Background to the complaint

1. One of the tasks of the European Anti-Fraud Office (OLAF) is to conduct independent administrative investigations into serious misconduct by staff and members of the EU institutions. Following its investigations, OLAF can make recommendations for actions to be taken by the EU institution concerned, including ‘disciplinary recommendations’ aimed at sanctioning wrongdoing by the person(s) concerned[1]. Through its annual report, OLAF informs the public about the number of disciplinary recommendations it made to the EU institutions concerned in a given period and provides aggregated information on the follow-up actions taken by the competent EU institutions or bodies.[2]

2. The complainant, a journalist, wanted to know more about OLAF’s findings and the EU institutions’ follow-up. To this end, he made several requests for public access to documents[3] to relevant EU institutions, including, in June 2024, to the Commission concerning a closed investigation referred to in OLAF’s annual report for 2022.

3. According to this annual report, the investigation concerned possible financial irregularities and breaches of statutory obligations by an EU staff member, consisting mainly of allegations of favouritism of external contractors and potential conflicts of interest with family members[4]. OLAF issued a recommendation to the Commission to initiate disciplinary proceedings against the EU staff member concerned. The Investigation and Disciplinary Office of the Commission (IDOC) was in charge of the follow-up.

4. More specifically, the complainant asked for:

• Copies of all communications between OLAF and the Commission relating to this matter, including OLAF’s recommendation;
• The Commission’s case file on the related disciplinary proceedings including (a) a copy of any final written report and appendices, (b) a copy of any preliminary report and appendices and (c) correspondence between the Commission and the staff member in question.

5. In July 2024, the Commission replied to the request, identifying 23 documents in relation to the disciplinary proceedings[5]. It refused access to the documents in their entirety, stating that disclosure would undermine the protection of privacy and the integrity of individuals under the EU legislation on public access to documents (Regulation 1049/2001) and on personal data protection (Regulation 2018/1725).[6]

6. The complainant asked the Commission to review its decision (by submitting a ‘confirmatory application’).

7. After a delay[7], the Commission issued its final decision, in which it confirmed the refused access.[8] In doing so, the Commission invoked a general presumption of confidentiality arising from the protection of the purpose of investigations.[9] The Commission also argued that public access cannot be granted to protect the personal data contained in the documents[10].

8. Dissatisfied with the Commission’s refusal to grant any public access to the documents requested, the applicant turned to the Ombudsman in January 2025.

The Ombudsman's proposal for a solution

9. The Ombudsman opened an inquiry into the Commission’s refusal to give public access to the requested documents and her inquiry team carried out an inspection of the documents at issue.

10. Based on the inspection and the reasoning provided in the Commission’s confirmatory decision, the Ombudsman was not convinced that the Commission could rely on a general presumption of confidentiality of IDOC investigation files after the disciplinary sanction had already been imposed.

11. Even if a general presumption were to be recognised by the EU Courts for documents included in the administrative file of an IDOC investigation, such a general presumption would most likely be limited in time. Otherwise, it would be at odds with the general presumption of confidentiality recognised by the General Court in relation to OLAF investigation files,[11] which is time-limited.[12] It applies during the investigation and related follow-up proceedings, provided that a reasonable time for this follow-up has not yet elapsed[13].

12. Based on the inspection, the Ombudsman considered that there is only limited information in the documents that would need to be redacted to protect the purpose of investigations. While some redactions may be needed to prevent witnesses, informants or other actors involved being discouraged from cooperating in the future, the Ombudsman considered that such information does not concern the entirety of the documents.

13. While some parts of the documents might need extensive redactions to prevent the identification of individuals, the documents do not contain personal data throughout. Rather, it would seem that parts of the documents could be disclosed whilst protecting the privacy and integrity of individuals. More specifically, the Ombudsman found that the redacted documents could still provide an overview of the facts taken into account, the applicable staff rules and the analysis and conclusions at each step of the proceedings, as well as the ultimate outcome, including the nature of the sanction imposed.

14. In view of the above, the Ombudsman proposed that the Commission should re-consider its decision to refuse public access with a view to providing meaningful partial access to the requested documents, whilst protecting the privacy and integrity of the individuals mentioned in the documents[14].  

15. In reply[15], the Commission restated its view that files related to IDOC investigations meet the criteria established by the jurisprudence for the application of a general presumption of confidentiality, including files related to closed IDOC investigations.

16. It argued that access to documents related to IDOC investigations is incompatible with the nature of these investigations, which always concern the personal data of natural persons. Furthermore, the documents’ disclosure would undermine the rights of the person investigated under Article 2(2) of Annex IX of the Staff Regulations[16].

