Background to the complaint

1. One of the tasks of the European Anti-Fraud Office (OLAF) is to conduct independent administrative investigations into serious misconduct by staff and members of the EU institutions. Following its investigations, OLAF can make recommendations for actions to be taken by the EU institution concerned, including ‘disciplinary recommendations’ aimed to sanction any wrongdoing by staff and members of EU institutions.[1] Through its annual report, OLAF informs the public about the number of disciplinary recommendations it made to the EU institutions concerned in a given period and whether the institutions followed-up on these.[2]

2. The complainant, a journalist, wanted to know more about OLAF’s findings and the EU institutions’ follow-up decisions in the period from 2015 to 2023. To this end, he made several requests[3] for public access to documents to relevant EU institutions, including, in June 2024, to the European Union Agency for Cybersecurity (ENISA), asking for

· OLAF’s final report(s) and recommendations (and related documents), and

· the final reports issued by ENISA on the disciplinary follow-up action it had taken.

3. Between 2015 and 2023, OLAF had conducted one investigation concerning an ENISA staff member based on which it had made two recommendations to ENISA.

4. ENISA refused to give public access to the OLAF report “and related information”, relying on the need to protect the personal data of the person concerned by the OLAF investigation and of other individuals.[4] ENISA did not list the documents it had identified as falling within the scope of the complainant’s access request.

5. The complainant challenged ENISA’s decision to refuse access (by making a ‘confirmatory application’). He did not challenge the redaction of personal data of individuals other than the person concerned by the OLAF investigation.

6. In reply, ENISA maintained its position that no public access could be granted to the documents at issue as disclosure of the documents, even in part, would undermine the protection of personal data.

7. Dissatisfied with this outcome, the complainant turned to the Ombudsman.

The inquiry

8. The Ombudsman opened an inquiry into ENISA’s decision to refuse to give public access to the documents at issue to the extent that they do not constitute personal data of individuals other than the person concerned by the OLAF investigation.

9. In the course of the inquiry, the Ombudsman received ENISA’s reply on the complaint, including confidential information. The Ombudsman inquiry team also held a meeting with a representative of ENISA and inspected the documents at issue, that is,

1) the OLAF final report and the annexes to it,

2) two recommendations issued by OLAF, and

3) three documents related to ENISA’s follow-up,

as well as related documents.

The Ombudsman's proposal for a solution

10. In light of the broad scope of the concept of ‘personal data’, the Ombudsman found that it was reasonable for ENISA to consider that “identifiers such as the name” of the person concerned in the OLAF investigation as well as certain operational information related to this individual are covered by this concept.

11. The Ombudsman also found that the complainant had not established a necessity for disclosure of the personal data at issue, as required by the EU legislation on data protection (Regulation 2018/1725[5]). The Ombudsman therefore concluded that ENISA had been justified in withholding any personal data contained in the documents at issue.

12. However, based on the inspection of the documents by the Ombudsman inquiry team and the information provided by ENISA, the Ombudsman was not convinced that the documents constitute personal data in their entirety. The Ombudsman questioned, for example, whether information related to the kind of misconduct that was found by OLAF as well as the kind of follow-up measures taken by ENISA as such qualify as personal data. Based on the available information, the Ombudsman considered that, on its own, this information was not likely to allow for the identification of the person concerned.

13. In light of this, the Ombudsman made the following proposal for a solution[6]:

ENISA should re-consider its decision to refuse public access with a view to providing meaningful partial access to the requested documents, whilst protecting the privacy and integrity of the individuals concerned.

14. In response to the Ombudsman’s proposal for a solution, ENISA conducted a renewed assessment of the documents at issue. Based on this, ENISA concluded that, if it were to grant partial access, it could not provide a level of anonymisation that would render the documents useful to the complainant while, at the same time, ensuring the protection of personal data.

15. More specifically, ENISA argued that, as regards the risk for identification of individuals, all reasonable means that may be at the disposal of any third party, such as publicly available information or information that is available to a third party, including due to the third party’s professional or personal relationships, need to be taken into account.[7] Therefore and considering the context and the sensitivity of the information in the documents, the Agency’s small size in terms of staff and additional confidential elements, ENISA concluded that the documents have to be considered to constitute personal data in their entirety.

