Report of the European Ombudsman following his visit to the European Network and Information Security Agency (ENISA) - OII/11/2012/ANA »Den Europæiske Ombudsmand
  • Indgiv en klage
  • Anmodning om oplysninger
60th Rome Treaty anniversarydit Europa - Portalen til europæiske og nationale offentlige tjenester på nettet

Report of the European Ombudsman following his visit to the European Network and Information Security Agency (ENISA) - OII/11/2012/ANA

Tilgængelige sprog :  en

The background to the visit

1. In May 2011, the European Ombudsman launched a programme of visits to the EU agencies with the aim of identifying and spreading best practices in their relations with citizens. Initially, the Ombudsman carried out three 'pilot' visits to the EU agencies in the United Kingdom, namely, the European Banking Authority, the European Medicines Agency and the European Police College. In October 2011, the Ombudsman visited the European Environment Agency in Copenhagen and, in November 2011, the European Monitoring Centre for Drugs and Drug Addiction and the European Maritime Safety Agency in Lisbon. In February 2012, the Ombudsman visited the European Centre for the Development of Vocational Training in Thessaloniki and, in May 2012, the European Foundation for the Improvement of Living and Working Conditions in Dublin. In June 2012, the Ombudsman visited the European Police Office and Eurojust in The Hague, and the European Systemic Risk Board in Frankfurt[1].

2. By letter of 5 July 2012, the Ombudsman informed the European Network and Information Security Agency ('ENISA') that, in the framework of his programme of visits to agencies, he intended to visit it on 19 July 2012.

3. ENISA was established by Regulation 460/2004 (hereafter, 'ENISA's Founding Regulation')[2], which was last amended by Regulation 580/2011[3]. ENISA aims to ensure a high and effective level of network and information security and to develop a culture of network and information security in the European Union for the benefit of EU citizens, consumers, enterprises and public sector organisations, thus contributing to the smooth functioning of the internal market. ENISA serves the following objectives: (i) to enhance the capability of the Union, the Member States and, as a consequence, the business community to prevent, address and to respond to network and information security problems; (ii) to provide assistance and deliver advice to the Commission and the Member States on issues related to network and information security falling within its competencies; (iii) to develop a high level of expertise and use this expertise to stimulate broad cooperation between actors from the public and private sectors; and (iv) to assist the Commission, where called upon, in the technical preparatory work for updating and developing Union legislation in the field of network and information security.

4. The Ombudsman sent ENISA a draft agenda with the specific issues he wished to discuss. In addition, the Ombudsman informed ENISA that, in response to a commitment he had undertaken following a request by the Assembly of Agency Staff Committees ('AASC'), he intended to meet ENISA's Staff Committee during his visit. 

The visit

5. The meeting took place at ENISA's premises on 19 July 2012. The Ombudsman was accompanied by Mr Antonios Antoniadis, Legal Officer. ENISA was represented by Mr Udo Helmbrecht, Executive Director, who was accompanied by Mr Graeme Cooper, Head of the Public Affairs Unit, Mr Ulf Bergstrom, Spokesman, Mr Evangelos Ouzounis, Head of Resilience & Critical Information Infrastructure Protection ('CIIP') Unit, Mr Emmanuel Maurage, Legal Adviser and Deputy Head of Administration, Mrs Ingrida Taurina, from the Secretariat of the Management Board and Permanent Stakeholders Group ('PSG'), Mrs Valérie Follmer, Human Resources Assistant, and Mr Domenico Costabile, Procurement Officer.

6. At the beginning of the meeting, the Ombudsman provided information on the purpose and context of his visit to ENISA. He clarified that he carries out his visits to agencies of the EU on the basis of his competence to conduct own-initiative inquiries. An own-initiative inquiry implies, among others, that the usual procedural guarantees concerning such inquiries apply. These include the Agency's right to request the Ombudsman to treat information and documents on a confidential basis, in accordance with Articles 5.1, 5.2 and 14.2 of the Ombudsman's Implementing Provisions[4].

7. Following the Ombudsman's introductory remarks, ENISA presented its position on the subjects identified by the Ombudsman in his letter of 5 July 2012. The Heads of Unit in charge and, when necessary, the Executive Director addressed the different agenda items with the help of PowerPoint slides. Each presentation was followed by a discussion and a question and answer session. At the end of the meeting, a copy of the presentation and supporting documents were provided to the Ombudsman. ENISA asked for the confidential treatment of certain documents.

