Background to the complaint

1. In September 2023, the complainant made a request for public access to documents concerning the European Commission’s ads of 2022 and 2023 on X, Instagram, Facebook, Google and TikTok in relation to its proposal on rules to prevent and combat child sexual abuse (CSAM) and the related Flash Eurobarometer.

2. In November 2023, the Commission sent its reply. It identified a final report from a contractor on paid advertisement on X as falling within the scope of the complainant’s public access request and gave partial access. In doing so, the Commission invoked exceptions under the EU legislation on public access to documents[1] (Regulation 1049/2001), arguing that disclosing the full document could undermine the privacy and integrity of individuals[2] and commercial interests[3]. In addition, the Commission provided the complainant with several Twitter/X URLs containing information regarding the set-up of the paid advertisement.

3. Dissatisfied with the Commission’s reply, the complainant asked the Commission to review its position (by making a ‘confirmatory application’).

4. The Commission extended the deadline for its reply to the complainant’s confirmatory application to 19 January 2024.

5. Not having received a reply within the extended time limit, the complainant turned to the Ombudsman in February 2024.

The inquiry

6. The Ombudsman opened an inquiry into the Commission’s failure to reply within the applicable time limits to the complainant’s confirmatory application.

7. However, in light of the persisting delay, the Ombudsman asked to review the document(s) identified as falling within the scope of the access request in July 2024.

8. Following the review of the document identified by the Commission at initial stage, the Ombudsman shared her preliminary views with the Commission that further access could be provided to the document at issue.

9. On 19 September 2024, the Commission adopted a confirmatory decision granting wider access to the document at issue in the Ombudsman’s preliminary views. The Commission also identified an additional document, which it partially disclosed with redactions of personal data.

10. The complainant provided comments on the Ombudsman’s preliminary views and the Commission’s confirmatory decision. They did not raise any concerns regarding the redactions in the additional document.

Arguments presented to the Ombudsman

11. In its initial reply to the public access request, the Commission argued that full disclosure of the document at issue was prevented by the exception concerning the protection of privacy and the integrity of the individual. It stated that the document contains information relating to an identified or identifiable natural person, such as names or positions held in an organisation. The Commission considered that the complainant neither expressed any particular interest in these personal data nor did they put forward arguments to establish the necessity to have the data transmitted for a specific purpose in the public interest.

12. The Commission further considered that full disclosure of the document was prevented by the need to protect sensitive business information of the contractor and, more specifically, “prices and the financial results, including the overall price”.

13. In their confirmatory application, the complainant argued that the Commission’s answer was incomplete and that the Twitter URLs provided did not function and referred to Twitter/X transparency reports containing only limited information. Moreover, they considered that full access should be given to the document at issue. They also considered that the personal data in the document should have been disclosed. More specifically, they claimed that there is a “very strong public interest” in disclosure as there had been reports indicating that the Commission “has been trying to influence public opinion” on the CSAM legislative proposal by use of microtargeting. Therefore, the complainant considered that the “public needs to be able to verify the full scope of targeting options that has been selected by their government, even if these targeting options include personal data”.

14. In its confirmatory decision, the Commission confirmed that parts of the document contain personal data, “such as the names, functions, contact details, and social media account names of persons external to the European Commission who are not public figures”. According to the Commission, the requested transfer of these data would not be necessary for the complainant to pursue their objective. In this regard, the Commission pointed out that there are better-suited remedies available, such as lodging a complaint with the European Data Protection Supervisor[4], to ascertain if the allegations of illegal microtargeting are founded. In addition, the Commission considered that there are reasons to assume that the legitimate interests of the individuals concerned would be prejudiced by the disclosure of their personal data included in the requested document.  

15. The Commission explained that the other redacted parts of the document concern “non-public commercially sensitive information, such as the detailed cost structure of the [...] campaign, considerations related to market strategy and know-how” of the contractor. Given that this information relates to the contractor’s business secrets and corporate strategy, disclosing it would pose a real and non-hypothetical risk to the contractor’s commercial interests by providing an undue advantage to its competitors. According to the Commission, the complainant did not explain how disclosure of the commercially sensitive information would contribute to assuring protection of the public interest referred to in their confirmatory application. The Commission itself was not able to identify any overriding public interest in disclosure.  

