# Decision of the European Ombudsman on complaint 181/2003/ELB against the European Commission
- Author: European Ombudsman
- Date: null
- [URL](https://www.ombudsman.europa.eu/en/decision/en/1849)
---
Strasbourg, 5 December 2003   

Dear Mr X.,

On 24 January 2003, you made a complaint to the European Ombudsman concerning
the publication of your name on the list of candidates for the post of
European Data Protection Supervisor, published on the Commission's website.

On 18 February 2003, I forwarded the complaint to the President of the Commission.
The Commission sent its opinion on 26 May 2003. I forwarded it to you
with an invitation to make observations, which you sent on 30 August
2003.

I am writing now to let you know the results of the inquiries that have been
made.

THE COMPLAINT
-------------

In summary, the relevant facts according to the complainant appear to be as follows:

The complainant applied for the post of European Data Protection Supervisor.
The list of candidates for this post was published on the Commission's
website. The complainant asked the Commission to remove his name from
the list. However, the Commission refused to comply with this request.

The complainant alleges that the publication of his name on the Commission's
website is a violation of data protection rules. He claims that his name
should be deleted from the list and that damages should be awarded on
account of the disclosure of personal data without his consent.

THE INQUIRY
-----------

**The Commission's opinion**   

The Commission's opinion on the complaint can be summarised
as follows:

Regulation (EC) No 45/2001 of the European Parliament and the Council of 18 December
2000 on the protection of individuals with regard to the processing of
personal data by the Community institutions and bodies and on the free
movement of such data[(1)](#(1)){#Footnote1} makes provision for the establishment of an independent
supervisory authority, called the European Data Protection Supervisor.

According to Article 3 of Decision No 1247/2002/EC of the European Parliament,
of the Council and of the Commission of 1 July 2002 on the regulations
and general conditions governing the performance of the European Data
Protection Supervisor's duties[(2)](#(2)){#Footnote2}, "The European Data-protection Supervisor and the Assistant Supervisor shall be
appointed following a public call for candidates. (...) The list of candidates
shall be public (...)".

A public call for candidates for appointment as European Data Protection Supervisor
and Assistant Supervisor was published in the Official Journal no. C
224 A of 20 September 2002. The public call for candidates included in
Annex 2 Decision No 1247/2002/EC.

The complainant applied for the post of European Data Protection Supervisor on
27 September 2002.

In accordance with Decision No 1247/2002/EC, the list of the 306 candidates for
the post of European Data Protection Supervisor and Assistant Supervisor
was published on the website of the Commission at the following address:
http://ec.europa.eu/internal_market/en/dataprot/application/docs/candidates-list.pdf.
This list only mentioned the surnames and first names of the candidates
in alphabetical order.

On 16 January 2003, the complainant sent a message to the Commission, in which
he complained about the fact that his name had been mentioned on the
website. He requested that his name be deleted from the list.

On 4 February 2003, the Commission replied to the complainant, explaining the
reasons why it felt that it could not withdraw the complainant's name
from the list.

The arguments of the Commission were, in summary, as follows:
> 1) ++On an alleged violation of the rules on data
> protection because of the publication of the name of the complainant
> on the Internet site of the Commission++.

Article 3 of Decision No 1247/2002 states: "The European Data-protection Supervisor and the Assistant Supervisor shall be
appointed following a public call for candidates. (...). The list of candidates
shall be public (...)". This obligation was based on the transparency principle and aims at assuring
citizens that the appointment is regular. The publication of the list
was consequently a processing of personal data, which was necessary for
complying with the legal obligation to which the controller is subject.
Such a processing should be considered as lawful in accordance with Article
5 of Regulation 45/2001.

The Commission considered that, in the information society, Internet was a first-rate
tool for disseminating public information. Moreover, the personal data
published in the list was restricted to the surnames and first names
of candidates, which is the bare minimum to comply with the obligation
of publication.

This obligation was mentioned in the Official Journal together with the call
for candidates. The complainant must therefore be assumed to have been
aware of this obligation.

Consequently, the Commission considered that, in publishing the complainant's
name in the list of candidates for the post of European Data Protection
Supervisor, it had not failed to comply with its obligations in accordance
with data protection rules, in particular Regulation 45/2001.
> 2) ++The complainant's claim that his name should
> be deleted from the list and that damages should be awarded on account
> of the disclosure of personal
> data without his consent++.

According to Article 288 of the EC Treaty, the Community shall, in accordance
with the general principles common to the laws of the Member States,
make good any damage caused by its institutions or by its servants in
the performance of their duties.

According to established case law, non-contractual liability can be found if
the claimant proves that the behaviour of the institution is illegal,
that damage has occurred and that there is a causal link between this
behaviour and the damage.

Regarding the illegality of the behaviour of the institution, the Commission
considered that the publication of the complainant's name on the Internet
site of the Commission was not illegal.

As to damages, the complainant had not demonstrated that he had suffered any
prejudice.

Regarding the causal link between the two previous elements, no causal link could
be established.

Consequently, the Commission considered that the publication in question did
not give rise to any non-contractual responsibility of the Community
and that thus the claim for damages of the complainant should be rejected.
**The complainant's observations**   

In his observations, the complainant maintained his complaint.
He expressed the view that publishing his name on the Internet was an
invasion of his privacy and had personal implications for him, notably
regarding his current job and employer.

