The background to the complaint

1. The present complaint concerns OLAF's handling of a request for access to documents submitted by the complainant under Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents[1] (hereinafter 'Regulation 1049/2001') and OLAF's alleged failure to grant the complainant access to information regarding the results of a closed investigation.

2. In September 2006, an Italian limited liability company, represented by the complainant, was the object of an on-the-spot investigation carried out by OLAF. The aim of the investigation was to check the account books and all the relevant documentation concerning certain projects co-financed by a Regional Operational Programme of the Region Friuli Venezia-Giulia, Italy.

3. In his initial request submitted to OLAF on 6 October 2006, the complainant asked OLAF to grant him access to the documents on the basis of which it decided to carry out the above-mentioned investigation.

4. On 21 March 2007, OLAF rejected the complainant's request. OLAF came to the conclusion that the exceptions laid down in Article 4(1)(b)[2] and Article 4(2) first indent[3] of Regulation 1049/2001 were relevant and applicable in this case. OLAF further stated that it evaluated the possibility to grant partial access, in accordance with Article 4(6) of Regulation 1049/2001[4]. However, it stressed that the above exceptions covered the documents to such an extent that the rest of the text would have been deprived of substance and would, therefore, have been meaningless. It thus concluded that partial access was not possible.

5. On 4 April 2007, the complainant submitted a confirmatory application, which was registered by OLAF on 13 April 2007. In a letter dated 21 May 2007, OLAF's Director-General fully confirmed the decision of 21 March 2007. He further stressed that the purpose of Regulation 1049/2001 is to give to the general public a right of access to documents of the institutions and not to lay down rules designed to protect the particular interest which an individual may have in obtaining access to the documents in question. The complainant's interest in obtaining access to the documents was an interest of a private nature and not a public interest within the meaning of Regulation 1049/2001. Furthermore, even if the complainant had expressly and unambiguously consented to public disclosure of his own personal data or the commercial information relating to his company which was included in the requested documents[5], these data could not be disclosed because the documents contained additional data relating to other parties, which were covered by the exceptions invoked.

The subject matter of the inquiry

6. The Ombudsman opened an inquiry into the following allegations and claim:

Allegations:

(1) The decision taken by OLAF to reject the complainant's request for access to documents was unfair since, in the complainant's view, the exceptions invoked by OLAF were not relevant in his case.

(2) OLAF failed to inform the complainant about the result of its investigation.

Claim:

OLAF should grant the complainant access to the documents requested and to the results of its investigation.

The inquiry

7. On 21 January 2009, the Ombudsman asked OLAF for its opinion on the complaint. At the same time, the Ombudsman announced that he would inspect the relevant file, in accordance with Article 2(2) and 3(1) of the Statute of the European Ombudsman. The Ombudsman also underlined that, in accordance with Article 5(2) and 5(3) of the Implementing Provisions of the European Ombudsman, the complainant would not have access to any confidential documents or confidential information obtained as a result of the inspection. OLAF submitted its opinion on 6 April 2009. It was forwarded to the complainant with an invitation to submit observations.

8. On 8 April 2009, the Ombudsman's services carried out an inspection of OLAF's file concerning the present case. The inspection took place at OLAF's premises in Brussels. On 9 June 2009, the Ombudsman received further information from OLAF in relation to the inspection.

9. On 8 June 2009, the Ombudsman received the complainant's observations on OLAF's opinion. On 21 July 2009, the Ombudsman sent a copy of his report on the inspection to OLAF and to the complainant. On 3 September 2009, the Ombudsman received comments from the complainant on the above-mentioned report.

10. Having analysed the information which the complainant and OLAF had provided him with, the Ombudsman decided to consult the European Data Protection Supervisor ('EDPS'), pursuant to the Memorandum of Understanding signed between the Ombudsman and the EDPS on 30 November 2006[6]. On 5 August 2010, the Ombudsman received the EDPS's opinion. It was forwarded to OLAF and to the complainant with an invitation to submit comments. Neither party submitted comments.

