Background to the complaint

1. EU funding is managed either by the European Commission directly (‘direct management’), jointly with the Member States (‘shared management’), or through implementing partners (‘indirect management’).[1] The Commission has to ensure that entities implementing Union funds under indirect management have appropriate systems, rules and procedures in place to ensure that the financial interests of the EU are protected.[2] This is done through a so-called ‘pillar assessment’ that is often carried out by an external auditor and that is based on a set of ‘terms of reference’ established by the Commission.[3]

2. The complainant, a journalist, sought public access[4] to all documents and correspondence related to the pillar assessment of an international organisation that is implementing EU funds in the area of migration under indirect management.

3. Amongst other documents, the Commission identified a 2014 and a 2020 pillar assessment report as falling within the scope of the complainant’s request. The reports had been drawn up by an external auditor. The Commission refused to give access to the two reports, relying on the need to protect personal data[5] and commercial interests[6].

4. The Commission argued that disclosure of the reports would undermine the intellectual property rights of the external auditor. Specifically, it said that the auditor had assessed the design and effectiveness of the relevant systems, controls, procedures and rules of the international organisation concerned. Parts of the reports could therefore be regarded as sufficiently creative to qualify as original work. The Commission added that the reports had been paid for and that they were intended for use by itself and the international organisation only.

5. The Commission also took the view that the reports contain commercially sensitive information on the international organisation, such as information on specific methodology, know-how and expertise, as well as the auditor’s findings and recommendations. The Commission concluded that disclosure of this information would undermine the commercial interests of both entities concerned.

6. Finally, the Commission found that there was no overriding public interest in disclosure.

7. Dissatisfied with this outcome, the complainant turned to the Ombudsman. The complainant did not challenge the redaction of personal data.

8. The Ombudsman opened an inquiry into the Commission’s refusal to grant public access to the two reports at issue based on the need to protect commercial interests. In the course of the inquiry, the Ombudsman inquiry team inspected the two reports as well as the Commission’s exchanges with the international organisation concerned, which it had consulted on the complainant’s access request.

The Ombudsman's proposal for a solution

9. In her proposal for a solution, the Ombudsman noted that, in order to apply the exception for the protection of commercial interests, an institution has to explain how disclosure of documents would specifically and actually undermine legitimate commercial interests. Moreover, the risk that the suspected damage occurs must be reasonably foreseeable and not purely hypothetical.[7]

10. After having reviewed the two reports at issue as well as the other documents to which the Commission had granted the complainant wide partial access, the Ombudsman considered that the non-disclosure of the reports in their entirety did not appear to be justified.

11. The Ombudsman took the view that only limited parts of the reports could reasonably be regarded as containing business secrets that deserve protection under the EU legislation on public access to documents (Regulation 1049/2001). Specifically, as regards the intellectual property rights of the external auditor, the Ombudsman noted that the templates the Commission developed for pillar assessments are mandatory. In addition, the review showed that the reports contain comments, findings and recommendations about the international organisation which could not be regarded as sensitive as such. It was therefore unclear how disclosure of large parts of the reports could undermine the commercial interests of the entities concerned.

12. As regards the limited parts of the reports that could reasonably be regarded as containing business secrets, the Ombudsman found that there did not seem to be an overriding public interest in disclosure.

13. Based on the above findings, the Ombudsman proposed that the Commission should re-consider its decision to refuse access (to the extent that it does not concern personal data) and provide wide partial access to the reports, explaining in detail, as regards any parts that it considers deserve protection under Article 4(2), first indent, of Regulation 1049/2001, how their respective disclosure would specifically and actually undermine the commercial interests of the international organisation concerned.^[8]

14. The Commission did not accept the Ombudsman’s proposal for a solution. Rather, it largely reiterated[9] the arguments presented in its confirmatory decision which the Ombudsman had already reviewed and disagreed with. The Ombudsman therefore asked the Commission for another reply, engaging with her detailed assessment in the proposal for a solution.

15. The Commission then gave examples of specific parts of the two reports that it deems to be commercially sensitive and provided additional explanations.[10] It argued that disclosure of identified weaknesses, findings and the detailed scores could undermine the public’s confidence in the international organisation and pose a reputational risk,[11] which might affect its potential cooperation with partners other than the Commission. This, in turn, could have a negative impact on the Commission’s relationship with the organisation.

16. The Commission also said that disclosure of the detailed descriptions and assessments of the international organisation’s internal rules and procedures could expose it to cyber threats and security breaches.

17. In addition, the Commission was concerned that potential future customers of the auditor might take into account how strict the pillar assessments at issue had been conducted.

18. As regards the applicable ‘terms and references’, the Commission stated that the reports are more detailed than the information that is publicly available. Specifically, the auditor is free to modify, complete and add information to the template and remains fully responsible for the assessment. Disclosure could thus distort the market competitiveness of the auditor, for example, if other competitors used the auditor’s methodologies to gain an advantage in future tenders.

19. The Commission concluded that there were not sufficient elements to overrule the objections of the author of the reports.

