Background to the complaint

1. To help address the COVID-19 pandemic, the European Commission developed a ‘Vaccine Strategy’^[1] to secure safe and effective vaccines for Europe and the world. The Strategy stipulates that, in order to support companies in the swift development and production of a vaccine, the Commission would enter into agreements with individual vaccine producers on behalf of Member States. In return for the right to buy a specified number of vaccine doses in a given timeframe and at a given price, part of the upfront costs faced by vaccine producers would be financed from the ‘Emergency Support Instrument’^[2]. The contracts concluded between the Commission and the pharmaceutical companies securing this procedure are called ‘advanced purchase agreements’ (APAs). The Commission coordinates a team, including experts from the national administrations of EU Member States, which negotiated these APAs with the relevant pharmaceutical companies.

2. In September 2020, the complainant, a Member of the European Parliament, submitted a request for public access^[3] to (1) “the contract the Commission negotiated and signed with the pharmaceutical company AstraZeneca for the purchase of a vaccine against Covid-19 for all Member States of the EU”, and (2) “the names of the persons negotiating on behalf of the EU Member States”.

3. The Commission extended the deadline by which it should take a decision on the request^[4], and finally issued its initial decision in October 2020. It identified one document as falling within the scope of the first part of the request, namely the APA signed with AstraZeneca (one of the pharmaceutical companies developing vaccines). However, it refused access, arguing that disclosure could undermine the protection of AstraZeneca’s commercial interests.^[5] The Commission dealt with the second part of the request as a ‘request for information’^[6]. The Commission argued it could not disclose the names, as doing so would undermine the protection of the personal data^[7] of the individuals concerned. It said that their identities needed to be protected to maintain their independence and safeguard them from undue external pressure and influence. However, it did disclose the name of the expert negotiating on behalf of the Commission.

4. Dissatisfied with the reply, the complainant requested the Commission to review its initial position, by submitting a ‘confirmatory application’.

5. Having extended the deadline once, the Commission informed the complainant in December 2020 that, due to ongoing internal consultations, it was not in a position to deal with the confirmatory application within the prescribed time limits. It committed to reply “as soon as possible”.

6. In January 2021, in the absence of a reply, the complainant turned to the Ombudsman.

The inquiry

7. A few days after the complainant turned to the Ombudsman, the Commission made public the APA with AstraZeneca with some parts redacted. The Ombudsman welcomed these developments. Consequently, she opened an inquiry only into the Commission’s refusal to disclose the names of the representatives of national administrations involved in negotiating the APAs.

8. The Ombudsman asked the Commission to elaborate on its refusal to disclose the names, and, in particular, to consider whether it might be feasible to disclose some information, such as the individuals’ titles and/or positions and the details of the national administration to which they belong. In the course of the inquiry, the Ombudsman received the reply of the Commission and, subsequently, the comments of the complainant on that reply.

Arguments presented to the Ombudsman

9. The complainant argued that there is a public interest in disclosure of the experts’ names. He said that transparent decision making is crucial for the functioning of a democracy and public trust. The complainant also considered that non-disclosure of the requested information could lead to a lack of trust in the vaccine, resulting in some public reluctance to be vaccinated. As such, the EU should do its utmost to restore public trust.

10. The complainant moreover considered that disclosing the names could help reduce the perception of potential conflicts of interest.

11. The Commission explained that a joint negotiation team carries out the negotiations with vaccine suppliers. The experts of the joint negotiation team - representing seven Member States with production capacities for vaccines - are appointed by the co-chairs of a steering committee. The Commission is also part of the joint negotiation team. The steering committee discusses and reviews all aspects of the APA contracts before signature.^[8]

12. The Commission said that, in dealing with requests for information, it is bound by the European Code of Good Administrative Behaviour^[9], which stipulates that institutions should protect personal data in line with the EU data protection rules^[10]. The Commission explained that it has developed internal administrative practices in this regard, which are relevant also for treating requests for information.

13. In line with these administrative practices, the names of third parties, who are not public figures acting in their public capacity, should not be disclosed unless the conditions of the EU data protection legislation for transferring data are fulfilled.^[11] The same applies to the ‘functions’ of third parties, to the extent that releasing these functions would enable the persons to be identified. Since none of the experts of the steering board and the joint negotiation team fell under the category of ‘public figures’, the Commission argued that it needed to verify whether the conditions to transfer their personal data were fulfilled.