8. After the meeting with ENISA's management, the Ombudsman and Mr Antoniadis met the Staff Committee representatives, Ms Stavroula Caridis and Mr Slawomir Gorniak. The Staff Committee representatives described the Staff Committee's role and reported on its contribution to the smooth running of ENISA. The Staff Committee informed the Ombudsman that ENISA's staff members are aware of his role in uncovering maladministration and of their right to lodge a complaint with him.

9. The following issues constituted the object of discussion between the Ombudsman and ENISA's management:

  1. ENISA's initial contacts with the public;
  2. Transparency, dialogue and accountability;
  3. Selection and recruitment;
  4. Tenders and contracts;
  5. Ethical issues.

The Ombudsman's findings and suggestions

(A) ENISA's initial contacts with the public

10. One of the Ombudsman's fundamental tasks is to ensure that the EU administration is open, service-minded and efficient in handling contacts with citizens. The relevant basic principles are laid down in the European Code of Good Administrative Behaviour ('the Code'). The European Ombudsman often receives complaints alleging lack of service-mindedness and efficiency. This suggests that the EU administration is still faced with challenges in this area. When appropriate, the European Ombudsman tries to find a rapid solution to complaints that concern grievances arising from citizens' initial contacts with the administration. In such circumstances, the Ombudsman's services usually contact the relevant person by telephone.

11. In his letter dated 5 July 2012, the Ombudsman informed ENISA that all the EU agencies had agreed to adopt the Code at a meeting of the heads of the agencies held in Lisbon in October 2008. However, ENISA's website contained no reference to the Code and, therefore, the Ombudsman sought additional information on how ENISA has implemented this decision. Moreover, the Ombudsman asked how ENISA ensures that its staff members comply with the principles laid down in the Code.

12. In its presentation, ENISA underlined the importance it gives to the Code and outlined its efforts to ensure that its staff members are aware of the rights and obligations contained therein. To this end, in June 2012, it organised a training session dedicated to the Code.

13. Next, ENISA explained its practices to improve initial contacts with citizens, by focusing on recent initiatives concerning this issue. ENISA presented its outreach activities designed to enhance the Agency's visibility. These activities, which include a media and advertising campaign, target (a) experts in the field of network and information security, (b) the media as an intermediary for the dissemination of information, and (c) the citizens directly. ENISA informed the Ombudsman that its website plays a central role in the Agency's outreach efforts and that a Visual Branding update is currently underway. That process is intended to lead to an improved website that will provide state-of-the-art accessibility and will also cater for disabled users. ENISA informed the Ombudsman that, in order to raise network and information security awareness, it has already made use of 'youtube', and also that it intends to use social media, such as facebook. ENISA further outlined its outreach activities on a local level. In this regard, ENISA placed advertisements with local media, organised public events, such as the Europe day event on 9 May, and arranged visits to Cretan schools.

14. The Ombudsman welcomes ENISA's commitment to providing its staff with a wide range of information relating to good administrative behaviour and applauds it for organising a training session on the Code. The Ombudsman considers that ENISA's commitment to the principles set out in the Code could be made more visible to Union citizens and, therefore, suggests that the Agency provides a link to the Code on ENISA's website. Furthermore, the Ombudsman expresses his satisfaction with ENISA's outreach activities and the initiatives undertaken to enhance the Agency's visibility and to facilitate initial contacts with the public.

(B) Transparency, dialogue and accountability

15. The Ombudsman values highly the need to promote transparency and to increase accountability in the EU administration. This requirement is reflected in, among others, the EU legislation on public access to documents, which expressly mentions the Ombudsman as a review body. It is also reflected in the Ombudsman's extensive powers of investigation, which enable him thoroughly to clarify the facts and issues which arise during his inquiries.

