The background to the complaint

1. The complaint concerns the European Commission's refusal to grant full public access under Regulation 1049/2001[1] to the Final Report of Project EQAR 2007- 4214/001/-001. This report was submitted to the Commission by the European Association for Quality Assurance in Higher Education ('ENQA') and concerned the preparation for establishing of the European Quality Assurance Register for Higher Education ('Project EQAR')[2]. ENQA was responsible for the setting up of EQAR and applied for funding from the Commission under the Lifelong Learning Programme.

2. The complainant requested access to the confidential part of the final report of Project EQAR 2007- 4214/001/-001, which contains a report submitted to the Commission concerning financial information on the establishment of EQAR.

3. The Commission consulted ENQA to ask whether it agreed to the disclosure of the confidential part of the final report. ENQA objected to the disclosure. The Commission then informed the complainant that it refused public access to the document on the grounds that disclosure could undermine the protection of (a) privacy and the integrity of the individual, that is, the exception to public access set out in Article 4(1)(b) of Regulation 1049/2001[3] and (b) commercial interests of a natural or legal person, including intellectual property, that is, the exception to public access set out in Article 4(2), first indent, of Regulation 1049/2001[4].

4. The complainant renewed his request for access by sending a confirmatory application.

5. The Commission consulted ENQA on two further occasions regarding the matter. ENQA eventually agreed to the disclosure of a redacted version of the final report, which led the Commission to grant partial access to the final report on 5 March 2010. The Commission refused to grant access to three parts of the final report, namely, the EQAR business plan (annexed to the final report); Part 6 of the final report, entitled "Involvement of staff"; and Annex I of the final report, entitled "Financial reporting table".

6. In support of its decision to refuse access, the Commission provided the following reasoning.

7. The Commission argued that the EQAR business plan fell outside the scope of its assessment of the request for access under Regulation 1049/2001 because the complainant was already in possession of the document in question.

8. The Commission refused access to Part 6 of the final report on the basis of Article 4(1)(b) of Regulation 1049/2001 and its exception to access in order to protect the privacy and integrity of the individual. The Commission argued that the exception applied because this part of the document contains a list of persons who were involved in the project per category, partner and period of assignment. The Commission stated that this information constitutes personal data because it concerns identified persons and data of a private nature relating to their work assignment and remuneration in this project.

9. The Commission refused access to the Financial reporting table on the basis of Article 4(2), first indent, of Regulation 1049/2001 and its exception to the right of access, which was designed to protect commercial interests. The Commission provided the complainant with a description of the nature of the non-disclosed items contained in the Financial reporting table[5]. The Commission argued, however, that the issues addressed in part 6 of the final report and in the Financial reporting table were at stake in pending litigation between the complainant and ENQA. Disclosure of these parts of the final report would jeopardise ENQA's ability effectively to present its case on an equal footing with the other party/parties to these legal proceedings. This would harm ENQA's commercial interests regarding the outcome of the litigation. The Commission stated that, while ENQA is not a profit-seeking entity, it acts like any other economic operator in an open market when carrying out several of its activities, such as hiring staff and purchasing equipment and services necessary for its operation. In addition, the Commission stated that access to the section on realised travel and subsistence costs of the Financial reporting table could not be granted because this part contains a list of persons who claimed travel and subsistence costs for the project. This information qualifies as personal data, which is also protected on the basis of Article 4(1)(b) of Regulation 1049/2001.

10. The Commission finally noted that the exceptions to the right of access under Article 4(1) of Regulation 1049/2001 must not be weighed against an overriding public interest. However, the exception laid down in Article 4(2), first indent, of Regulation 1049/2001 must be waived if there is an overriding public interest in disclosure. Such an interest must, first, be a public interest and, second, outweigh the harm caused by disclosure. The Commission underlined that the purpose of Regulation 1049/2001 is to grant public access to documents, the disclosure of which would not harm a public interest or specific private interests. As access under Regulation 1049/2001 implies that all members of the public can have access to the document, no specific interest of an individual, for example, a specific interest of the applicant, could be taken into account when assessing whether or not access to a document can be granted. Considering that a large part of the documents concerned had already been disclosed, the Commission concluded that there were no elements at its disposal which could indicate the existence of an overriding public interest that would outweigh the need to protect ENQA's commercial interests.