The Ombudsman's analysis and conclusions

A. Allegation that OLAF unfairly refused to grant access to the documents requested by the complainant and corresponding part of the claim

Arguments presented to the Ombudsman

11. The complainant alleged that OLAF's decision to reject his request for access to documents was unfair. He argued that the exceptions invoked by OLAF were not relevant in his case. In order to support his allegation, the complainant argued that the exception in Article 4(1)(b) of Regulation 1049/2001 was not applicable because any person who might have complained to OLAF concerning his company should have been ready to assume his or her own responsibilities. There was therefore no reason to invoke the exception concerning the protection of personal data. Regarding the exception in Article 4(2) first indent concerning the protection of commercial interests, the complainant argued that it was not applicable in light of the existing public interest in knowing on which basis OLAF decides to carry out its investigations.

12. In its opinion, OLAF stated that the application of Regulation 1049/2001 and of the rules on data protection must be objective and cannot be based on subjective considerations of the person affected by an investigation, such as the complainant in the present case. It further reiterated that the purpose of Regulation 1049/2001 is to give to the general public a right of access to documents of the institutions and not to lay down rules designed to protect the particular interest which an individual may have in obtaining access to the documents in question[7]. Article 4(1)(b) of the regulation expressly refers to the legislation of the Union regarding personal data and requires that the effect of disclosure on the data subject be taken into account. In this respect, OLAF stressed that both informants and whistleblowers are in a specific and sensitive situation.

13. OLAF further pointed out that the identity of informants and whistleblowers must not be disclosed to anyone other than judicial authorities[8].

14. Additionally, OLAF explained that the documents requested by the complainant contained information related to projects and beneficiaries other than the complainant, as well as commercial information about specific individuals. OLAF pointed out that, for this reason, the exception protecting commercial interests had been duly invoked.

15. Concerning the possibility to grant partial access, OLAF maintained the position already expressed in its replies to both the initial request and the confirmatory application submitted by the complainant. Specifically, it stressed that, as held by the General Court of the European Union in the Mattila case[9], institutions are "in any event entitled to refuse partial access in cases where examination of the documents in question shows that partial access would be meaningless because the parts of the document that could be disclosed would be of no use to the applicant".

16. The complainant's aim was to identify the informant whose information was at the origin of OLAF's investigation. Since the information requested was covered by the rules on data protection, everything in the document capable of identifying the informant would have had to be removed. As a consequence, the rest of the document would have been of no use to the complainant.

17. OLAF further stated that its position was in line with two opinions delivered by the EDPS on 23 June 2006 and on 4 October 2007. In these opinions, the EDPS essentially took the view that under no circumstances can the person accused in a whistleblower's report (or in an informant's report) obtain information about the identity of the whistleblower unless the whistleblower, or the informant, maliciously makes a false statement. OLAF stated that it had no reasons to suspect that this had happened in the present case.

18. In his observations, the complainant basically maintained his original position concerning this allegation.

Consultation of the European Data Protection Supervisor

19. The Ombudsman decided to consult the EDPS in order to clarify certain aspects of the case. In his letter to the EDPS, the Ombudsman specifically asked the latter: (i) to clarify whether the position he had taken in the two opinions referred to in paragraph 17 above was also applicable to the case at hand; and (ii) to explain whether the identity of informants or whistleblowers who provide OLAF with information should not be disclosed to anyone other than the judicial authorities. The Ombudsman further asked the EDPS to comment on whether the protection of informants or whistleblowers also has to be guaranteed after the closure of an investigation where there is no follow-up and, if so, in what way, and to what extent.

20. In his reply, the EDPS stated, as a preliminary remark, that he had drafted his reply on a policy rather than on an individual case level. As regards the first point made by the Ombudsman, the EDPS pointed out that the issue here concerned related to a data processing activity apparently conducted by OLAF in the context of an external investigation. The above-mentioned EDPS's opinion of 4 October 2007 regarding OLAF external investigations was, therefore, relevant to the case. Since that opinion referred to the EDPS's opinion of 23 June 2006 on OLAF internal investigations, the latter was therefore also partially relevant.

