the institution or body
must specify the application of the provision.

safeguards

additional

59. Paragraph 3 obliges the institution or body to consider
partial access — for instance by blanking out names in
documents — as an additional instrument to ensure a right
balance between the fundamental rights at stake, which
should only be used if there is a ground for refusal.

60. Finally, the EDPS underlines that this solution would avoid
the ‘catch-22’ situation as mentioned above in point 39.

V. SHOULD REGULATION (EC) No 45/2001 BE CHANGED?

in the context of public access.

61. It follows from the Judgement of the Court of First Instance
in Bavarian Lager that the need for clarification of the rela-
tion between public access and data protection is also
urgent because of the different interpretations that can be
given in this context to Article 8(b) of Regulation (EC)
No 45/2001. The controversy,
inter alia in the Bavarian
Lager case before the Court of First Instance, related to the
meaning of ‘establishes the necessity of having the data trans-
ferred’
If one takes this
clause literally, it would mean that the applicant for a docu-
ment under Regulation (EC) No 1049/2001 would have to
establish a convincing reason for requiring a document,
which would be contrary to one of the objectives of the
public access Regulation, namely the widest possible access
to documents held by institutions (25). In order to solve this
problem, the Court of First Instance decided that when
personal data are transferred in order to give effect to the
right of access to documents, the applicant does not need
to prove the necessity of disclosure. Equally, it stated that a
transfer of data that does not fall under the exception of
Article 4(1)(b) can not prejudice the data subject's legitimate
interests (26).

58. Paragraph 2 recognises the fact that there can be an over-
riding interest requiring public access. Certain data can be
the public to develop an informed
indispensable for
opinion on the legislative process or the functioning of the
European institutions more in general. One can for instance
think about the (financial) relations between an institution

62. This solution was needed in order to reconcile both Regula-
tions in a satisfactory way, but it is challenged by the
Commission in its appeal before the Court of Justice. The
Commission states that ‘no provision of either Regulation
(EC) No 45/2001 or Regulation (EC) No 1049/2001

(25) See paragraph 107 of the judgement of the CFI.
(26) Paragraph 107 and 108 of the judgement of the CFI.

7.1.2009

EN

Official Journal of the European Union

C 2/15

requires or permits this provision (Article 8(b))
to be
disabled in order to permit a norm under Regulation (EC)
No 1049/2001 to have effect’ (27).

that Regulation. In such a case, when the institution or
body knows the ratio of such request for access (i.e. access
to petitioner's own personal data), the institution should be
obliged to provide access ex officio to the petitioner's
personal data.

63. According the EDPS this tension could best be solved by
the introduction of a recital in the amended Regulation (EC)
No 1049/2001, codifying the decision of the Court of First
Instance. Such a recital could read as follows:
‘Where
personal data are transferred in order to give effect to the
right of access to documents, the applicant does not need
to prove the necessity of disclosure for the purpose of
Article 8(b) of Regulation (EC) No 45/2001’.

VI. RIGHT OF ACCESS TO DOCUMENTS AND RIGHT OF

ACCESS TO OWN PERSONAL DATA

64. The right of access to documents as provided for in Regu-
lation (EC) No 1049/2001 must be differentiated from
Article 13 of Regulation (EC) No 45/2001. The right of
access as provided in Regulation (EC) No 1049/2001 grants
a general right of access to everyone concerning documents
in view of guaranteeing transparency of public bodies.
Article 13 of Regulation (EC) No 45/2001 is more limited
as regards the beneficiaries of the right of access, as it
grants this right only to the person concerned to informa-
tion relating to him/her, notably with a view of enabling
data subjects to control of information relating to them.
Furthermore, the right of access under Article 13 of Regu-
lation (EC) No 45/2001 is referred to in Article 8(2) of the
Charter of Fundamental Rights of the European Union.

65. Against

this background,

the EDPS considers that
Regulation (EC) No 1049/2001 should clarify that the
existence of
the right of access to documents is
without prejudice to the right of access to own
personal data under Regulation (EC) No 45/2001.

66. Furthermore,

the legislator

the existence of

the EDPS recommends

to
consider introducing in the amended Regulation an ex
officio access to the data subject's own personal data.
Indeed, it happens in practice that people may not be aware
of
the right of access to his/her own
personal data, as stipulated in Article 13 of Regulation (EC)
No 45/2001, and therefore they ask for access in the light
of Regulation (EC) No 1049/2001. They may be refused
access to the document if one of the exceptions in Regu-
lation (EC) No 1049/2001 applies, or it may be considered
that a request for specific access is not within the scope of

(27) See the application of the Commission in Case C-28/08 P mentioned

in footnote 7.

67. Both aspects could be clarified by introducing specific state-
ments to the Recitals to the amended Regulation (EC)
No 1049/2001, possibly in connection with Recital 11 of
the existing regulation. A first recital (or part of a recital)
could state that the right of access to public documents is
without prejudice to the right of access to personal data
under Regulation (EC) No 45/2001. A second recital (or
part of a recital) could include the notion of ex officio access
of an applicant to his or her own personal data. When a
person requests access to data concerning him or her, the
institution should on its own initiative examine whether
that person is entitled to access under Regulation (EC)
No 45/2001.