16. In view of the above considerations, the Ombudsman asked ENISA to provide additional information and to answer the following questions:

"a) How does ENISA deal in practice with requests for public access to documents? What are its guidelines and/or practical arrangements for handling such requests? Please give examples of the manner in which it handles such requests, for instance by providing the main correspondence concerning the last three requests for public access to documents dealt with under Regulation 1049/2001[5]. Kindly note that I will not examine the substance of ENISA's decision in these examples, as this is not the purpose of this visit.

b) Does ENISA produce an annual report (internal or external) on its handling of public access to documents?

c) Does ENISA operate, or intend to operate, a public register in the sense of Article 11 of Regulation 1049/2001?

d) Since January 2011, the publication of the ENISA Quarterly Review (EQR), an ENISA publication for stakeholders and other interested readers, was discontinued in order to reduce ENISA's carbon footprint and promote the use of digital online tools for communications and publications. Which publications replaced EQR?

e) The ENISA Work Programmes and General Reports are available online in English (the Work Programmes of 2008 and 2010 are also available in French and German, subject to the disclaimer that the English version is the only official one). What is ENISA's policy regarding language issues in this regard?

f) The 'Contact' section of the website provides one telephone number, one fax number and two e-mail contact forms (one for website-related questions and one for all other information requests). ENISA is kindly requested to provide the Ombudsman with more information as to how it deals with requests for information. It could inform the Ombudsman about the feedback it receives from users and stakeholders.

g) How does ENISA ensure the availability to the public of Declarations of Interest made by the Executive Director, seconded national experts and experts in relation to items on the agendas of meetings of the Agency's ad hoc Working Groups?"

17. In its presentation, ENISA noted that, in line with Article 12 of ENISA's Founding Regulation, which provides that the Agency shall ensure that it carries out its activities "with a high level of transparency" and "that the public and any interested parties are given objective, reliable and easily accessible information, in particular with regard to the results of its work, where appropriate", transparency is an important characteristic of the manner in which it carries out its work.

18. In reply to the questions relating to access to documents, ENISA explained that it deals with all the requests it receives in accordance with Regulation 1049/2001. The Ombudsman underlined that ENISA's internal rules[6] make no provision for the implementation of Regulation 1049/2001, as required by Article 14(2) of ENISA's Founding Regulation[7]. ENISA explained that pursuant to Article 6(6) of ENISA's Founding Regulation[8], these rules may only be adopted on the basis of a Commission proposal. The Agency informed the Ombudsman that the Commission is in the process of preparing a 'support package for Agencies' which is expected to address this issue.

19. The Ombudsman pointed out that, despite the existence of different contact persons for different matters, there is no indication of a contact person for access to documents issues on ENISA's website. ENISA noted that its services receive very few requests for access to documents because most of its documents that are of interest to the public relate to its core activity and are therefore already publicly accessible. In any event, ENISA replies promptly to these requests and almost invariably in a favourable manner. However, it presented to the Ombudsman a case in which access to the requested documents was denied. The Agency explained that, because of the small number of requests, ENISA has not published any report on Regulation 1049/2001 and does not have a public register.

20. The discussion then turned to ENISA's initiatives to promote transparency, dialogue and accountability. In this regard, ENISA explained that its website contains a large volume of data, publications and information relating to its core activities (Work Programmes and General Reports), its structure, organisation, and the legal framework governing its operation. In addition to the availability of information about 'Recruitment' and 'Public Procurement', ENISA highlighted the availability of information concerning its financial operations: the 2012 Annual Budget and Establishment Plan, the Annual Accounts of past years, including the opinions of ENISA's Management Board, and the Reports from the European Court of Auditors on these accounts.

21. In response to the Ombudsman's question concerning the issue of the EQR having been discontinued, ENISA explained its publications policy of printing far fewer publications than before and of focusing on online publications. The website constitutes the main tool to disseminate information about its work. ENISA's online publications are broadly divided into two categories, one for citizens and the media (press releases, news items and corporate material) and one for experts in network and information security (publications, reports and studies).

22. Next, ENISA presented its policy concerning the choice of languages used in its website, online publications and reports. It explained that the choice was made on the basis of objective criteria in order to ensure that ENISA reaches out to the community of experts and citizens. The main language is English because it is the lingua franca of network and information security. Because the main companies engaged in network and information security are based in France and Germany, French and German versions are also available. Greek was added in order to raise awareness of ENISA's work in the host country. In seeking to expand the languages of communication, ENISA drew inspiration from the Office of Harmonization for the Internal Market and publishes its press releases also in Italian and Spanish.