17. The Commission added that the nature of the protected interests requires the general presumption of confidentiality to apply to closed cases as well. It referred to the fact that the Court has extended the application of a general presumption of confidentiality to closed cases related to (i) State aid investigations[17] and (ii) OLAF investigations. The Commission stated that, even in closed OLAF cases, the Court found that public access to OLAF’s files, including OLAF’s final reports, would undermine the protection of the purpose of OLAF’s investigative activities[18].

18. The Commission also referred to its detailed rules on the application of Regulation 1049/2001, according to which “[t]here is a presumption that access to the following documents, inter alia, undermines interests protected by Article 4(1) to (3) of Regulation (EC) No 1049/2001: […] (j) documents being part of investigations of the Investigation and Disciplinary Office of the Commission”[19]. It specified that the Commission made use of its power under the Treaties to adopt its own rules of procedure that include as an annex the detailed rules in question. Article 15(3) of the Treaty on the Functioning of the European Union (TFEU)[20] and Regulation 1049/2001 recognise the power of the Commission to adopt specific provisions regarding access to its documents.

19. The Commission stated that it had, in any event, carried out an individual assessment of the requested documents. Based on this individual assessment, the Commission had come to the conclusion that no meaningful partial access could be provided as extensive redactions would be required to protect the purpose of IDOC investigations, including future investigations, and the privacy and integrity of the person concerned. Large parts of the documents would need to be redacted to protect not only the names of the persons involved (person investigated, witnesses and the other actors involved) but also any other elements that would make the persons identifiable.

20. The Commission added in this regard that it is not possible to disclose parts of the documents to provide an overview of the facts taken into account, the applicable staff rules and the analysis and conclusions at each step of the proceedings from the different bodies involved, as well as the ultimate outcome, including the nature of the sanction imposed, without making the persons identifiable. It stated that an overview of the facts would reveal, for instance, the Unit/Directorate-General where the person concerned works or worked. The higher the seniority of the person involved, the easier it is to identify him or her. Moreover, there are different staff rules applicable for IDOC investigations and different possible sanctions depending on the level of seniority of the person involved. The disclosure of this information could therefore make the person identifiable.

21. In his comments on the Ombudsman’s proposal for a solution and the Commission’s reply to it, the complainant argued that the Commission has improperly relied on a general presumption of confidentiality and that partial access is both possible and legally required.

22. For the complainant, the Commission’s reliance on its internal detailed rules cannot create a presumption that goes beyond Regulation 1049/2001. He considered that the Commission’s argument that the presumption applies indefinitely is incompatible with existing case-law.

23. The complainant added that the Commission’s refusal to disclose any meaningful content undermines the public’s ability to assess whether the disciplinary mechanisms under the Staff Regulations function effectively.

The Ombudsman's assessment after the proposal for a solution

24. The Ombudsman regrets the Commission’s rejection of her solution proposal and the confirmation of its view that a general presumption of confidentiality applies to the closed IDOC disciplinary proceedings at issue.

25. First, the Ombudsman does not agree with the Commission’s reading of the case law on the general presumption of confidentiality applicable to OLAF investigation files.

26. According to the Commission, “even in closed OLAF cases, the Court has found that public access to OLAF’s files or OLAF’s final reports would undermine the protection of the objectives of OLAF’s investigation activities”[21].

27. The Ombudsman considers that the judgment the Commission referred to does not support this conclusion.

28. In that case, the General Court held that the presumption of confidentiality of documents in OLAF’s investigation files extends to their follow-up, to the extent that that follow-up takes place within a reasonable period[22]. Given that a reasonable period for the follow-up had not yet elapsed in this specific case, the General Court upheld OLAF’s refusal of access[23]. This judgment cannot therefore be interpreted as recognising a general presumption of confidentiality that would apply indefinitely after the follow-up is closed.

29. As the Ombudsman noted in her solution proposal, the case law clearly states that the general presumption of confidentiality in relation to documents in OLAF investigation files, which is based on the need to protect the purpose of its investigations,[24] is time-limited.[25]

30. Second, the Commission referred to case law recognising a general presumption of confidentiality applicable to documents in State aid files[26]. The Commission did not, however, explain - in the confirmatory decision or in its reply to the solution proposal - how this line of case law could apply by analogy to closed IDOC investigations.  