20. The complainant received a copy of the Commission’s replies, but did not provide any comments to the Ombudsman.

The Ombudsman's assessment after the proposal for a solution

21. The Ombudsman welcomes the detailed response now received from the Commission. She regrets, however, that this response was provided only upon a renewed request to engage with the detailed assessment set out in her proposal for a solution.

22. The Ombudsman further regrets that the re-assessment now conducted has not led the Commission to give partial access to the reports at issue.

23. The Ombudsman maintains her view, expressed in her proposal for a solution, that the reports do not appear to be sensitive throughout,[12] including considering that one of the reports was drawn up almost ten years ago. By way of example, it remains entirely unclear how information that is already publicly available, such as information on the organisational structure of the entity concerned or information on the scope of the pillar assessment, could possibly undermine commercial interests. The same is, for example, true for information that is very general in nature, such as many of the comments made by the entity and the auditor, including some of the specific findings and recommendations (or absence thereof). 

24. Based on the inspection of the documents, the Ombudsman also disagrees that certain non-public and more specific information, such as the detailed scores or certain findings, would pose a risk to the international organisation’s reputation. The Ombudsman notes in this context that, in the case-law cited by the Commission, the EU court found that it was unreasonable to refuse access to a report identifying deficiencies in an entity’s compliance with EU rules due to a potential reputational risk in its entirety and therefore annulled the Commission’s decision in question.[13] This is exactly what the Ombudsman tried to achieve in this case, the partial release of the documents.

25. In addition, the Ombudsman takes the view that an entity managing EU funding should expect a certain degree of transparency in relation to information about it, such as the one contained in the reports at issue. The Commission cannot curtail the right to access EU documents by committing to confidentiality in the terms of reference. It is regrettable that the terms of reference at issue seem to imply otherwise.

26. As regards a possible copyright claim by the author of the reports, the Ombudsman notes that the Commission does not seem to have consulted the external auditor who conducted the pillar assessment. In addition, the Commission itself considered in this context that only parts of the reports meet the required level of originality. The Ombudsman already noted in her solution proposal that the template for pillar assessments is compulsory. [14]

27. The Commission also raised concerns that possible future customers might base their decision on which audit firm they hire on how strictly a firm carries out pillar assessments. However, as far as the Ombudsman is aware, the identity of the external auditor has remained confidential.

28. In light of the above, the Ombudsman confirms her view that large parts of the reports at issue could not reasonably be considered to fall within the scope of the exception for the protection of commercial interests. The Commission should therefore have granted wide public access to the reports and, in view of its replies to the Ombudsman’s proposal for a solution, it remains unclear why it has not done so. The Ombudsman considers that the Commission’s refusal to partially disclose the two reports amounts to maladministration.

29. As the Commission has now reassessed the matter twice and has come to the same conclusion it adopted in its confirmatory decision, namely that access to the two reports must be refused in their entirety, the Ombudsman sees no useful purpose in making a formal recommendation at this stage and closes the case. It is regrettable that the Commission chose to take a defensive approach, rather than a citizen-minded one, and did not use the opportunity in the context of this inquiry to deliver greater transparency.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

There was maladministration by the European Commission in refusing to provide partial access to the two pillar assessment reports.

The complainant and the European Commission will be informed of this decision.

 

Emily O'Reilly
European Ombudsman

Strasbourg, 24/11/2023

 

[1] For more information on the different management types for EU funds, visit: https://commission.europa.eu/funding-tenders_en.  

[2] Article 154 of Regulation 2018/1046 on the financial rules applicable to the general budget of the Union (‘Financial

Regulation’): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1046.

[3] More information about the terms of reference for the pillar assessments is available at: https://international-partnerships.ec.europa.eu/policies/audit-and-control_en#terms-of-reference-for-pillar-assessments.

[4] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents:

https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32001R1049.

[5] In accordance with Article 4(1)(b) of Regulation 1049/2001.

[6] In accordance with Article 4(2), first indent of Regulation 1049/2001.

[7] See, for example, judgment of the Court of First Instance of 13 April 2005, VKI v Commission, T-2/03, paragraph 69:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62003TJ0002&qid=1666343897772.

[8] For further information on the background to the complaint, the parties' arguments and the Ombudsman's inquiry, please refer to the text of the Ombudsman's proposal for a solution (some parts are confidential and have been redacted), available at: https://www.ombudsman.europa.eu/en/solution/en/170463.

[9] The Commission’s reply to the Ombudsman’s proposal for a solution is available at: https://www.ombudsman.europa.eu/en/doc/correspondence/en/170464.

[10] The Commission’s additional reply to the Ombudsman is available at: https://www.ombudsman.europa.eu/doc/correspondence/178187.

[11] The Commission referred to the judgment of the General Court of 5 December 2018, Falcon v Commission, T-875/16: https://curia.europa.eu/juris/document/document.jsf?text=&docid=208484&pageIndex=0&doclang=FR&mode=lst&dir=&occ=first&part=1&cid=1333680.

[12] The Ombudsman already acknowledged in her solution proposal that parts of the documents can reasonably be considered to be commercially sensitive.

[13] See Falcon v Commission (cited in footnote 12 above), paragraphs 100ff.

[14] Commission decision of 17 April 2019 establishing new terms of reference for the pillar assessment methodology to be used under Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council.