23. ENISA outlined the information available to the public on its website, including the address of its headquarters in Heraklion and of its office in Athens. ENISA explained that, nevertheless, the initial contacts from the public are usually made by e-mail. In this connection, ENISA included two dedicated contact forms and e-mail addresses on its website. It went on to inform the Ombudsman about its standard procedure for replying to requests for information and outlined the main elements of its e-mail workflow. As soon as an e-mail enters the system, it is replied to or referred to the responsible person at the Agency within 48 hours. The efficiency of this approach was successfully tested on several occasions in which the Agency received a high volume of questions, such as questions on the 2010 Stuxnet virus, the 2011 Botnets Report and the 2012 High Rollers cyber-attacks.

24. The discussion then moved on to the question of transparency in relation to the Declarations of Interest ('DoI') by the Executive Director, seconded national experts and experts in relation to items on the agendas of meetings of the Agency's ad hoc Working Groups as provided for in Article 12 of ENISA's Founding Regulation[9]. The Ombudsman pointed out that these DoIs are not available on ENISA's website. ENISA requested clarifications and guidance concerning the content of DoIs, which the Ombudsman provided. It expressed its commitment to developing the relevant templates and to publishing the DoIs on its website. 

25. The Ombudsman congratulates ENISA on its website, which is user-friendly, easy to navigate and informative. While he finds the reasons underpinning ENISA's language policy regarding publications to be adequate, he encourages ENISA to make available in all 23 official languages at least the homepage of its website, as well as information on its functions and language policy. By greeting citizens who visit the website in their own language and by explaining its functions to them, ENISA would demonstrate clearly that it recognises that all citizens of the European Union have a legitimate interest in its work.

26. ENISA provides the public with a vast amount of information mainly relating to its core activities, as well as sufficient information regarding financial and organisational matters. It has adopted a proactive approach to the dissemination of information, principally through online publications, and should be applauded in that respect. The Ombudsman also applauds the mechanisms ENISA has put in place to ensure the efficient handling of contacts from the public and its e-mail workflow system.

27. As regards access to documents, and pending the adoption of provisions intended to implement Regulation 1049/2001, ENISA could consider (a) creating a dedicated page on its website which would identify the rules applicable to requests for access to documents and the responsible contact person, (b) producing an annual report on its handling of requests for public access to documents, and (c) establishing a public register of its documents.

28. ENISA should ensure that the DoIs of the Executive Director and seconded national experts are published on its website and the Ombudsman welcomes ENISA's commitment to doing so.

(C) Selection and recruitment

29. With regard to the substance of selection and recruitment decisions, the Ombudsman takes an approach similar to that of the Court of Justice of the EU. This means, among others, that he recognises the administration's wide discretionary powers in selecting its staff. With regard to the procedural aspects of selection and recruitment, the Ombudsman has very actively worked to increase transparency in EU recruitment. His efforts have, for instance, led to enhanced transparency regarding the names of members of selection boards, and more detailed evaluation sheets providing candidates with a better insight into how they were assessed.

30. The Ombudsman noted that ENISA publishes on its website information on its application procedure and on open and closed vacancies. The Ombudsman asked ENISA to provide clarifications on the following issues:

"a) How does ENISA ensure effective communication with candidates who participate in selection procedures concerning the status of their applications and/or the outcome of the selection procedure?

b) Are the names of selection board members known to candidates? To what extent does ENISA provide candidates with access to the assessments of their applications?

c) To what extent does ENISA seek quicker and less formal means of resolving disputes over selection and recruitment decisions than the ones foreseen in Article 90 of the Staff Regulations?

d) Does ENISA systematically inform candidates that they may complain to the Ombudsman, as provided for in Article 19 of the Code?"

31. ENISA provided information regarding its selection procedures. It stated that, in March 2012, it adopted improved guidelines for transparency in its selection procedures. According to these guidelines, the threshold to be admitted to an interview is set before applications are received. Moreover, all candidates are kept fully informed at all stages of the procedure. Unsuccessful candidates are systematically informed after the screening of the applications. Requests for additional information in relation to recruitment procedures may be addressed to a dedicated e-mail address. The candidates' marks are made known to them.

32. Candidates are informed of the possibility of bringing a formal complaint in accordance with Article 90(2) of the Staff Regulations. It appears that ENISA does not to inform candidates about their right to either lodge a complaint with the Ombudsman or bring a case before the Civil Service Tribunal. In this regard, the Ombudsman wishes to encourage ENISA to inform individuals of the two aforementioned possibilities for challenging an unfavourable decision.