21. Regarding the second point made by the Ombudsman in his letter dated 31 May 2010, the EDPS first of all pointed out that there is no EU legislation regulating the action of informants and that the OLAF Manual[10] defines an informant as:

"an individual who:

• seeks to disclose information concerning a matter within the legal competence of OLAF regarding a matter which has already occurred or is ongoing;
• has obtained that information as a consequence of a business or personal relationship, often involving a duty of confidence;
• seeks to ensure that disclosure of his identity is withheld; and
• is not an official or servant of a Community organ (officials or servants have a legal obligation to provide information, and those who come forward with such information are referred to as 'whistleblowers' (...)".

22. The EDPS noted that his opinion of 4 October 2007 dealt with the position of both informants and whistleblowers. It applied the same approach to both these categories. The EDPS recalled that he recommended that OLAF should guarantee the confidentiality of the identities of the whistleblowers and informants, except when this would contravene national rules governing judicial procedures, or where they maliciously make a false statement.

23. The EDPS went on to consider that a request for access to the identity of an informant could be made either under Article 13 of Regulation 45/2001[11] or under Regulation 1049/2001. In the case at hand, the complainant submitted a request for access to documents under Regulation 1049/2001. Hence, OLAF analysed whether the exception provided by Article 4(1)(b) of this regulation was applicable.

24. In line with his conclusion in the opinion of 4 October 2007, the EDPS took the position that, as a general rule, the identity of a whistleblower or informant should not (emphasis added by the EDPS) be disclosed, except when this would contravene national rules on judicial procedures and/or when the whistleblower or the informant has maliciously made a false statement.

25. Concerning the third point on which the Ombudsman asked him to comment, the EDPS concluded that there are good reasons to believe that the same level of protection should be afforded to whistleblowers and informants after the closure of an investigation, regardless of whether there is a follow-up or not. According to the EDPS, the vulnerability of the whistleblower's or informant's role, and therefore the risk to their privacy and integrity, does not change depending on whether the investigation leads to follow-up actions or not. The EDPS stated that there may be specific situations where the protection of whistleblowers or informants should have to give way to the legitimate interests of other persons, and also that the lapse of time may be a relevant factor. However, he reiterated that, as a general rule, the identity of a whistleblower or informant should not (emphasis added by the EDPS) be disclosed, except under specific and carefully defined conditions.

The Ombudsman's assessment

26. In the present case, the Ombudsman has to examine whether OLAF was entitled to refuse access to the documents requested by the complainant. In its decisions on the complainant's initial and confirmatory applications for access, OLAF relied on Article 4(1)(b) and Article 4(2) first indent of Regulation 1049/2001.

27. Regarding the exception concerning the privacy and integrity of an individual and the protection of personal data, as set out in Article 4(1)(b) of Regulation 1049/2001, the complainant submitted that this did not apply, because any person who might have complained to OLAF concerning his company should have been ready to assume his or her own responsibilities. The Ombudsman is not convinced by this argument. The relevant provision of the regulation specifically requires institutions to refuse access to a document where disclosure would undermine the protection of privacy and the protection of personal data. On the basis of the results of the Ombudsman's inspection of OLAF's file, it is clear that this risk existed in the present case as regards the identity of the informant whose information had led OLAF to investigate the matter. The Ombudsman therefore finds that OLAF was entitled to invoke the exception set out in Article 4(1)(b) in order to justify its refusal to grant access to documents that would have allowed the informant to be identified. This conclusion is also in line with the views expressed by the EDPS in his reply to the Ombudsman's question to that effect.

28. Regarding the exception concerning the protection of commercial interests set out in Article 4(2) first indent of Regulation 1049/2001, the Ombudsman notes that neither Regulation 1049/2001 nor the case-law of the Union courts provides for a precise definition of 'commercial interests'. In spite of this, however, he notes that the case-law of the General Court sheds some light on the scope of the commercial interests exception.

