Background to the complaint

1. In April 2022, the European Data Protection Supervisor (EDPS) amended its internal provisions for the promotion of its staff members[1], applicable also to staff members of the European Data Protection Board (EDPB) Secretariat.[2]

2. In June 2022, the complainant asked the EDPS for public access[3] to documents concerning the preparatory work for the new Decision of the European Data Protection Supervisor of 27 April 2022 adopting implementing provisions concerning promotion. The complainant referred, for example, to legal opinions drafted in relation to the decision, consultations with other entities, minutes, analyses and internal exchanges.

3. In its initial reply, the EDPS identified 17 documents as falling within the scope of the request. It gave full or partial access to 14 documents, redacting personal data in order to protect the privacy and integrity of the individual[4] and some parts, which fell outside the scope of the request. It refused access to three documents invoking the exceptions for the protection of privacy and integrity of the individual,[5] the protection of legal advice[6] and the protection of the decision-making process after the decision has been taken.[7] The three documents were:

• Document 8: an email transmitted by the legal service to the human resources team
• Document 9: an email transmitted by the human resources team to the Director
• Document 10: an email thread between the Director and the human resources team

4. In July 2022, the complainant requested a review of this decision (by making a ‘confirmatory application’). The complainant also expressed doubts as to whether the list of documents identified was exhaustive. The complainant did not object to the redaction of personal data but challenged the application of the exceptions under Articles 4(2) (protection of legal advice) and 4(3) (protection of the decision-making process) of Regulation 1049/2001.

5. The EDPS interpreted the complainant’s confirmatory application to be in relation to the documents refused entirely, namely documents 8-10. In the confirmatory decision, the EDPS decided to give partial access to those documents, redacting some parts in order to protect the privacy and integrity of the individual and legal advice. In addition, the EDPS confirmed that the documents identified at initial stage were the only ones falling within the scope of the original request.

6. Dissatisfied with this outcome, the complainant turned to the Ombudsman on 4 November 2022.

The inquiry

7. The Ombudsman opened an inquiry into the following aspects of the complaint:

1) whether the EDPS was justified to refuse full public access to documents 8-10, based on the exception for the protection of legal advice;

2) whether the EPDS identified all the documents within the scope of the complainant’s request.

8. In the course of the inquiry, the Ombudsman inquiry team inspected the concerned documents. The Ombudsman also received the reply of the EDPS on the complaint.

Arguments presented

9. The complainant considered that the EDPS was not justified in redacting parts of the documents. In his view, the EDPS did not show, as requested by EU case-law,[8] how full disclosure would pose a risk, which was reasonably foreseeable and not purely hypothetical, of undermining the interests protected by one of the exceptions to public access (in this case the protection of legal advice).

10. The complainant also argued that there was an overriding public interest in releasing the documents, since these referred to a decision affecting the rights of the EDPS and the EDPB Secretariat staff members. He also referred to the public interest in ensuring transparency and accountability of the EU institutions, particularly since it had an impact on staff rights.

11. The complainant further claimed that the EDPS did not identify all documents falling within the scope of his initial request. He said that he had obtained additional information, which led him to draw this conclusion. In particular, it appears that the EDPS Staff Committee expressed concerns about the short deadline imposed when consulted on the draft implementing provisions on promotion.

12. The EDPS argued the documents contain legal advice relating to an internal administrative issue of the institution, and not to a legislative proposal.[9]

13. The EDPS considered that disclosure of the parts relating to legal advice would harm the EDPS’s interest in seeking legal advice and receiving frank, objective and comprehensive advice.[10] The EDPS explained that the documents include legal interpretations, risk assessments and reflections ahead of the adoption of the decision. Disclosure would create the risk that, in future, such analysis would not be conducted in an independent and frank manner. Protecting the independence of the advice was particularly important in staff matters, “where staff might want exactly to exploit the legal interpretations and assessment provided in the advice for their own personal purposes”. The EDPS argued that there was “more than a foreseeable risk” that the content of the advice might be influenced by the mere possibility of disclosure to staff affected by the decision for which the advice was given. Disclosure would further undermine the ability of the EDPS to make legally sound administrative decisions, since the drafters might refrain from expressing their most delicate concerns and water-down their advice, against the interests of the EDPS.

14. The EDPS stated that the final decision on promotion was made public and that there was no overriding public interest in disclosing the internal legal advice. The documents related to an administrative decision, and not to a legislative matter where the need for transparency and accountability was greater. In addition, the decision was of interest to the EDPS staff only and not to society as a whole.

15. As for the complainant’s claim that not all documents were identified, the EDPS confirmed in its reply to the Ombudsman that all documents pertaining to the public access request were properly identified. However, the EDPS noted that one document initially disclosed to the complainant at initial stage was erroneously redacted. Rather than redacting only personal data as intended, an additional sentence was redacted by error. On 8 December 2022, the EDPS issued a corrigendum and disclosed the respective sentence to the complainant.  

