Decision of the European Ombudsman on complaint 181/2003/ELB against the European Commission

Strasbourg, 5 December 2003

Dear Mr X.,

On 24 January 2003, you made a complaint to the European Ombudsman concerning the publication of your name on the list of candidates for the post of European Data Protection Supervisor, published on the Commission's website.

On 18 February 2003, I forwarded the complaint to the President of the Commission. The Commission sent its opinion on 26 May 2003. I forwarded it to you with an invitation to make observations, which you sent on 30 August 2003.

I am writing now to let you know the results of the inquiries that have been made.

THE COMPLAINT

In summary, the relevant facts according to the complainant appear to be as follows:

The complainant applied for the post of European Data Protection Supervisor. The list of candidates for this post was published on the Commission's website. The complainant asked the Commission to remove his name from the list. However, the Commission refused to comply with this request.

The complainant alleges that the publication of his name on the Commission's website is a violation of data protection rules. He claims that his name should be deleted from the list and that damages should be awarded on account of the disclosure of personal data without his consent.

THE INQUIRY

The Commission's opinion

The Commission's opinion on the complaint can be summarised as follows:

Regulation (EC) No 45/2001 of the European Parliament and the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data(1) makes provision for the establishment of an independent supervisory authority, called the European Data Protection Supervisor.

According to Article 3 of Decision No 1247/2002/EC of the European Parliament, of the Council and of the Commission of 1 July 2002 on the regulations and general conditions governing the performance of the European Data Protection Supervisor's duties(2), "The European Data-protection Supervisor and the Assistant Supervisor shall be appointed following a public call for candidates. (...) The list of candidates shall be public (...)".

A public call for candidates for appointment as European Data Protection Supervisor and Assistant Supervisor was published in the Official Journal no. C 224 A of 20 September 2002. The public call for candidates included in Annex 2 Decision No 1247/2002/EC.

The complainant applied for the post of European Data Protection Supervisor on 27 September 2002.

In accordance with Decision No 1247/2002/EC, the list of the 306 candidates for the post of European Data Protection Supervisor and Assistant Supervisor was published on the website of the Commission at the following address: http://ec.europa.eu/internal_market/en/dataprot/application/docs/candidates-list.pdf. This list only mentioned the surnames and first names of the candidates in alphabetical order.

On 16 January 2003, the complainant sent a message to the Commission, in which he complained about the fact that his name had been mentioned on the website. He requested that his name be deleted from the list.

On 4 February 2003, the Commission replied to the complainant, explaining the reasons why it felt that it could not withdraw the complainant's name from the list.

The arguments of the Commission were, in summary, as follows:

1) On an alleged violation of the rules on data protection because of the publication of the name of the complainant on the Internet site of the Commission.

Article 3 of Decision No 1247/2002 states: "The European Data-protection Supervisor and the Assistant Supervisor shall be appointed following a public call for candidates. (…). The list of candidates shall be public (...)". This obligation was based on the transparency principle and aims at assuring citizens that the appointment is regular. The publication of the list was consequently a processing of personal data, which was necessary for complying with the legal obligation to which the controller is subject. Such a processing should be considered as lawful in accordance with Article 5 of Regulation 45/2001.

The Commission considered that, in the information society, Internet was a first-rate tool for disseminating public information. Moreover, the personal data published in the list was restricted to the surnames and first names of candidates, which is the bare minimum to comply with the obligation of publication.

This obligation was mentioned in the Official Journal together with the call for candidates. The complainant must therefore be assumed to have been aware of this obligation.

Consequently, the Commission considered that, in publishing the complainant's name in the list of candidates for the post of European Data Protection Supervisor, it had not failed to comply with its obligations in accordance with data protection rules, in particular Regulation 45/2001.

2) The complainant's claim that his name should be deleted from the list and that damages should be awarded on account of the disclosure of personal data without his consent.

According to Article 288 of the EC Treaty, the Community shall, in accordance with the general principles common to the laws of the Member States, make good any damage caused by its institutions or by its servants in the performance of their duties.

According to established case law, non-contractual liability can be found if the claimant proves that the behaviour of the institution is illegal, that damage has occurred and that there is a causal link between this behaviour and the damage.

Regarding the illegality of the behaviour of the institution, the Commission considered that the publication of the complainant's name on the Internet site of the Commission was not illegal.

As to damages, the complainant had not demonstrated that he had suffered any prejudice.

Regarding the causal link between the two previous elements, no causal link could be established.

Consequently, the Commission considered that the publication in question did not give rise to any non-contractual responsibility of the Community and that thus the claim for damages of the complainant should be rejected.

The complainant's observations

In his observations, the complainant maintained his complaint. He expressed the view that publishing his name on the Internet was an invasion of his privacy and had personal implications for him, notably regarding his current job and employer.