29. The General Court has held that, if one were to consider all information relating to a company and its business relations as being covered by the concept of commercial interests, one would not give effect to the general principle of providing the public with the widest possible access to documents held by the institutions[12]. However, according to the case-law of the same court, documents containing confidential information concerning companies and their commercial activities, for example, constitute information covered by the commercial interests exception[13].

30. In the present case, the Ombudsman's services inspected the relevant OLAF file. The inspection showed that the relevant files contained detailed information about specific individuals and companies, as well as details about their projects and commercial activities. The Ombudsman therefore considers that the exception concerning the protection of commercial interests set out in Article 4(2) first indent of Regulation 1049/2001 was thus applicable in principle.

31. The Ombudsman notes that, according to the case-law of the Union courts, the risk that the interest protected by the exceptions laid down in Regulation 1049/2001 might be undermined cannot be purely hypothetical[14]. However, given the details and specificity of the information contained in the documents in the case at hand, the Ombudsman considers it reasonable to assume that the interests protected by the relevant exception would specifically and actually be undermined by disclosure.

32. Article 4(2) first indent of Regulation 1049/2001 further provides that, even though the said exception applies, documents containing such information are to be disclosed if there is an overriding public interest in disclosure. Therefore, the Ombudsman has to examine whether such an overriding public interest in disclosure existed in the present case. In his observations on OLAF's opinion, the complainant appeared to rely on what he considered to be a public interest in knowing on which basis OLAF decides to carry out its investigations. The Ombudsman is not convinced by this argument, as, in the absence of special circumstances, it cannot be assumed that this general interest constitutes an overriding public interest in the above-mentioned sense. As regards the complainant's personal interest in obtaining access to the documents requested, OLAF correctly observed that this interest could not be regarded as constituting an overriding public interest, but was rather of a private nature. The Ombudsman concludes, therefore, that the exception protecting commercial interests was duly invoked by OLAF.

33. Concerning the possibility to grant partial access in accordance with Article 4(6) of Regulation 1049/2001, OLAF stated that doing so would be meaningless and void of purpose because the parts of the documents that could be disclosed would be of no use to the applicant. Having inspected the documents concerned, the Ombudsman reached the conclusion that OLAF's position on this point is correct.

34. In light of the foregoing, the Ombudsman finds that this aspect of the case revealed no maladministration.

B. Allegation that OLAF failed to inform the complainant about the result of its investigation and corresponding part of the claim

Arguments presented to the Ombudsman

35. The complainant alleged that OLAF failed to inform him about the result of its investigation and claimed that it should do so.

36. In its opinion, OLAF stated the following: "OLAF considered this point in depth in March 2007 and concluded from a legal point of view that there is no obligation for OLAF to inform the complainant [of the result of its investigation]. The investigation was closed without judicial or financial follow-up recommendations and only administrative follow-up was recommended and this is still ongoing. The result of the investigation did not trigger any consequences whatsoever for the complainant." Nevertheless, after further reflection on the matter and "with a view to bringing closure to the matter", OLAF stated that it had finally decided to inform the complainant of the result of its investigation.

37. The complainant considered OLAF's reply to his second allegation to be absolutely "bewildering". OLAF's position seemed even worse because it carried out its further reflection only after the Ombudsman's inquiry into the case.

The Ombudsman's assessment

38. Regarding this aspect of the case, the Ombudsman notes that OLAF informed the complainant about the result of its investigation after the opening of the present inquiry. In light of this, the Ombudsman concludes that OLAF has done what the complainant wanted it to do and that the complainant's claim has therefore been addressed.

39. However, the complainant also alleged that OLAF failed to inform him of the result of its investigation. It is clear that the complainant considers that this information should have been provided before the Ombudsman opened the present inquiry.

40. In its opinion, OLAF submitted that it was not under any legal obligation to inform the complainant. The Ombudsman is not convinced by this argument. According to the case-law of the General Court, there is an obligation to inform, as rapidly as possible, the person concerned by the existence of an investigation, as long as this would not be harmful to the investigation[15]. In the Ombudsman's view, the same conclusion ought to apply as regards informing the person concerned of the result of such an investigation, all the more so if, as in the present case, this person or his company has been the object of an on-the-spot investigation. In any event, and even in the absence of a legal obligation to do so, informing the person concerned, within a reasonable period of time, of the results of such an investigation would be in line with the right to good administration, as enshrined in Article 41 of the Charter of Fundamental Rights of the European Union.