The subject matter of the inquiry

11. In his complaint to the Ombudsman, the complainant alleged that the Commission failed to give valid and adequate grounds for its refusal to grant full access to the document entitled Confidential Part of the Final Report of Project EQAR 2007- 4214/001/-001, including its annexes.

12. The complainant claimed that the Commission should grant full access to the document entitled Confidential Part of the Final Report of Project EQAR 2007- 4214/001/-001, including its annexes.

The inquiry

13. The Ombudsman asked the Commission to submit an opinion on the complaint. The Ombudsman's services also carried out an inspection of the Commission's file on the matter. The Commission provided its opinion on the complaint, which was forwarded to the complainant with an invitation to make observations. The Ombudsman did not receive any observations from the complainant. On 25 August 2001, following telephone correspondence with the complainant regarding the matter, the Ombudsman submitted a proposal to the Commission for a friendly solution in the case. The Commission’s response of 9 March 2012 was forwarded to the complainant with an invitation to submit observations by 30 April 2012. The complainant did not submit any observations.

The Ombudsman's analysis and conclusions

A. Alleged failure to provide valid and adequate grounds for its refusal to grant full access

Arguments presented to the Ombudsman

14. In his complaint, the complainant argued that the Commission's refusal to examine whether the EQAR business plan could be made public meant that he was unable to ascertain whether he was in possession of the same version of the business plan as the one held by the Commission.

15. The complainant also objected to the redaction of the names of the participating staff members in the report. He referred to the European Ombudsman's Special Report to the European Parliament in complaint 713/98/IJH, arguing that the staff names were given in the report in order to provide accountability for the use of a grant awarded by the Commission.

16. The complainant further argued that possible adverse consequences to a party in legal proceedings cannot constitute commercial interests within the meaning of the exception laid down in Article 4(2), first indent, of Regulation 1049/2001. In addition, ENQA did not prepare and submit the report to the Commission in the context of litigation in Finland, but produced it in the context of administrative procedures between ENQA and the Commission. The exception to public access in relation to Court proceedings (Article 4(2), second indent of Regulation 1049/2001[6]) would not allow the Commission to evade its obligation to disclose documents which were drawn up in connection with a purely administrative matter.

17. The complainant also argued that the commercial activities of a non-profit organisation are not the same as "the objective commercial interests intended in the Regulation". In his view, the Commission did not demonstrate that there were any objective commercial interests needing protection. The Commission's understanding of protectable commercial interest implied that the activities of any entity which purchases services in the open market would fall under the exception in Article 4(2), first indent. The complainant also pointed out that the exceptions to the right of access to documents must be interpreted and applied strictly.

18. The complainant finally objected to the Commission's decision not to disclose the link appearing on page 13 of the final report under title "8 - Dissemination & Exploitation", following the sentence which reads as follows: "The EQAR website contains a reserved area for EQAR members and official observers of the General Assembly, including the Commission. It is accessible by the login form at [deleted]".

19. With regard to the EQAR business plan, the Commission referred to the content of its reply to the complainant's confirmatory application. Given that the complainant was in possession of the business plan, the Commission reasoned that, for reasons of economy of resources, it did not need to examine whether it could be made public under Regulation 1049/2001.

20. As regards the redaction of the names of the participating staff members in Part 6 of the final report, the Commission maintained the reasoning provided in its reply to the confirmatory application. It argued that the redaction of the names themselves would not be sufficient to protect the privacy of the persons concerned because the latter would be identifiable on the basis of the rest of the information contained in this part, namely, their staff category and period of assignment.