33. ENISA further stated that the names of the members of its selection boards are not disclosed or made public. It explained that non-disclosure aims to protect the selection board from outside pressure. It noted that staff members would hesitate to participate in selection boards if their names were disclosed. The Ombudsman explained that disclosure of the names of selection board members is in line with the Court's case-law on the matter. The secrecy relating to the deliberations and proceedings of selection boards was introduced with a view to guaranteeing the independence of these boards and the objectivity of their proceedings. It protects them from all external interference and pressure[10].  Observance of this secrecy therefore precludes the disclosure of the views adopted by individual members of selection boards. However, the Ombudsman has consistently taken the view that the right to keep secret the individual views of selection board members is not the same as keeping their identities secret[11].

34. The Ombudsman notes that the institutions' views on the correct balance between openness and the legitimate needs of confidentiality in the work of selection boards have evolved in the direction of giving greater weight to openness[12]. He points out that the established practice within both EPSO and the Commission is to disclose the names of selection board members. In the Ombudsman's view, such a practice guarantees transparency in selection procedures, helps to build and maintain public trust in the EU institutions, bodies, offices and agencies and reassures candidates that the selection procedure has not been vitiated by conflicts of interest. In light of the above considerations, ENISA could reconsider its position regarding disclosure of the names of selection board members. 

(D) Tenders and contracts

35. At the review level, disputes in relation to tender decisions and contractual relationships are most commonly dealt with by the courts. However, over the years, a significant proportion of the Ombudsman's cases has concerned these areas as well. In relation to tenders, the Ombudsman draws inspiration from the Court of Justice's approach, which is to recognise the administration's broad discretionary powers in assessing the substantive aspects of tender proposals, while carefully checking whether it gave valid and adequate reasons for its decisions and whether it adequately respected applicable procedures and information rights. In relation to contractual disputes, the Ombudsman does not, as such, assess whether there is a breach of contract. He does, however, thoroughly examine whether the administration provided good reasons for its position, and also looks into the fairness of administrative actions or omissions.

36. In view of the above, the Ombudsman wished to be informed of how ENISA handles disputes in relation to these areas.

37. ENISA presented the main elements of the procedure it follows in tender cases. It informed the Ombudsman that it pays due regard to the provisions of the Financial Regulation[13] and that it ensures respect for the principles of transparency and equal treatment by making sure that all tenderers are given information simultaneously. ENISA underlined that it applies the Financial Regulation also in respect of low cost tenders. When tenderers make requests for additional information, ENISA provides the breakdown of its evaluation even if not requested. ENISA deals with requests for further information as requests for access to documents.

38. In the course of the discussion and in response to a question from the Ombudsman about ENISA's practices in relation to subcontractors, ENISA provided an example of a case in which it intervened in order to ensure that the subcontractor received the correct payment under the contract. The Ombudsman welcomed this approach and characterised it as an example of good administrative practice.

39. On the question of whether tenderers and contractors are informed that they can complain to the Ombudsman, ENISA stated that it informs tenderers of their right to submit a complaint to the Ombudsman both in the contract award notice for all open procedures and in the relevant section of its website. The Ombudsman acknowledged ENISA's proactive approach but pointed to his letter of 5 July 2012 to the Agency in which he noted that the 'Contract Award Notice' available on the Agency's website presents the Ombudsman as a "[b]ody responsible for mediation procedures", which could be misleading. In addition, the Ombudsman noted that his contact details provided are no longer valid. ENISA replied that the contract award notice template is provided by the Publications Office and that, as far as it is concerned, ENISA aims to provide correct information about the role of the Ombudsman in tender cases.

40. In the Ombudsman's view, both the application to all tenderers of the principles laid down in the Financial Regulation and ENISA's approach towards subcontractors constitute examples of good administrative practice. Furthermore, the Ombudsman considers that the information ENISA gives to tenderers and contractors concerning his role in receiving complaints is satisfactory.  

(E) Ethical Issues

41. The Ombudsman examines ethical issues under the following broad subheadings: first, the Public Service Principles, second, conflicts of interest, and, third, whistleblowing.