14. The Commission considered that the complainant did not bring forward any convincing arguments to substantiate that disclosing the requested personal data would serve the public interest (first condition). The Commission also contended that disclosure would prejudice the ‘legitimate interests’ of the individuals concerned, as there is a real and non-hypothetical risk that disclosing their identities could harm their privacy and lead to unsolicited external contacts and pressure (second condition). Therefore, the Commission contended that the legal conditions were not fulfilled and it was not in a position to disclose the experts’ names.

15. In addition, the Commission said that, in light of the ongoing negotiations, it needed to protect the experts’ independence and safeguard them from undue external pressure and influence.

16. The Commission considered that disclosing the experts’ titles or listing the national administrations of those on the team would likely make them identifiable based on information publicly available (such as organisational charts or directories of public services), thereby defeating the objective of protecting their privacy that the Commission was seeking to attain.

The Ombudsman's assessment

17. The Ombudsman considers it reasonable for the Commission to have dealt with the complainant’s request as a ‘request for information’. In any case, she notes that how it classified the request had no impact on the fact that transferring personal data has to be carried out in accordance with EU data protection legislation. The Ombudsman agrees that the names of the experts of the steering committee and the joint negotiation team are personal data.^[12]

18. In assessing whether transferring the experts’ personal data would be lawful, the Commission needs to follow a three-stage analysis. First, it has to examine whether the requester has demonstrated the necessity of the transfer of the personal data to him for a specific purpose in the public interest. If this is the case, the Commission has to establish whether the transfer could undermine the legitimate interests of the "data subjects" (the experts, in this case). Finally, the Commission has to carry out a ‘balancing exercise’ between the interests of the person seeking access to the personal data and the legitimate interests of the data subjects.^[13]

19. The Ombudsman agrees that the arguments put forward by the complainant do not establish a specific need in the public interest that would be met by obtaining access to the names of the individuals.

20. As such, the Commission did not need to take the further step of considering whether disclosure could have affected the legitimate interests of the experts. However, the Ombudsman agrees with the Commission that their interests could be harmed, especially given the sensitive nature of their negotiating role.

21. In these circumstances, the Ombudsman finds that the Commission was justified in refusing to disclose the experts’ names to protect their personal data. The Ombudsman notes the name of the senior Commission civil servant on the joint negotiation team is public.

22. However, the Ombudsman is disappointed that the Commission refused to release at least some information related to the experts. While understanding that the Commission wished to protect their identity, the Ombudsman considers that disclosing general information that would indicate to which national administration the negotiators belonged would be possible without revealing their identities. Signalling clearly which Member State is represented in the ‘joint negotiation team’ and at what level the national public administration is represented would serve to enhance public trust, and ensure there can be true accountability concerning the negotiating process for the purchase of vaccines. Given the ongoing public debate about the APAs in general, and the APA in this case in particular, it would be also in the interest of the EU for there to be more transparency about the negotiations.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

Given EU data protection law, there was no maladministration by the European Commission.

The complainant and the European Commission will be informed of this decision.

Suggestion

The Ombudsman maintains that greater transparency as regards the negotiations are necessary. She strongly suggests that the Commission publish the list of seven Member States represented on the joint negotiation team.

 

Emily O'Reilly
European Ombudsman

Strasbourg, 22/03/2021

 

[1] Communication from the Commission of 17 June 2020, EU Strategy of COVID-19 vaccines, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1597339415327&uri=CELEX:52020DC0245.

[2] The Emergency Support Instrument helps Member States respond to the coronavirus pandemic by addressing needs in a strategic and coordinated manner at European level. More information is available at: https://ec.europa.eu/info/live-work-travel-eu/coronavirus-response/emergency-support-instrument_en.

[3] In accordance with Article 6 of Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents, available at: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32001R1049.

[4] In accordance with article 7(3) of Regulation 1049/2001.

[5] In accordance with Article 4(2), first indent, of Regulation 1049/2001.

[6] In accordance with the European Code of Good Administrative Behaviour, available at: https://www.ombudsman.europa.eu/en/publication/en/3510.

[7] In line with the provisions of Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725.

[8] https://ec.europa.eu/commission/presscorner/detail/en/QANDA_21_48.

[9] https://www.ombudsman.europa.eu/en/publication/en/3510.

[10] Regulation 2018/1725.

[11] The three conditions are mentioned under Article 9(1)(b) of Regulation 2018/1725.

[12] Within the meaning of Article 3(1) of Regulation 2018/1725.

[13] Article 9(1)(b) of Regulation 2018/1725.