21. As regards the complainant's objection to the argument that possible adverse consequences of one party in legal proceedings constitute commercial interests, the Commission again stated that, although ENQA is not a profit-seeking entity, it acts like any other economic operator in an open market when carrying out several of its activities, such as hiring staff and purchasing equipment and services necessary for its operation. Releasing the relevant parts of the report into the public domain would be harmful to the commercial interests of ENQA , which is the author of the document concerned. The fact that ENQA objected to the disclosure of certain parts of that report by stating that the information in these parts is relevant in pending litigation is one element in the Commission's assessment concerning ENQA's commercial interests. The Commission recalled its statement, in its confirmatory reply, that disclosure of the redacted parts of the final report on the basis of the public access regime would jeopardise ENQA's ability effectively to present its case on an equal footing with the other party/parties to these legal proceedings. Such an eventuality would, in turn, harm ENQA's commercial interests as regards the outcome of the litigation.

22. The Commission took the view that the status of the entity concerned, that is, the fact that ENQA is a non-profit organisation, is irrelevant as regards the protection of commercial interests. The Commission argued that, from the wording of Article 4(2), first indent, of Regulation 1049/2001, this provision applies to the commercial interests of any legal person, whether public or private.

23. As to the potential existence of an overriding public interest in disclosure, the Commission put forward the same arguments as those contained in its reply to the complainant's confirmatory application.

24. Concerning the complainant's argument that the link on page 13 of the final report should be made public if the Commission is unable to present a legal reason to redact it, the Commission stated that this is an external website to which it has access on the basis of its quality as an observer of the General Assembly concerned. It is not a document in its possession in the sense of Article 3 of Regulation 1049/2001. For this reason, the login password for the reserved area in the EQAR website was deleted.

25. For the above reasons, the Commission maintained its position that the parts of the documents that had not been disclosed were clearly covered by the exceptions laid down in Regulation 1049/2001.

The Ombudsman's preliminary assessment leading to a friendly solution proposal

EQAR Business Plan

26. As regards the request for access to the EQAR Business Plan, the Ombudsman points out that the complainant made a request for public access to the business plan under Regulation 1049/2001. The fact that the complainant may have obtained access to the EQAR Business Plan elsewhere does not mean that the EQAR Business Plan has been made public. Every request for public access to documents under Regulation 1049/2001 has to be dealt with in accordance with the provisions set out therein. The institution concerned can only refuse public access if one of the exceptions to public access listed in Article 4 applies[7]. In the present case, the Ombudsman is not convinced that the reasons put forward by the Commission to refuse to process the complainant's request for access to the EQAR Business Plan are in accordance with the provisions set out in Regulation 1049/2001. This refusal will be addressed in the Ombudsman's proposal for a friendly solution below.

Part 6 of the final report

27. As regards Part 6 of the final report and the names listed therein, the Ombudsman notes that the Court of Justice has ruled on the interplay between the EU rules on public access and the EU rules on data protection in the Bavarian Lager case[8]. The European Data Protection Supervisor ('EDPS') has further analysed the Bavarian Lager case in a Background paper of 24 March 2011, entitled "Public access to documents containing personal data after the Bavarian Lager ruling"[9]. In line with the Memorandum of Understanding[10] between the Ombudsman and the EDPS, in which the two institutions undertake to adopt a consistent approach to legal and administrative aspects of data protection, the Ombudsman considers it appropriate to analyse the present case in light of the guidelines and conclusions made by EDPS in his Background paper of 24 March 2011 (the 'Background Paper').

28. In the Background Paper, EDPS concludes that the Bavarian Lager ruling establishes that surnames and forenames may be regarded as 'personal data' and that the communication of such data falls within the definition of 'processing' for the purpose of Regulation 45/2001[11] (the data protection regulation)[12]. Where a request for public access under Regulation 1049/2001 seeks to obtain access to documents containing personal data, the provisions of Regulation 45/2001 become applicable in their entirety[13]. Such a public access request must be dealt with by the institutions involved under Article 8(b) of Regulation 45/2001[14]. In order to grant access to personal data under Article 8(b) of Regulation 45/2001, the recipient has to establish the necessity of having the data transferred and the institution must consider whether there is no reason to assume that the data subject's legitimate interests might be prejudiced. This means that the institution concerned has to undertake a balancing exercise of the interests at stake and that disclosure is only allowed if both conditions are met.