Public Service Principles

42. On 19 June 2012, the Ombudsman published the Public Service Principles for the EU Civil Service[14]. His main aim in publishing the principles was to help build greater trust between citizens and the EU institutions. The principles take account of best practice in the Member States and were established following an extensive period of reflection and public consultation. As the public consultation confirmed, the public service principles are not new, but represent existing expectations of citizens and civil servants. They constitute the fundamental ethical standards that govern the conduct of EU civil servants. The principles also guide them towards the right decision in situations where they should exercise judgment. As such, they constitute a vital component of the administrative culture of service to which the EU institutions adhere.

43. ENISA presented the actions it has taken to instil a culture of service in its work. As mentioned above under heading (A), ENISA provides training not only on the Code but also on the Staff Regulations. Moreover, the values of transparency and honesty also feature in ENISA's internal policy on Crisis Communication.

44. The Ombudsman acknowledges ENISA's adherence to high ethical standards. In his view, it would be highly desirable if ENISA were to ensure that all members of its staff are informed of the public service principles. The Ombudsman also encourages ENISA to make the public service principles available on its website. That way, citizens would be informed that it subscribes to those principles.

Conflicts of Interest

45. Conflicts of interest arise when persons who work for the public administration may be perceived as having an inappropriate personal interest in a matter with which they are dealing. Such conflicts need to be handled appropriately in order to ensure objective decision-making, and to enhance the public's trust in the administration. Recent events and cases show that the EU administration does not enjoy the public's full confidence in relation to this issue.

46. Having regard to Articles 11[15] and 13(2)[16] of ENISA's Founding Regulation, the Ombudsman asked ENISA to provide information on the concrete measures it takes in order to avoid conflicts of interest in relation to:

a) the recruitment of staff, including senior staff;

b) the conduct of current and former staff members, notably regarding external activities during and after their service at ENISA (see, for instance, Articles 11, 11a, 12b, and 16 of the Staff Regulations concerning staff members and Article 13 of ENISA's Founding Regulation concerning members of the Management Board, the Executive Director, and the Permanent Stakeholders Group); and

c) the implementation of Article 11 of its Founding Regulation.

47. In its presentation, ENISA explained that the type of conflicts of interest that ENISA's staff members may face must be viewed in relation to the Agency's mandate. The Commission proposal for a Regulation that will amend ENISA's Founding Regulation will provide more specific guidelines concerning conflicts of interest. ENISA acknowledged the difficulties it faces in developing the appropriate templates in relation to the DoIs by its Executive Director and seconded national experts, which have been analysed above under heading (B), and in providing the necessary information to the public in accordance with Article 12(2) of its Founding Regulation. ENISA reiterated its commitment to addressing the issue.

48. The Ombudsman has stated on several occasions that EU institutions, bodies, offices and agencies should do their utmost to avoid not only actual but also apparent conflicts of interest, in order to maintain public trust and confidence in their activities and to protect their staff from unjustified suspicion. In this regard, it would clearly be appropriate if ENISA could adopt the concrete measures on conflict of interest issues set out in its Founding Regulation in order to comply with its legal obligations. In this regard, ENISA could develop templates for the DoIs of the Executive Director and seconded national experts and could ensure that these DoI are made available on its website. The Ombudsman welcomes the fact that ENISA expressed its willingness to do so.

Whistleblowing

49. The Ombudsman asked ENISA to provide information about any arrangements it has in place for internal whistleblowing and about any whistleblowing cases.

50. In its presentation, ENISA noted that Article 22a of the Staff Regulations does not provide a complete answer to the challenges of whistleblowing. Furthermore, it drew the Ombudsman's attention to OLAF's practice of encouraging whistleblowers to turn directly to it. Next, ENISA briefly presented the whistleblowing cases it has dealt with recently. The Ombudsman encouraged ENISA to inform staff about the option provided by the Staff Regulations to report the possible existence of illegal activity internally first.

Summary of the Ombudsman's suggestions

51. On the basis of his visit and the information provided to him by ENISA, the Ombudsman makes the following suggestions:

a)  ENISA could make its commitment to the principles set out in the European Code of Good Administrative Behaviour more visible to Union citizens by providing a link to the Code on its website.

b) Pending the adoption of provisions intended to implement Regulation 1049/2001, ENISA could consider (a) creating a dedicated page on its website which would identify the rules applicable to requests for access to documents and the responsible contact person, (b) producing an annual report on its handling of requests for public access to documents, and (c) establishing a public register of its documents.

c) ENISA could consider making available in all 23 Treaty languages at least the homepage of its website, as well as information on its functions and language policy. By greeting citizens who visit the website in their own language and by explaining its functions to them, ENISA would demonstrate clearly that it recognises that all citizens of the European Union have a legitimate interest in its work.