31. Finally, the Ombudsman notes that the Commission’s new detailed rules for the application of Regulation 1049/2001,[27] referred to by the Commission in the confirmatory decision and in reply to the Ombudsman’s solution proposal, are currently contested before the General Court.[28] The detailed rules state that there is a presumption that access to “documents being part of investigations of the Investigation and Disciplinary Office of the Commission” undermines interests protected by Articles 4(1) to (3) of Regulation 1049/2001[29]. As the Ombudsman has noted in the context of previous inquiries,[30] unless and until the Court issues its judgment on the legality of these rules, the Ombudsman will not take a position on the detailed rules as such. As the detailed rules must in any case remain in line with Regulation 1049/2001[31], the Ombudsman will continue to assess the compliance of individual confirmatory decisions adopted by the Commission, which are brought to her attention, with Regulation 1049/2001, as interpreted by the EU courts, and the principles of good administration.

32. In this case, the Ombudsman considers that, in light of the existing case law, the Commission’s application of a general presumption of confidentiality to closed IDOC investigations files was not reasonable.

33. That said, the Ombudsman welcomes that the Commission did carry out an individual assessment of the documents in reply to her solution proposal.

34. However, the Ombudsman remains unconvinced by the additional explanations provided by the Commission to refuse any partial access based on an individual assessment.

35.  While the Ombudsman acknowledged in her solution proposal that some parts of the documents might indeed require extensive redactions to prevent the identification of individuals, her view was that it is still possible to disclose some information, notably on the outcome of the procedure, without disclosing personal data. For example, such partial access would not have required the Commission to reveal (directly or indirectly) the Directorate-General (DG) or the Unit in which the person concerned worked or works.

36. The Ombudsman recognises that revealing the level of seniority of an individual, depending on the case, may lead to the indirect identification of the person concerned. The higher the level of seniority, the lower the number of individuals that could be concerned. In this case, the Commission could have taken into consideration the (low or high) number of staff members in each category[32] to decide whether there was a risk of (in)direct identification of the person concerned.

37. The Ombudsman also acknowledged in her proposal for a solution that the requested documents may need to be redacted to some extent to prevent possible witnesses, informants or other actors involved being discouraged from cooperating in the future, so as to protect the purpose of IDOC investigations. However, for the Ombudsman, such reasonable and legitimate redactions could not go as far as covering the entirety of the documents in question.

38. Overall, the Ombudsman considers that the Commission’s individual assessment of the documents is based on an interpretation of the notion of personal data and the risk to the protection of investigations that is excessively broad, and arguably not in line with its obligation to apply the exceptions to public access strictly[33].

39. While she appreciates that redacting personal data is a delicate exercise, and extensive redactions to prevent the indirect identification of individuals would have been necessary in this case, some meaningful information could still have been disclosed.  

40. In light of the above, the Ombudsman finds that the Commission’s handling of this access request constituted maladministration.

41. As the Commission has reassessed its position on the complainant’s access request following the Ombudsman’s proposal for a solution and has come to the same conclusion as in its confirmatory decision, the Ombudsman sees no useful purpose in continuing this inquiry with a formal recommendation on the matter. She therefore closes the case.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

The Ombudsman finds that there was maladministration in how the Commission handled the complainant’s public access request.

The complainant and the Commission will be informed of this decision.

Teresa Anjinho
European Ombudsman

Strasbourg, 13/04/2026

 

[1] For more information, visit: https://anti-fraud.ec.europa.eu/about-us/what-we-do_en or https://anti-fraud.ec.europa.eu/investigations/internal-administrative-investigations_en.

[2] See, for example, the OLAF report 2022: https://ec.europa.eu/olaf-report/2022/investigative-activities/investigative-mandate/investigating-within-the-eu-institutions_en.html.

[3] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: http://data.europa.eu/eli/reg/2001/1049/oj.

[4] https://ec.europa.eu/olaf-report/2022/investigative-activities/investigative-mandate/internal-investigations_en.html#family-ties-and-conflict-of-interest.  

[5] The part of the request related to the OLAF final report and recommendation was dealt with by OLAF directly and then subject to the complaint 2327/2024/ACB.

[6] Article 4(1)(b) of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents, available at: https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32001R1049 ; Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, available at: https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng.

[7] This delay in issuing a confirmatory decision was the subject matter of the complaint in case 1935/2024/ACB.

[8] It also specified that OLAF’s final report with recommendation was not covered in the confirmatory decision in the present case because it was dealt with directly by OLAF. The handling of this part of the request by OLAF is the subject matter of another complaint to the Ombudsman (case 2327/2024/ACB).