29. EDPS concludes that Article 8(b) of Regulation 45/2001 requires that the person requesting access must provide an express and legitimate justification or convincing arguments in order to demonstrate the necessity for the personal data to be transferred[15]. In respect of the data subject's legitimate interests, EDPS states that, in case of doubt as to whether these would be prejudiced by the transfer, it seems reasonable that the data subject is invited to present his or her views on the possible transfer. However, this invitation to present his or her views should not be seen as a request for consent to the transfer, but as a measure allowing the institution to make a well-informed decision.

30. On the basis of the above, the Ombudsman finds that the Commission was right to consider that the names of the persons listed in Part 6 of the final report constituted personal data. However, this fact should have prompted the Commission to carry out a full analysis of the request for access to these names under Article 8(b) of Regulation 45/2001[16]. The Commission does not appear to have done so. The failure to carry out a full analysis of the request for access will be addressed in the Ombudsman's proposal for a friendly solution below.

31. The Ombudsman also notes the Commission's argument that the redaction of the names would not be sufficient to protect the privacy of the persons concerned, since such persons would be identifiable on the basis of the rest of the information contained in Part 6 of the final report, that is, their staff category and period of assignment. According to the Commission, this information could therefore not be disclosed either.

32. In this regard, the Ombudsman notes that Article 2 of Regulation 45/2001 stipulates that "[f]or the purposes of this Regulation: (a) ‘personal data’ shall mean any information relating to an identified or identifiable natural person hereinafter referred to as ‘data subject’; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity; …"

33. However, the Ombudsman does not consider that the Commission has explained in what way information about staff categories and periods of assignment would render identifiable the individuals listed in Part 6 of the final report.

34. It follows that the Commission did not sufficiently analyse this aspect of the access request in respect of Part 6 of the final report, in particular under Article 2, and eventually, where applicable, Article 8(b) of Regulation 45/2001. The failure to analyse this aspect of the access request will be addressed in the Ombudsman's proposal for a friendly solution below.

Financial reporting table

35. As regards the Commission's arguments in support of refusing access to the financial reporting table, the Ombudsman is not convinced that the eventual outcome of litigation can constitute a commercial interest within the meaning of Article 4(2), first indent, of Regulation 1049/2001.

36. However, in its opinion on the complaint, the Commission also argues that public disclosure of the financial reporting table would, as such, be harmful to the commercial interests of ENQA. According to the Commission, although ENQA is a profit-seeking entity, it acts like any other economic operator in an open market when carrying out many of its activities. These include hiring staff and purchasing equipment and services necessary for its operation. Having inspected the document concerned, the Ombudsman considers this argument valid. The Ombudsman also considers the Commission's argument that there is no overriding public interest in disclosure to be valid.

37. On the basis of the conclusions in paragraph 36 above, the Ombudsman concludes that the refusal to grant public access to the financial reporting table was justified.

Link to the website on page 13 of the Final report

38. Having inspected the document concerned, the Ombudsman notes that the Commission deleted from the disclosed document not only the login password for EQAR members to access the reserved area, but also the link to the web page containing the login form. The Ombudsman further notes that the complainant only objects to the non-disclosure of the link. He does not dispute the deletion of the login password.

39. The Commission refused access to the link to the web page by arguing that the web page is not "a document in its possession". The Ombudsman points out in this regard that the complainant requested access to the document in which the link is mentioned, and not to the actual web page to which that link leads. The document in which the link is mentioned is clearly a document in the Commission's possession and the link is a component of that document.