The Ombudsman's assessment

16. According to EU case-law, when invoking the exception relating to the protection of legal advice, an EU institution needs to examine:

(1) whether the concerned documents relate to legal advice;

(2) whether disclosure would harm the institution’s interest in seeking legal advice and receiving frank, objective and comprehensive advice, that risk being reasonably foreseeable and not purely hypothetical; and

(3) if the institution concerned takes the view that disclosure of a document would undermine the protection of legal advice, whether there is an overriding public interest justifying disclosure.[11]

17. Having inspected documents 8-10, the Ombudsman inquiry team confirms that the documents contain legal advice pertaining to the modification of the EDPS internal provisions concerning staff promotion, based on the EU Staff Regulations.

18. The EDPS explained how, in its view, disclosure of the redacted parts would affect, in a reasonably foreseeable and not purely hypothetical way, its ability to receive frank, objective and comprehensive advice. More specifically, the EDPS takes the view that disclosure, or mere threat of disclosure, would lead to the drafters refraining from expressing all concerns, and would not allow the hierarchy to obtain frank legal advice, which would jeopardize the effective functioning of the institution.

19. The Ombudsman considers that EU staff members should, in general, be aware that their work can at any point be scrutinised by the public and should think of transparency as the default approach.

20. That said, the EDPS’s position as regards its drafters refraining from expressing all concerns, thus not allowing the hierarchy to obtain frank legal advice on an administrative matter such as that at issue, is not unreasonable.

21. The Ombudsman agrees with the EDPS that there is no overriding public interest in disclosure. The EDPS’s decision on promotion concerns only the EDPS and the EDPB Secretariat staff members. The final decision has been made public, and any amendments could be deduced by comparing the original with the current version. Furthermore, the EU courts have recognised the need for an overriding public interest in particular for disclosure of documents containing legal advice related to legislative initiatives under debate, with the aim of increasing transparency of the legislative process and strengthen the public scrutiny.[12] In this case, the documents at issue are not legal advice relating to a specific legislative initiative for which wider openness is expected. Rather, they relate to an internal administrative procedure.

22. This does not mean, however, that the non-legislative activity of the EU institutions cannot be scrutinised. As the Ombudsman pointed out above, EU staff members should in general acknowledge that their work can - at any point - be scrutinised by the public and that transparency-by-design should be incorporated in the EU administration at all levels. The Ombudsman invites the EDPS to consider this in the future.

23. Finally, as regards whether all documents falling within the scope of the request were properly identified, the Ombudsman considers that this was the case. During the Ombudsman’s inquiry, the EDPS became aware of an error in the redaction of one document partially disclosed at initial stage. The erroneously redacted sentence seems to contain the information the complainant believed was missing, based on the information he had received. As the EDPS has in the meantime remedied that error and granted the complainant wider partial access to the document in question, this aspect of the complaint has been resolved.

Conclusions

Based on the inquiry, the Ombudsman closes this case with the following conclusions[13]:

There was no maladministration by the EDPS in refusing full public access to documents 8-10. The EDPS has settled the second aspect of the complaint in relation to the documents falling within the scope of the request by giving further partial access to one document wrongly redacted at initial stage.

The complainant and the EDPS will be informed of this decision.

 

Rosita Hickey
Director of Inquiries

Strasbourg, 16/12/2022

 

[1] In accordance with the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Economic Community and the European Atomic Energy Community: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A01962R0031-20140501.

[2] The European Data Protection Board is an independent body, which contributes to the consistent application of data protection rules throughout the European Union. Its secretariat is provided by the EDPS. More information is available at: https://edpb.europa.eu/about-edpb/about-edpb/edpb-secretariat_en.

[3] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32001R1049.

[4] In line with Article 4(1)(b) of Regulation 1049/2001.

[5] Article 4(1)(b) of Regulation 1049/2001.

[6] Article 4(2) second indent of Regulation 1049/2001.

[7] Article 4(3) second paragraph of Regulation 1049/2001.

[8] The complainant referred to, for example, the Judgment of the General Court of 22 March 2018, Case T-540/15, Emilio De Capitani v European Parliament, available at: https://curia.europa.eu/juris/liste.jsf?num=T-540/15 and to Judgment of the Court of 21 July 2011, Case C-506/08 P, Kingdom of Sweden v European Commission and MyTravel Group, available at: https://curia.europa.eu/juris/liste.jsf?language=en&num=C-506/08%20P.

[9] The EDPS referred to case-law recognising increased transparency for documents related to legislative proposals, such as for example: Judgment of the General Court of 7 February 2018, Case T 851/16, Access Info Europe v European Commission, available at: https://curia.europa.eu/juris/liste.jsf?num=T-851/16&language=EN.

[10] The EDPS referred to the Judgment of the Court of 1 July 2008, C-39/05 P and C-52/05 P- Sweden and Turco v Council: available at: https://curia.europa.eu/juris/liste.jsf?num=C-39/05&language=en and Judgment of the General Court of 21 April 2021, Case T-252/19, Pech v Council, available at: https://curia.europa.eu/juris/liste.jsf?language=en&num=T-252/19.

[11] Pech v Council, paragraphs 78 and 79.

[12] Sweden and Turco v Council, paragraph 46, Pech v Council, paragraph 80.

[13] This complaint has been dealt with under delegated case handling, in accordance with the Decision of the European Ombudsman adopting Implementing Provisions.