d)  With a view to further improving the information provided to candidates in selection and recruitment procedures, ENISA could inform candidates of their rights to challenge an unfavourable decision. These are the right to complain to the Ombudsman and the right to bring an action before the Civil Service Tribunal.

e) ENISA could reconsider its position regarding disclosure of the names of selection board members[17]

f) ENISA could ensure that all its staff members are informed of the public service principles for EU civil servants. It could consider making the public service principles available on its website. That way, citizens would be informed that it subscribes to those principles.

g) ENISA could adopt the concrete measures on conflict of interest issues set out in its Founding Regulation in order to comply with its legal obligations. In this regard, ENISA could develop templates for the Declarations of Interest of the Executive Director and seconded national experts and it could ensure that these Declarations of Interest are made available on its website.

h) ENISA could consider informing staff about the option provided by the Staff Regulations to report the possible existence of illegal activity internally first.

I would appreciate if ENISA could report back to me by 31 January 2013 on its follow-up to the suggestions listed above.

Nikiforos Diamandouros

Done in Strasbourg on 24/10/2012



[1] Information on previous visits to the EU agencies is available on the following page of the Ombudsman's website: www.ombudsman.europa.eu/activities/visits.faces

[2] Regulation (EC) No 460/2004 of the European Parliament and of the Council of 10 March 2004 establishing the European Network and Information Security Agency, OJ 2004 L 77, p. 1.

[3] OJ 2011 L 165, p. 3.

[5] Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents, OJ 2001 L 145, p. 43.

[6] 'Internal rules of operation on the practical arrangements for implementing transparency and confidentiality rules for the European Network and Information Security Agency', Decision of the Management Board, 29 September 2006, available at http://www.enisa.europa.eu/about-enisa/structure-organization/management-board/minutes-decisions-1/decision_08.pdf

[7] "The Management Board shall adopt arrangements for implementing the Regulation (EC) No 1049/2001 within six months of the establishment of the Agency."

[8] "The Management Board shall adopt the Agency's internal rules of operation on the basis of a proposal by the Commission."

[9] The second sentence of Article 12(2) provides that ENISA shall "... make also public the Declarations of Interest made by the Executive Director, seconded national experts and experts in relation to items on the agendas of meetings of the ad hoc Working Groups".

[10] See, for example, case 89/79 Bonu v Council [1980] ECR I-553, paragraph 5.

[11] Decision of the European Ombudsman closing his inquiry into complaint 2586/2010/(ML)TN against the European Personnel Selection Office (EPSO). See also decision of the European Ombudsman closing his inquiry into complaint 3115/2009/RT against the European Commission; special report from the European Ombudsman to the European Parliament following the own-initiative inquiry into the secrecy which forms part of the Commission’s recruitment procedures (1004/97/(PD)GG); decision of the European Ombudsman on complaint 674/2004/(MF)PB against the European Commission and the European Personnel Selection Office.

[12] Decision of the European Ombudsman on complaint 812/2004/MHZ against the European Personnel Selection Office.

[13] Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities, OJ 2002 L 248, p. 1, as amended.

[15] Article 11 of ENISA's Founding Regulation provides: "[t]he Executive Director, as well as officials seconded by Member States on a temporary basis shall make a declaration of commitments and a declaration of interests indicating the absence of any direct or indirect interests, which might be considered prejudicial to their independence. Such declarations shall be made in writing.

2. External experts participating in ad hoc Working Groups, shall declare at each meeting any interests, which might be considered prejudicial to their independence in relation to the items on the agenda."

[16] Article 13(2) of ENISA's Founding Regulation provides: "Members of the Management Board, the Executive Director, the members of the Permanent Stakeholders Group, external experts participating in ad hoc Working Groups, and members of the staff of the Agency including officials seconded by Member States on a temporary basis, even after their duties have ceased, are subject to the requirements of confidentiality pursuant to Article [339] of the Treaty [on the Functioning of the European Union].

[17] Draft recommendation of the European Ombudsman in his own-initiative inquiry OII/4/2012/CK concerning the European Centre for the Development of Vocational Training (Cedefop) available at http://www.ombudsman.europa.eu/en/activities/visitreport.faces/en/12072/html.bookmark