40. The Ombudsman notes that, if the Commission's reasoning were to be considered valid, it would lead to an absurd situation where all links to external web pages that are cited in a document held by the Commission, including links to public web pages, would have to be deleted before the document is released.

41. While the link in question is clearly part of a document in the possession of the Commission, it must still be examined whether that part of the document should be deleted, in accordance with the exceptions to access set out in Article 4 of Regulation 1049/2001. Given that the Commission simply argued that the request concerned a document that was not in its possession, the Ombudsman considers that the Commission did not properly reason its refusal to provide access to the link. The failure properly to reason its refusal to provide access to the link will be addressed in the Ombudsman's proposal for a friendly solution below.

The friendly solution proposal

42. On the basis of the above analysis and the findings in paragraphs 26, 30, 34 and 41, the Ombudsman made the following proposal for a friendly solution:

The Commission could reconsider giving access to the EQAR Business Plan, to Part 6 of the final report and to the link on page 13 of the final report.

The arguments presented to the Ombudsman after his friendly solution proposal

43. In its reply to the Ombudsman, the Commission stated that it considered that it had accepted the friendly solution proposal. The Commission had re-examined the possibility of granting public access to the EQAR Business Plan by consulting the author of the document, who did not object to its disclosure. The Commission had therefore decided to disclose the EQAR Business Plan, which is now accessible to the public.

44. The Commission did not consider it necessary to re-examine the possibility of granting public access to Part 6 of the final report, given the recent judgment of the General Court in Case T-82/09[17] and the complainant's failure to provide any specific reasons justifying the request for a transfer of personal data.

45. The Commission acknowledged that there was no reason to protect the link on page 13 of the final report. The "login" and the "password" on page 13 of the final report were deleted to prevent access to the internal site of EQAR. However, the login form itself, to which the link leads, contains no substantive content.

The Ombudsman’s assessment after his friendly solution proposal

46. The Ombudsman welcomes the Commission's decision to make the EQAR Business Plan accessible to the public. The Ombudsman also applauds the Commission's willingness to accept his reasoning in respect of the link on page 13 of the final report by acknowledging that there was no reason to protect it. The Ombudsman therefore makes the finding that the Commission has taken steps to settle these aspects of the complaint.

47. The Ombudsman further notes that, despite having found that the link on page 13 of the final report should have been disclosed, the Commission does not appear to have provided the complainant with an updated version of page 13 of the final report, containing the link. However, having inspected the document concerned and visited the login form to which the link leads, the Ombudsman concurs with the Commission that the login form contains no substantive content. The Ombudsman will therefore not pursue this matter further.

48. In respect of Part 6 of the final report, the Ombudsman notes the Commission's statement, in its reply to the proposal for a friendly solution, maintaining that it did not have to re-examine the request for access in this respect. The Ombudsman notes, however, that the Commission did nevertheless provide additional reasons as to why it does not consider it to be in line with applicable legislation to provide public access to this document. In sum, the Commission argued that the complainant has not provided any specific reasons justifying the request for a transfer of personal data.

49. As noted in the proposal for a friendly solution, the case law of the EU Courts sets out that a request for public access to a document containing personal data must be dealt with under Article 8(b) of Regulation 45/2001[18], which means that, as a first step, the applicant has to establish the necessity of having the data transferred[19]. It appears, in the present case, that the complainant has not done so and the Commission is thus, in principle, entitled to refuse access on the basis of Article 4(1)(b) of Regulation 1049/2001.

50. The Ombudsman notes, however, that the complainant made the request for access to Part 6 of the final report before the exception to the right of public access to personal data set out in Article 4(1)(b) of Regulation 1049/2001 had been further defined by the EU Courts. The complainant might not, therefore, have been aware, at the time, of his obligation to establish the necessity of having the data transferred. However, the complainant could consider making a new request for access, demonstrating such a necessity by providing express and legitimate justifications.

