Background to the complaint

1. The collection of information from individual communication devices of migrants has become an increasingly frequent practice across EU Member States.[1] This data can then be used for security or for asylum purposes. In recent years, however, such extraction practice has generated public debate as regards its impact on the right to private and family life and on the protection of personal data.[2]

2. In November 2024, the complainant, a researcher, requested public access to documents held by the European Union Agency for Criminal Justice Cooperation (Eurojust) on data extraction from the communication devices of migrants in Greece. Specifically, the complainant requested access to a document mentioned in the minutes of an interinstitutional meeting in which Eurojust participated in 2016, as well as to ‘other internal documents’ related to the topic and ‘circulated within Eurojust and/or with any other EU agencies, bodies, institutions and/or Greek authorities during the period 1 June 2016-1 June 2017 and 1 January 2024-1 November 2024’.

3. Eurojust initially did not identify any documents. After the complainant asked the Agency to review its decision (by making a ‘confirmatory application’), Eurojust identified seven documents, one of which was already public. Eurojust provided partial access to the six remaining documents, withholding parts to protect the public interest as regards public security, as well as personal data.

4. Dissatisfied with how Eurojust handled his access request, and in particular with the partial access granted, the complainant turned to the Ombudsman in April 2025.

The inquiry

5. The Ombudsman opened an inquiry into Eurojust’s refusal to give (wider) public access to documents concerning the extraction of information from communication devices of migrants based on the need to protect the public interest as regards public security.

6. The complainant did not challenge the redaction of personal data, but noted that, in one document, redactions seemed to be too extensive to be covered by that exception only. During the inquiry, Eurojust acknowledged that a clerical error had been made, and disclosed the correct document to the complainant. The Ombudsman’s inquiry therefore did not cover the redaction of personal data.

7. During the inquiry, the Ombudsman inquiry team inspected the documents at issue, as well as the documentation on the third-party consultation conducted by Eurojust in relation to the request. The Ombudsman also received an additional written reply by Eurojust on the complaint.

8. The Ombudsman inquiry team met with Eurojust representatives in order to clarify a number of questions following the inspection of documents and, finally, received the complainant’s comments on the meeting report.

Arguments presented to the Ombudsman

9. Eurojust, in its confirmatory decision, emphasised the wide discretion that EU institutions enjoy when determining whether disclosure of a document to the public would undermine the public interest as regards public security. The Agency explained that disclosure of the redacted parts of the document would undermine public security because access could obstruct the attempts of authorities to prevent criminal activities and potentially impede cooperation between national authorities on matters relating to future terrorist cases and admissibility of evidence.

10. The complainant, in his complaint to the Ombudsman, argued that Eurojust made an excessive and unjustified use of the exception pertaining to the protection of the public interest as regards public security. Specifically, he considered that Eurojust had failed to demonstrate an actual and serious risk to public security resulting from disclosure, in particular in light of the passage of time. He highlighted that the documents at issue are from 2016 and 2017, and that, under Regulation 1049/2001, exceptions must apply only for the period during which protection is justified, on the basis of the content of the document.

11. In the meeting with the Ombudsman inquiry team, the Eurojust representatives further explained that the documents constitute an indivisible whole, where factual details, legal reasoning and operational assessments are tightly interwoven. Releasing fragments beyond what has already been disclosed would create a ‘mosaic effect’ and enable ill-intentioned individuals to reconstruct sensitive operational vulnerabilities. Eurojust representatives further explained that the mere passage of time does not suffice to render information non-sensitive. This is especially the case considering the type of work in which Eurojust is involved, which can be very lengthy. Information related to data extraction is still highly relevant to today’s context.

12. The Eurojust representatives nonetheless acknowledged that greater access to some parts of the documents could be provided, though this might not result in the disclosure of meaningful or relevant information to the complainant.

13. In his comments on the meeting report, the complainant welcomed what he considered to be Eurojust’s apparent willingness to reconsider its position on the access request.

The Ombudsman's proposal for a solution

14. Based on the inspection of the documents, the Ombudsman was not convinced that the exception invoked covered the redacted parts in their entirety. 

15. Specifically, and while acknowledging the relevance of data extraction as an investigative technique in criminal investigations (and thus that some elements need to be withheld to protect the public interest as regards public security), the Ombudsman recalled that the mere fact that a document concerns an interest protected by an exception does not suffice to justify the application of that exception.[3]

16. In that regard, it appeared that Eurojust had redacted information which was already in the public domain, and which in fact was disclosed by Eurojust as part of the same access request .The Ombudsman recalled that case law recognises that, in assessing the risk that a public interest may be undermined, institutions must take into account whether the essential content of the information requested has already been made public[4] - and if so, grant partial access to the documents concerned. Similarly, the Ombudsman noted that some of the information redacted appeared generic and/or outdated. This was all the more so considering the significant changes that have taken place in the domain of data extraction and retention over the past decade. In the Ombudsman’s view, this raised questions as regards the up-to-date nature - and thus the sensitivity - of the documents at issue, which were drafted almost ten years ago.

17. In light of the above, the Ombudsman proposed that Eurojust should reassess the documents at issue in the access request, with a view to granting wider (partial) access. She invited Eurojust to focus in particular on three documents (3, 5 and 7), with the subsequent necessary adjustments to two additional documents (1 and 2). 

18. In its reply, Eurojust agreed to give the complainant wide public access to the documents subject to the Ombudsman’s solution proposal. Eurojust explained that only one document (document 7) still needed to be withheld, as disclosure would undermine the public interest as regards public security, as well as the protection of personal data. Eurojust underlined that this was also the position of the Commission, which had been consulted on the disclosure of the document.

19. The complainant was overall satisfied with this outcome, though he maintained his view that partial access should have been provided to document 7. 

The Ombudsman's assessment after the proposal for a solution

20. The Ombudsman welcomes Eurojust’s positive response to her proposal for a solution and the wide access granted, which she considers has resolved the complaint. The Ombudsman appreciates Eurojust’s commitment to the principle that public access to its documents should be as wide as possible, as well as the Agency’s constructive engagement throughout this inquiry.

21. As regards the remaining document withheld, the Ombudsman takes note of the more extensive reasoning provided by Eurojust as to why that is the case, and invites the Agency to provide a similar level of explanation in future.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

The European Union Agency for Criminal Justice Cooperation has accepted the Ombudsman’s proposal for a solution by granting the complainant wider public access to the documents at issue.

The complainant and Eurojust will be informed of this decision.

Teresa Anjinho
European Ombudsman

Strasbourg, 06/10/2026

 

[1] European Network of National Human Rights Institutions (ENNHRI), 2024, ‘Technologies, migration, and human rights: the role of European NHRIS’, available at: https://ennhri.org/wp-content/uploads/2024/09/Technologies-migration-and-human-rights-the-role-of-European-NHRIs-an-ENNHRI-scoping-paper.pdf

[2] See, for instance, see Amnesty International 2024 report, ‘Defending the rights of refugees and migrants in the digital age’, available at: https://www.amnesty.be/IMG/pdf/rights_refugees_migrants_digital_age_20240205_expose_.pdf

[3] Judgement of 13 April 2005, Verein für Konsumenteninformation v Commission of the European Communities, T-2/03, paragraph 69, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62003TJ0002

[4] Judgement of 13 March 2019, Espirito Santa Financial Group v ECB, T-730/16, paragraphs 127 and 136, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62016TJ0730; and by analogy Judgment of 3 July 2014, Council v in ’t Veld, C‑350/12 P, paragraph 60, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0350