16. The Commission also provided the complainant with new Twitter URLs.

17. When providing comments, the complainant indicated that they were unsure about the applicability of one of the exceptions to refuse access to a redacted table in the document at issue (an extract of the Twitter dashboard reflecting the pertinence of handles and keywords).

The Ombudsman's assessment

18. In her preliminary views, the Ombudsman stated that it was not readily clear how all of the redacted information in the report on paid advertisement on X would qualify as information related to “prices and financial results” and would thus be sensitive business information. More specifically, it was not clear to the Ombudsman how disclosure of the name and contact details of the contractor, as well as some further redacted information, would undermine the contractor’s commercial interests.

19. Furthermore, the Ombudsman considered that the redaction of the content of a table in the document (an extract of the Twitter dashboard reflecting the pertinence of handles and keywords) appeared to be inconsistent in view of the disclosed information that is contained in other tables in the document. Finally, the document seemed to contain only limited personal data (a few X-handles) that could be redacted to protect the individuals concerned.

20. In line with the Ombudsman’s preliminary views, the Commission disclosed the name and contact details of the contractor. The Commission also gave wider partial access to some of the information that it had considered commercially sensitive at initial stage. In addition, it disclosed the total cost and costs of the social media campaign per country.

21. While the Ombudsman considers that the remaining redactions are overall reasonable, she remains unconvinced that the extract of the Twitter dashboard had to be redacted in full. The Commission’s confirmatory decision clarified that the commercially sensitive information in the document did not solely concern “prices and financial results” but also “considerations related to market strategy and know-how”. However, it is still unclear how disclosure of this table would undermine the commercial interests of the contractor. Additionally, the Commission could redact X-handles referring to a natural person. Only for those handles, the Commission could validly invoke the exception for the protection of personal data.

22. However, as the Commission has just adopted its final position after nine months of delay, pursuing the inquiry would not serve any useful purpose at this stage.

23. Having said that, the Ombudsman notes the very significant delay incurred by the Commission in replying to the complainant’s confirmatory application. According to Regulation 1049/2001, an EU institution should, within 15 working days from registration of the confirmatory application, either grant access to the document requested or, in a written reply, state the reasons for the total or partial refusal. The time limit of 15 working days may be extended by a further 15 working days in exceptional circumstances.^[5]

24. In this case, it took the Commission more than nine months to adopt a confirmatory decision on an access request concerning two short documents. This case is thus another example of the significant and systemic delays the Commission encounters in dealing with confirmatory applications, which the Ombudsman considered to amount to maladministration.^[6]  Following a Special Report of the Ombudsman to the European Parliament on the matter, the European Parliament urged the Commission to correct its systematic and significant delays in processing requests for public access to documents.^[7]

Conclusions

Based on the inquiry, the Ombudsman closes this case with the following conclusions[8]:

No further inquiries are justified.

The Ombudsman profoundly regrets the delay incurred by the Commission in replying to the complainant’s request. Failure to comply with the time limits established by the legislature in Regulation 1049/2001 cannot be good administration. She again urges the Commission to improve its handling of public access requests as a matter of priority, and refers it to the recommendation in her strategic inquiry OI/2/2022/OAM.

The complainant and the Commission will be informed of this decision.

Rosita Hickey
Director of Inquiries

Strasbourg, 18/12/2024

 

[1] Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32001R1049.

[2] Article 4(1) (b) of Regulation 1049/2001.

[3] Article 4(2) first indent of Regulation 1049/2001.

[4] Chapter VIII of Regulation 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, available at: https://eur-lex.europa.eu/eli/reg/2018/1725/oj.

[5] Article 8 of Regulation 1049/2001.

[6] Recommendation on the time the European Commission takes to deal with requests for public access to documents

(strategic inquiry OI/2/2022/OAM), available at https://www.ombudsman.europa.eu/en/recommendation/en/167661.

[7] See https://www.europarl.europa.eu/doceo/document/TA-9-2024-0172_EN.html.

[8] This complaint has been dealt with under delegated case handling, in accordance with the Decision of the European Ombudsman adopting Implementing Provisions.