16. Following its renewed assessment, ENISA thus maintained that no public access could be granted to the documents at issue. ENISA did, however, disclose the fact that it had taken measures following-up on the OLAF recommendations at issue.

17. Upon receipt of ENISA’s reply to her proposal for a solution, the Ombudsman gave the complainant the opportunity to comment on her exchanges with ENISA.

18. In response, the complainant contended that ENISA’s interpretation of the concept of ‘personal data’ was overly broad, arguing that such an understanding of the data protection rules would effectively prevent any disclosure of OLAF documents. As regards the documents at issue, the complainant challenged ENISA’s view that an identification of individuals was likely if information on the nature of the misconduct or on ENISA’s follow-up were disclosed to the public.

The Ombudsman's assessment after the proposal for a solution

19. The Ombudsman notes ENISA’s willingness to re-consider its earlier position on the access request, thereby accepting her proposal for a solution.

20. While ENISA maintained that public access must be refused to the documents in their entirety, the Ombudsman considers this position reasonable based on the additional information provided by ENISA, including confidential elements. She regrets, however, that this information was not provided to the complainant at an earlier stage.

21. The Ombudsman recognises that an assessment of whether information related to an OLAF investigation into staff misconduct constitutes personal data within the meaning of Regulation 2018/1725 is a delicate task which depends on the specific circumstances of each case. To allow for public scrutiny and ensure accountability, they should always strive to give the widest access possible to documents that contain personal data in reply to a request for public access to documents.

22. Where the institution concerned finds that no or only very limited public access can be granted, the Ombudsman considers it good administrative practice to try and address the access request by providing information instead.

23. The Ombudsman thus welcomes that ENISA disclosed the fact that it had followed-up on OLAF’s recommendations in this case. Based on the Ombudsman inquiry team’s inspection of the documents, the Ombudsman can confirm that this was indeed the case.

24. Finally, the Ombudsman notes that ENISA did not list the documents at issue in its replies to the complainant’s access request. The Ombudsman has consistently taken the view that providing lists of identified documents is a matter of good administration, as it facilitates a requester’s understanding of the institution’s decision and the formulation of a request for review, if necessary.[8] While ENISA agreed in the course of the Ombudsman’s inquiry to include a list of identified documents in the report on the meeting in this case, which was shared with the complainant, the Ombudsman will make a suggestion as regards ENISA’s dealing with future public access to documents requests.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

The European Union Agency for Cybersecurity has accepted the Ombudsman’s proposal for a solution.

The complainant and ENISA will be informed of this decision.

Suggestion for improvement

As a matter of good administration, the European Union Agency for Cybersecurity should provide a list of the documents that it identifies when it replies to a request for public access to documents under Regulation 1049/2001, unless the very disclosure of a list undermines the interest(s) to be protected.

 

Teresa Anjinho

European Ombudsman

Strasbourg,27/08/2025

 

[1] For more information, visit: https://anti-fraud.ec.europa.eu/about-us/what-we-do_en or https://anti-fraud.ec.europa.eu/investigations/internal-administrative-investigations_en.

[2] See, for example, the OLAF report 2021, page 52: https://anti-fraud.ec.europa.eu/document/download/8d92a187-fae8-449f-8600-e84af9b2dabf_en?filename=olaf-report-2021_en.pdf.

[3] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: http://data.europa.eu/eli/reg/2001/1049/oj applicable to documents held by ENISA according to Article 28(1) of Regulation 2019/881 on ENISA and on information and communications technology cybersecurity certification: https://eur-lex.europa.eu/eli/reg/2019/881/oj.

[4] In accordance with Article 4(1)(b) of Regulation 1049/2001.

[5] Article 9(1)(b) of Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data: http://data.europa.eu/eli/reg/2018/1725/oj.

[6] A redacted version of the Ombudsman’s proposal for a solution is available at: https://www.ombudsman.europa.eu/solution/209060.

[7] ENISA referred to the judgment of the Court of 7 March 2024, OC v Commission, C-479/22 P: https://curia.europa.eu/juris/document/document.jsf?text=&docid=283526&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=7294278.

[8] See, for example, the Ombudsman’s proposal for a solution in case 1259/2024/NH on how the European Border and Coast Guard Agency (Frontex) dealt with a request for public access to documents related to guidance on return addressed to children: https://www.ombudsman.europa.eu/en/solution/en/201607.