41. The Ombudsman notes that, in the present case, OLAF informed the complainant about the result of its investigation only after he had opened an inquiry into the matter. This information was provided in OLAF's opinion, which was submitted to the Ombudsman in March 2009. The Ombudsman further notes that it appears to have been in November 2006, i.e., more than two years earlier, that OLAF decided that no further action needed to be taken as regards the complainant's company. In these circumstances, the Ombudsman concludes that OLAF failed to inform the complainant about the result of its investigation within a reasonable period of time. This constitutes an instance of maladministration, and the Ombudsman will therefore make a critical remark in this respect.

C. Conclusions

On the basis of his inquiry into this complaint, the Ombudsman closes it with the following conclusions:

The fundamental right to good administration laid down in Article 41 of the Charter of Fundamental Rights of the European Union requires that a person who has been the object of an investigation can reasonably expect to be informed, within a reasonable time, of the results of such an investigation once it has been closed. In the present case, OLAF failed to inform the complainant about the result of its investigation within a reasonable period of time. This constitutes an instance of maladministration.

No maladministration was found as regards the remainder of the complaint.

The complainant and the Director-General of OLAF will be informed of this decision.

 

P. Nikiforos Diamandouros

Done in Strasbourg on 16 February 2012

---

[1] OJ 2001 L 145, p. 43.

[2] "The institution shall refuse access to a document where disclosure would undermine the protection of:

(b) privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection of personal data".

[3] "The institution shall refuse access to a document where disclosure would undermine the protection of:

- commercial interests of a natural or legal person, including intellectual property, [...] unless there is an overriding public interest in disclosure."

[4] "If only parts of the requested document are covered by any of the exceptions, the remaining parts of the document shall be released".

[5] According to the Director-General of OLAF, this point was not clarified in the complainant's confirmatory application.

[6] OJ 2007 C 27, p. 21.

[7] Case C-266/05 P Sison v Council [2007] ECR I-1233, paragraph 43.

[8] In his opinion of 23 June 2006 on a notification for prior checking of OLAF internal investigations (case 2005-418), the EDPS stated that: "[T]his right [the right of access] can be restricted to safeguard the protection of the (...) rights and freedom of others. This has to be taken into account in the framework that is being analysed regarding access by the person concerned to the identity of whistleblowers. The Article 29 Working Party has made the following statement: 'under no circumstances can the person accused in a whistleblower's report obtain information about the identity of the whistleblower (...), except when the whistleblower maliciously makes a false statement'. The same approach has to be applied concerning the informants. Therefore, the EDPS recommends the respect of the confidentiality of the identity of the whistleblowers during OLAF internal investigations and in the later stage in as much as this would not contravene national rules regulating judicial procedure (...)".

The same approach was confirmed by the EDPS in his opinion of 4 October 2007 on five notifications for prior checking of OLAF external investigations (cases 2007-47, 2007-48, 2007-49, 2007-50 and 2007-72).

[9] Case T-204/99 Mattila v Council and Commission [2001] ECR II-2265, paragraph 69.

[10] OLAF Manual, 25 February 2005, p. 64. This version has since been replaced by a new version.

[11] Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institution and bodies and of the free movement of such data, OJ 2001, L 8, p. 1.

[12] Case T-380/04 Terezakis v Commission [2008] ECR II-11 (summary publication), paragraph 93.

[13] Joined Cases T-355/04 and T-446/04 Co-Frutta v Commission [2010], ECR II-1, paragraph 128.

[14] Case T-36/04 API v Commission [2007] ECR II-3201, paras. 51–56; Case C-52/05 P Sweden and Turco v Council [2008] ECR I-4723, paragraph 43.

[15] Case T-259/03 Nikolaou v Commission [2007] ECR II-99, paragraph 237.