[9] Under Article 4(2) third indent of Regulation 1049/2001.

[10] Under Article 4(1)(b) of Regulation 1049/2001.

[11] Under Article 4(2) third indent of Regulation 1049/2001.

[12] Judgment of the General Court of 1 September 2021, Homoki v Commission, T-517/19, paragraphs 60-63, available at: https://curia.europa.eu/juris/document/document.jsf?text=&docid=245503&pageIndex=0&doclang=FR&mode=req&dir=&occ=first&part=1&cid=8662129.

[13] Judgment of the General Court of 26 May 2016, IMG v Commission, T-110/15, paragraphs 33-35 available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62015TJ0110.

[14] The Ombudsman’s solution proposal available at: https://www.ombudsman.europa.eu/solution/217979.

[15] The Commission’s reply to the solution proposal available at: https://www.ombudsman.europa.eu/doc/correspondence/217980.

[16] Annex IX of Regulation No 31 (EEC), 11 (EAEC), laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Economic Community and the European Atomic Energy Community, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A01962R0031-20250513&qid=1764665155756#anx_IX.

[17] Judgment of the General Court of 5 October 2022, Ondřej Múka v European Commission, T-214/21, available at: https://curia.europa.eu/juris/document/document.jsf;jsessionid=A703319CCDAC760FD38969E012B47B06?text=&docid=266807&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=14541647.

[18] Judgment of the General Court of 26 May 2016, IMG v Commission, T-110/15, paragraph

33-36.

[19] The Commission’s detailed rules for the application of Regulation 1049/2001 referred to above.

[20] Available at: https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12008E015:en:HTML.

[21] Commission’s reply to the solution proposal, p. 6-7, referred to above.

[22] Judgment of the General Court of 26 May 2016, IMG v Commission, T-110/15, referred above, paragraph 35

[23] Judgment of the General Court of 26 May 2016, IMG v Commission, T-110/15, referred above, paragraphs 46-47.

[24] Under Article 4(2) third indent of Regulation 1049/2001.

[25] Judgment of the General Court of 1 September 2021, Homoki v Commission, T-517/19, paragraphs 60-63, available at: https://curia.europa.eu/juris/document/document.jsf?text=&docid=245503&pageIndex=0&doclang=FR&mode=req&dir=&occ=first&part=1&cid=8662129.

[26] Judgment of the General Court of 5 October 2022, Ondřej Múka v European Commission, T-214/21, referred to above.

[27] See the Commission’s detailed rules for the application of Regulation (EC) No 1049/2001 of the European Parliament and of the Council regarding public access to European Parliament, Council and Commission documents: link

[28] Case T-146/25, De Capitani and Others v Commission, information on the case available at: https://curia.europa.eu/juris/liste.jsf?lgrec=fr&td=;ALL&language=en&num=T-146/25&jur=T; Case T-641/25, ClientEarth v Commission, information on the case available at: https://curia.europa.eu/juris/document/document.jsf?text=&docid=306524&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1846572.

[29] See the Commission’s detailed rules for the application of Regulation (EC) No 1049/2001, referred to above, and more specifically its Article 4(2)(j).

[30] See decision in case 1405/2024/OAM, available at: https://www.ombudsman.europa.eu/en/decision/en/213196.

[31] In line with Article 15(3) of the Treaty on the Functioning of the European Union, which requires each institution, body, office or agency to “elaborate in its own Rules of Procedure specific provisions regarding access to its documents, in accordance with the regulations referred to in the second subparagraph”. The General Court held that Rules of Procedure adopted by the Commission (in Joined Cases T-371/20 and T-554/20, Pollinis v Commission, paragraph 93) or conclusions adopted by the Council (in case T-255/24, Nouwen v Council, paragraph 103) must remain in line with Regulation 1049/2001. In the latter case, the Court held that “[t]he scope of the obligations incumbent upon an EU institution under Regulation No 1049/2001, as interpreted by the Courts of the European Union, cannot depend on the content of acts, such as the Council’s conclusions, adopted by the institution concerned itself”.

[32] See human resources data published by the Commission every year: https://dashboard.tech.ec.europa.eu/qs_digit_dashboard_mt/public/sense/app/87fb97de-d12e-444a-a828-73a2e35242e4/sheet/b87ca14d-15a6-45dd-be10-b521cb0a0d82/state/analysis.

[33] Settled case-law stated for example in the judgment of the General Court of 1 September 2021, Homoki v Commission, T-517/19, paragraph 49, referred to above.