THE DECISION
------------

**1 The scope of the Ombudsman's inquiry**   

1.1 From the complainant's observations on the opinion sent
by the Commission, the Ombudsman understands that the complainant considers
that the publication of his name also constituted an interference with
his private life. According to the complainant, this aspect had already
been raised in his complaint. In the Ombudsman's view, however, there
was nothing to indicate that the complainant wished to complain about
an interference with his private life as well. It should also be noted
that when the Ombudsman informed the complainant that he had asked the
Commission on his allegation that the latter had infringed data protection
rules, the complainant did not object to this interpretation of his complaint.
The Ombudsman therefore considers that by arguing that the publication
of his name constituted an interference with his private life, the complainant
has submitted a new allegation.

1.2 The Ombudsman considers that he disposes of all the information he needs
to deal with the original complaint submitted by the complainant. It
further appears that the complainant has not made any prior approaches
to the Commission regarding his view that the publication of his name
also constituted an interference with his private life. In these circumstances,
the Ombudsman considers that it would not be appropriate to extend the
scope of the present inquiry to this new allegation, given that doing
so would inevitably delay the decision on the original complaint.

1.3 The complainant is of course free to address his further allegation to the
Commission and to submit a new complaint to the Ombudsman in case the
Commission should fail to provide a satisfactory answer.
**2 Alleged violation of data protection rules**   

2.1 The complainant alleges that the publication of his name
on the Commission's website is a violation of data protection rules.
He claims that his name should be deleted from the list and that damages
should be awarded on account of the disclosure of personal data without
his consent.

2.2 The Commission considers that, in publishing the complainant's name in the
list of candidates for the post of European Data Protection Supervisor,
it did not fail to comply with its obligations in accordance with data
protection rules, in particular Regulation (EC) No 45/2001 of the European
Parliament and the Council of 18 December 2000 on the protection of individuals
with regard to the processing of personal data by Community institutions
and bodies and on the free movement of such data[(3)](#(3)){#Footnote3}. It points to Article
3 of Decision No 1247/2002/EC of the European Parliament, of the Council
and of the Commission of 1 July 2002 on the regulations and general conditions
governing the performance of the European Data Protection Supervisor's
duties[(4)](#(4)){#Footnote4}, which provides: "The list of candidates shall be public (...)". In the Commission's view, this obligation is based on the transparency principle
and aims at assuring citizens that the appointment is regular. According
to the Commission, the publication of the list is consequently a processing
of personal data, which is necessary for complying with the legal obligation
to which the controller is subject. Such a processing should be considered
as lawful in accordance with Article 5 of Regulation 45/2001. The Commission
also points out that the personal data published in the list was restricted
to the surnames and first names of candidates, which is the bare minimum
to comply with the obligation of publication. The Commission argues that
in these circumstances, the publication in question does not give rise
to any non-contractual responsibility of the Community and that thus
the claim for damages of the complainant should be rejected.

2.3 The Ombudsman recalls that Regulation 45/2001, which deals with the protection
of individuals with regard to the processing of personal data by Community
institutions and bodies and on the free movement of such data, was adopted
to comply with Article 286 of the Treaty. This provision requires the
application to Community institutions and bodies of Community acts on
the protection of individuals with regard to the processing of personal
data and the free movement of such data. Regulation 45/2001 establishes
the principle that personal data may only be processed if certain conditions
are fulfilled. According to Article 5 (b), for example, such processing
is permitted if it is "necessary for compliance with a legal obligation to which the controller is subject".

2.4 The Ombudsman notes that Article 3 of Decision No 1247/2002 provides that
"the list of candidates shall be public". The Commission's argument that it published the names of the candidates in
order to comply with the legal obligation thus appears to be reasonable.
The complainant does not appear to argue that the relevant obligation
set out in Article 3 of Decision No 1247/2002 could in itself be contrary
to data protection rules. The Ombudsman further considers that the Commission's
view that it could comply with the said obligation by publishing the
names of the candidates on the Internet is acceptable and in accordance
with the principle of openness to which the European Union is committed,
as reflected notably in Article 1 of the Treaty on European Union. It
should also be noted that the complainant ought to have been aware of
the contents of Article 3 of Decision No 1247/2002 and thus of the fact
that his name would be published. The Ombudsman therefore takes the view
that the interpretation by the Commission of Regulation 45/2001 in this
case is justified.

2.5 In these circumstances, there appears to have been no maladministration on
the part of the Commission.
**3 Conclusion**   

On the basis of the Ombudsman's inquiries into this complaint,
there appears to have been no maladministration by the Commission. The
Ombudsman therefore closes the case.

The President of the Commission will also be informed of this decision.

Yours sincerely,

P. Nikiforos DIAMANDOUROS

*** ** * ** ***

[(1)](#Footnote1){#(1)} OJ
2001 no. L 8, p. 1.

[(2)](#Footnote2){#(2)} OJ 2002 no. L 183, p. 1.

[(3)](#Footnote3){#(3)} OJ 2001 no. L 8, p. 1.

[(4)](#Footnote4){#(4)} OJ 2002 no. L 183, p. 1.