51. If an institution finds that Regulation 45/2001 applies to a request for public access to a document, and access to the document concerned is refused because the applicant has not endeavoured to establish the necessity of having personal data transferred, the Ombudsman considers that it is appropriate for the institution, when informing the applicant of his or her right to make a confirmatory application in accordance with Article 7 of Regulation 1049/2001, also to inform the applicant of the obligation to demonstrate such necessity. This would be in conformity with principles of good administration and of service culture, and, more specifically, with Article 10(3) of the European Code of good Administration, concerning advice given to citizens. The Ombudsman will make a further remark in this regard.

52. In respect of the question whether it would be possible to grant partial access to Part 6 of the final report[20], the Ombudsman maintains the concern set out in paragraphs 31-33 above, that is, that the Commission has not explained in what way information about staff categories and periods of assignment would make the individuals identifiable within the meaning of Article 2 of Regulation 45/2001. The Ombudsman notes in this regard that, if information is not considered to be personal data for the purpose of Regulation 45/2001, the requirement that the applicant has to establish the necessity of having the data transferred, as described in paragraph 48 above, does not apply. On the basis of the above, the Commission's refusal to disclose that document after having blacked out the names constitutes an instance of maladministration and the Ombudsman will make a critical remark in respect of this aspect of the complaint.

53. Before reaching his decision in the present case, the Ombudsman carefully read the recent judgment of the General Court in Case T-190/10[21]. The Ombudsman notes that this judgment was delivered after the Ombudsman had formulated his friendly solution proposal in the present case and after the Commission had provided its reply to that proposal. In Case T-190/10, the General Court held that an institution could only refuse public access to a document containing personal data if, as a first step, it explained how access to that document could specifically and effectively undermine the privacy of the persons concerned within the meaning of Article 4(1)(b) of Regulation 1049/2001.[22] In the Ombudsman’s view, the conclusions set out in paragraphs 51 and 52 are consistent not only with the earlier case law cited in the friendly solution proposal, but also with the subsequent case law.

B. Conclusions

On the basis of his inquiry into this complaint, the Ombudsman closes it with the following conclusion and critical remark:

In respect of the request for access to the EQAR Business Plan and the link on page 13 of the final report, the Commission has taken steps to settle the matter.

Critical remark:

In respect of Part 6 of the final report, the Commission has not explained in what way information about staff categories and periods of assignment would make the individuals identifiable within the meaning of Article 2 of Regulation 45/2001. Accordingly, the Commission's refusal to disclose that document after having blacked out the names constitutes an instance of maladministration.

The complainant and the Commission will be informed of this decision.

Further remark

If an institution finds that Regulation 45/2001 applies to a request for public access to a document, and access to the document concerned is refused because the applicant has not established the necessity of having personal data transferred, the Ombudsman underlines the importance of applying principles of good administration and of being committed to a culture of service towards citizens. He considers that it would be in line with those principles and with such a service culture for the institution, when informing the applicant of his or her right to make a confirmatory application in accordance with Article 7 of Regulation 1049/2001, also to inform the applicant of the obligation to demonstrate such necessity.

 

P. Nikiforos Diamandouros

Done in Strasbourg on 9 July 2012

---

[1] Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents, OJ 2001 L 145, p. 43.

[2] EQAR is an international non-profit organisation established by the 'E4 Group' comprising the European Association for Quality Assurance in Higher Education (ENQA), the European Students Union (ESU), the European University Association (EUA) and the European Association of Institutions in Higher Education (EURASHE). EQAR's aim is to improve the quality of European higher education and to promote greater student mobility by providing clear and objective information about trustworthy quality assurance agencies that are working in Europe. The new register also aims at facilitating the mutual recognition of quality assurance decisions.

[3] "The institutions shall refuse access to a document where disclosure would undermine the protection of: …privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection of personal data."

[4] "The institutions shall refuse access to a document where disclosure would undermine the protection of

- commercial interests of a natural or legal person, including intellectual property

… unless there is an overriding public interest in disclosure."