VII. FURTHER USE OF PERSONAL DATA CONTAINED IN

PUBLIC DOCUMENTS

68. Another issue to be considered and possibly clarified in the
is the further use of personal data
Commission proposal
contained in public documents.
Indeed, when access to
documents is granted, the use of personal data contained
to the applicable rules on the
therein may be subject
protection of personal data, and in particular to Regulation
(EC) No 45/2001 and to the national
legislations imple-
menting Directive 95/46/EC. Re-use, dissemination and
further processing of these personal data by the applicant,
by the institutions granting access or by third parties
having access to the document should be carried out in the
framework of the applicable data protection legislation.

69. For example, should a list of names and contact details of
public officials be disclosed further to an access request,
this list should not be used in order to target the concerned
officials with a marketing campaign or to profile them,
unless
in accordance with applicable data protection
legislation.

70. Therefore, it would be advisable that the legislator uses this
occasion in order to highlight this relation. This approach
would be consistent with the choice of the legislator in
Directive 2003/98/EC of the European Parliament and of
the Council of 17 November 2003 on the re-use of public

C 2/16

EN

Official Journal of the European Union

7.1.2009

Indeed,

information.

sector
in the latter Directive full
compliance with the principles relating to the protection of
personal data in accordance with Directive 95/46/EC is one
the conditions that are explicitly mentioned for the
of
re-use of public sector information (28).

‘when access to documents is granted,

71. In this perspective, the EDPS suggests introducing a recital
stating that
the
further use of personal data contained therein is subject to
the applicable rules on the protection of personal data, and
legislations implementing
in particular
Directive 95/46/EC’.

to the national

VIII. CONCLUSION

that

the Proposal

for a Regulation of

72. The attention of the EDPS has in particular been triggered
by the fact
the
European Parliament and of the Council regarding public
access to European Parliament, Council and Commission
documents contains a provision dealing with the delicate
relation between access to documents and the rights to
privacy and to the protection of personal data,
the
proposed Article 4(5). This opinion supports the reasons
behind replacing the present Article 4(1)(b) by a new provi-
sion to some extent, but does not support the provision
itself.

73. This provision is criticized for the following reasons:

1. the EDPS is not convinced that this is the appropriate
moment for change, while an appeal is pending before
the Court of Justice. Fundamental issues are at stake in
this appeal;

2. the proposal does not provide the appropriate solution.
It consists of a general rule (the second sentence of
Article 4(5)) that:

— does not reflect the judgement of the Court of First

Instance in Bavarian Lager,

— does not do justice to the need for a right balance

between the fundamental rights at stake,

— is not viable since it refers to EC legislation on data
protection that does not provide a clear answer
when a decision on public access must be made;

3.

it consists of a specific rule (the first sentence of
Article 4(5)) that is in principle well defined, but with a
scope that is far too limited.

74. As a contribution to the discussion, the EDPS proposes the
following exception to public access to personal data:

1. personal data shall not be disclosed, if such disclosure would
harm the privacy or the integrity of the person concerned.
Such harm does not arise:

(a) if the data solely relate to the professional activities of the
circum-
person concerned unless, given the particular
stances, there is a reason to assume that disclosure would
adversely affect that person;

(b) if the data solely relate to a public person unless, given
the particular circumstances, there is a reason to assume
that disclosure would adversely affect that person or other
persons related to him or her;

(c) if the data have already been published with the consent

of the person concerned;

2. personal data shall nevertheless be disclosed, if an overriding
public interest requires disclosure. In those cases, the institution
or body shall have to specify the public interest. It shall give
reasons why in the specific case the public interest outweighs
the interests of the person concerned;

3. where an institution or body refuses access to a document on
it shall consider whether partial

the basis of paragraph 1,
access to this document is possible.

75. The opinion identifies

other

several

points where
clarifications are needed of the public access regulation,
mainly in its relation to the provisions of Regulation (EC)
No 45/2001. These clarifications can be given by intro-
ducing recitals or possibly legislative provisions on the
following subjects:

(a) the concept of a document so as to ensure the widest
possible application of the public access regulation;

(b) the interpretation of Article 8(b) of Regulation (EC)
No 45/2001 in the context of public access so as to
ensure that the applicant for public access does not
need to prove the necessity of disclosure;

(28) See Recital 21 and Article 1(4) of Directive 2003/98/EC of the
European Parliament and of the Council of 17 November 2003 on the
re-use of public sector information (OJ L 345, 31.12.2003, p. 90).

(c) the relation between the right of access to public docu-
ments and the right of access to own personal data

7.1.2009

EN

Official Journal of the European Union

C 2/17

under Regulation (EC) No 45/2001 so as to ensure that
the right of access to public documents is without
prejudice to the right of access to own personal data;

(d) the obligation of an institution to examine on its own
initiative whether that person is entitled to access under
Regulation (EC) No 45/2001, when a person requests
access to data concerning him or her under the public
access regulation;

(e) the further use of personal data contained in public
documents, in order to ensure that this further use is

subject to the applicable rules on the protection of
personal data.

Done at Brussels, 30 June 2008.

Peter HUSTINX

European Data Protection Supervisor