THE DECISION

1 The scope of the Ombudsman's inquiry

1.1 From the complainant's observations on the opinion sent by the Commission, the Ombudsman understands that the complainant considers that the publication of his name also constituted an interference with his private life. According to the complainant, this aspect had already been raised in his complaint. In the Ombudsman’s view, however, there was nothing to indicate that the complainant wished to complain about an interference with his private life as well. It should also be noted that when the Ombudsman informed the complainant that he had asked the Commission on his allegation that the latter had infringed data protection rules, the complainant did not object to this interpretation of his complaint. The Ombudsman therefore considers that by arguing that the publication of his name constituted an interference with his private life, the complainant has submitted a new allegation.

1.2 The Ombudsman considers that he disposes of all the information he needs to deal with the original complaint submitted by the complainant. It further appears that the complainant has not made any prior approaches to the Commission regarding his view that the publication of his name also constituted an interference with his private life. In these circumstances, the Ombudsman considers that it would not be appropriate to extend the scope of the present inquiry to this new allegation, given that doing so would inevitably delay the decision on the original complaint.

1.3 The complainant is of course free to address his further allegation to the Commission and to submit a new complaint to the Ombudsman in case the Commission should fail to provide a satisfactory answer.

2 Alleged violation of data protection rules

2.1 The complainant alleges that the publication of his name on the Commission's website is a violation of data protection rules. He claims that his name should be deleted from the list and that damages should be awarded on account of the disclosure of personal data without his consent.

2.2 The Commission considers that, in publishing the complainant's name in the list of candidates for the post of European Data Protection Supervisor, it did not fail to comply with its obligations in accordance with data protection rules, in particular Regulation (EC) No 45/2001 of the European Parliament and the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by Community institutions and bodies and on the free movement of such data(3). It points to Article 3 of Decision No 1247/2002/EC of the European Parliament, of the Council and of the Commission of 1 July 2002 on the regulations and general conditions governing the performance of the European Data Protection Supervisor's duties(4), which provides: "The list of candidates shall be public (...)". In the Commission’s view, this obligation is based on the transparency principle and aims at assuring citizens that the appointment is regular. According to the Commission, the publication of the list is consequently a processing of personal data, which is necessary for complying with the legal obligation to which the controller is subject. Such a processing should be considered as lawful in accordance with Article 5 of Regulation 45/2001. The Commission also points out that the personal data published in the list was restricted to the surnames and first names of candidates, which is the bare minimum to comply with the obligation of publication. The Commission argues that in these circumstances, the publication in question does not give rise to any non-contractual responsibility of the Community and that thus the claim for damages of the complainant should be rejected.

2.3 The Ombudsman recalls that Regulation 45/2001, which deals with the protection of individuals with regard to the processing of personal data by Community institutions and bodies and on the free movement of such data, was adopted to comply with Article 286 of the Treaty. This provision requires the application to Community institutions and bodies of Community acts on the protection of individuals with regard to the processing of personal data and the free movement of such data. Regulation 45/2001 establishes the principle that personal data may only be processed if certain conditions are fulfilled. According to Article 5 (b), for example, such processing is permitted if it is "necessary for compliance with a legal obligation to which the controller is subject".

2.4 The Ombudsman notes that Article 3 of Decision No 1247/2002 provides that “the list of candidates shall be public". The Commission’s argument that it published the names of the candidates in order to comply with the legal obligation thus appears to be reasonable. The complainant does not appear to argue that the relevant obligation set out in Article 3 of Decision No 1247/2002 could in itself be contrary to data protection rules. The Ombudsman further considers that the Commission’s view that it could comply with the said obligation by publishing the names of the candidates on the Internet is acceptable and in accordance with the principle of openness to which the European Union is committed, as reflected notably in Article 1 of the Treaty on European Union. It should also be noted that the complainant ought to have been aware of the contents of Article 3 of Decision No 1247/2002 and thus of the fact that his name would be published. The Ombudsman therefore takes the view that the interpretation by the Commission of Regulation 45/2001 in this case is justified.

2.5 In these circumstances, there appears to have been no maladministration on the part of the Commission.

3 Conclusion

On the basis of the Ombudsman's inquiries into this complaint, there appears to have been no maladministration by the Commission. The Ombudsman therefore closes the case.

The President of the Commission will also be informed of this decision.

Yours sincerely,

 

P. Nikiforos DIAMANDOUROS

---

(1) OJ 2001 no. L 8, p. 1.

(2) OJ 2002 no. L 183, p. 1.

(3) OJ 2001 no. L 8, p. 1.

(4) OJ 2002 no. L 183, p. 1.