[5] The Commission also provided the following detailed clarifications:

"The statements of accounts (part i) section contains a report on the cost claims for the preparation of the EQAR; it presents the overall budget, the sums eligible for funding from the Commission and other sources of financing (own funds of partnership). The section on expenditures by type of cost and by partner (part ii) presents the cost breakdown by partner (the above described E4 Group) and thus reports on how the Commission grant was divided between the partners as concerns staff costs, travel and subsistence, equipment, subcontracting and other costs. The section on realized staff costs by partner (part iii) gives a detailed account by partner of the staff costs by category of persons employed in the project (manager, researcher, teacher and/or trainer, technical staff and administrative staff). In each staff category this part reports on the number of days worked in the project, cost per day and total staff cost per category. The section on realized travel and subsistence costs (part iv) presents these costs (with a breakdown by person) and realized equipment costs reports (also in part iv) on equipment, such as computers, purchased for the project. Subcontracting and other costs (part v) relate to lawyers' consultations for drafting the EQAR statutes and setting up the organization. Finally, other costs relate to corporate design (such as logo), telephone costs, design of website, design of EQAR info-leaflet and its printing and such. As mentioned in my previous letter the Commission has consulted ENQA, the author of the documents in question, with a view to assessing whether an exception in paragraphs 1 or 2 of Article 4 of Regulation 1049/2001 is applicable to the documents concerned by your request. Upon this consultation ENQA raised objections as concerns disclosure of the Confidential Part of the Final Report of project EQAR, invoking an on-going court proceeding in a national court as a reason for its opposition."

[6] Article 4(2) of Regulation 1049/2001 stipulates that "[t]he institutions shall refuse access to a document where disclosure would undermine the protection of: … — court proceedings and legal advice, …"

[7] When examining such a request under Regulation 1049/2001, the institution must take into account, in its reasoning, the consequences if the public obtained access to the document concerned. Even though an individual or certain individuals may have already obtained access to the document concerned, one of the exceptions to public access under Article 4 may still apply to a request for public access.

[8] Case C-28/08 P Commission v Bavarian Lager, judgment of 29 June 2010, not yet published in the ECR.

[9] Available at the EDPS' website: www.edps.europa.eu

[10] OJ 2007 C 27, p. 21.

[11] Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data.

[12] Case C-28/08 P Commission v Bavarian Lager, paragraphs 68-69.

[13] Case C-28/08 P Commission v Bavarian Lager, paragraph 63.

[14] Article 8(b) of Regulation 45/2001 stipulates that "[w]ithout prejudice to Articles 4, 5, 6 and 10, personal data shall only be transferred [...] (b) if the recipient establishes the necessity of having the data transferred and if there is no reason to assume that the data subject's legitimate interests might be prejudiced."

[15] Case C-28/08 P Commission v Bavarian Lager, paragraph 78.

[16] The judgment in the Bavarian Lager case was delivered on 29 June 2010, which suggests that the Commission may not have taken it into account when drafting its opinion in the present case, which is dated 27 July 2010.

[17] Case T-82/09 G.J. Dennekamp v European Parliament, judgment of 23 November 2011, not yet reported.

[18] Where a request for public access under Regulation 1049/2001 seeks to obtain access to documents containing personal data, the provisions of Regulation 45/2001 become applicable in their entirety. See Case C-28/08 P Commission v Bavarian Lager, judgment of 29 June 2010, not yet reported, paragraph 63.

[19] Case C-28/08 P Commission v Bavarian Lager, judgment of 29 June 2010, not yet reported, paragraphs 59, 63 and 77, Case T-82/09 G.J. Dennekamp v European Parliament, judgment of 23 November 2011, not yet reported, paragraphs 26 and 30.

[20] Article 4(6) of Regulation 1049/2001.

[21] Case T-190/10 Egan and Hackett v Parliament, judgment of 28 March 2012, not yet reported.

[22] Ibid, paragraphs 90-91.