Background to the complaint

1. On 9 July 2025, the complainant asked the Single Resolution Board (SRB) for public access[1] to various documents concerning tender documentation, as well as internal audit reports. More specifically, the complainant’s request comprised:

• 1. Full tender documentation for all SRB contracts from 2021–2023, including award notices, contractor identities, and evaluation criteria, with focus on contracts exceeding €140,000 and related to ICT security, business continuity management, ethics/compliance, and oversight of Less Significant Institutions, aligning with critical audit findings in the SRB's 2023 Annual Report;
• 2. Internal audit reports from 2021–2023, with specific details on the critical and high-priority findings identified in 2023;
• 3. Records of corrective measures implemented following the ECA Special Report 28/2023;[2]
• 4. Conflict of interest declarations for SRB procurement and resolution officials;
• 5. Records of mediation or dispute resolution concerning procurement or financial oversight issues;
• 6. Open sanctions or similar vetting records for all contractors involved in SRB contracts.

2. In its initial reply, the SRB identified 21 documents as falling within the scope of the access request, covering points 1, 2 and 4 of the request. Two of these documents were already available on the SRB’s website. The SRB gave full access to one further document and partial access to the remaining eighteen documents. The SRB invoked various exceptions to the right of public access to justify the redactions in the eighteen documents, namely the protection of privacy and the integrity of the individual,[3] the protection of commercial interests,[4] the protection of the purpose of inspections, investigations and audits,[5] read in conjunction with the SRB Financial Regulation,[6] and the protection of the public interest as regards the financial, economic or monetary policy of the EU or a Member State.[7] The SRB said that it held no documents in relation to the remaining points of the complainant’s access request.

3. The complainant asked the SRB to review its decision (by making a ‘confirmatory application’) and challenged the SRB’s statement that no documents existed in relation to the remaining three points of their access request.

4. On 8 October 2025, the SRB adopted a confirmatory decision, maintaining its refusal to grant full access to the eighteen documents at issue and confirmed that it held no documents related to points 3, 5, and 6 of the complainant’s access request. 

5. Dissatisfied with the outcome, the complainant turned to the Ombudsman.

The inquiry

6. The Ombudsman opened an inquiry into the SRB’s decision to grant only partial access to eighteen documents under Regulation 1049/2001.

7. As regards the complainant’s claim that the SRB should have identified additional documents to fall within the scope of their request, the Ombudsman found that the complainant had not put forward sufficient elements to rebut the presumption of legality attached to the SRB’s statement that it held no documents covering three points of the complainant’s request. Therefore, the Ombudsman considered that there were insufficient grounds to open an inquiry into this aspect of the complaint.

8. During the inquiry, the Ombudsman inquiry team inspected the unredacted versions of the eighteen documents at issue and received additional confidential explanations from the SRB.

Arguments presented

By the complainant

9. The complainant argued that the redactions made in the documents were excessive. The complainant further argued that an overriding public interest in disclosure existed, namely the need for procurement transparency, an aspect highlighted in Special Report 28/2003 of the European Court of Auditors (ECA), and the need for public scrutiny of the SRB’s compliance with the EU’s Financial Regulation.[8]

By the Single Resolution Board

Privacy and the integrity of the individual (Article 4(1)(b) of Regulation 1049/2001)

10. The SRB invoked the exception pertaining to the protection of personal data in relation to two types of documents, namely in relation to an evaluation report and the declarations of absence of conflicts of interest and of confidentiality.

11. Specifically, the SRB said that it had to redact personal data related to the members of the evaluation committee, such as their names and signatures.

12. The SRB explained that the complainant had not established a necessity for a specific purpose in the public interest to have the personal data transmitted, as required by the EU legislation on data protection.[9] In particular, it considered that the public interest put forward by the complainant, namely procurement transparency, was formulated in an excessively broad and general manner. Furthermore, the SRB did not identify any section of the ECA Special Report 28/2023 which would justify the transmission of personal data for the purpose of scrutinising the ‘SRB’s compliance with [the EU] Financial Regulation’.

Commercial interests of a natural or legal person (Article 4(2), first indent of Regulation 1049/2001)

13. The SRB applied the exception to parts of one document, namely an evaluation report.

14. The SRB referred to case law^[10] recognising a ‘general presumption of non-access to bids submitted by tenderers, to ensure the openness of public procurement to undistorted competition, the underlying need to ensure that operators can freely communicate with contracting authorities without having to fear that possibly damaging information is communicated to third parties and the general principle that business secrets must be protected.’ In this regard, the SRB said that it had redacted the bids of the winning companies.

15. In addition, the SRB redacted the names of unsuccessful tenderers, arguing that their public disclosure could undermine the reputation of the companies involved.

16. Finally, the SRB said that this exception had to be interpreted in light of Article 339 of the Treaty on the Functioning of the European Union (TFEU) and Article 170(3) of the EU Financial Regulation, which require the SRB to take all necessary precautions to ensure that the protection of information about undertakings covered by professional secrecy and other confidential information is not undermined.

The purpose of inspections, investigations and audits (Article 4(2), third indent of Regulation 1049/2001)

17. The SRB invoked this exception in relation to the ten internal audit reports to which it granted partial access.

18. The SRB referred to case law recognising that there is a general presumption that the documents forming part of the administrative file of an audit can be considered as manifestly covered, in their entirety, by the exception in Article 4(2), third indent of Regulation 1049/2001.[11] It noted that a general presumption of confidentiality applies to the reports and findings of an internal auditor before they have validated the action taken for their implementation.[12] The SRB argued that parts of the documents at issue concerned audits that were ‘still in progress and the SRB Internal Auditor [had] not yet validated follow-up action’. Their full disclosure could thus endanger the completion of the respective audits.^[13] The SRB also referred to Article 74(9) of the SRB Financial Regulation, which stipulates that the reports and findings of the internal auditor shall be accessible to the public only after validation by the internal auditor of the action taken for their implementation.

The public interest as regards the financial, economic or monetary policy of the EU or a Member State (Article 4(1)(a), fourth indent of Regulation 1049/2001)

19. The SRB argued that it had to redact operational information about the SRB’s ICT infrastructure. It argued in particular that, disclosing certain findings and recommendations could provide potential attackers with a clear roadmap of areas that are more vulnerable. The SRB contended that disclosure of this information could expose the SRB’s ICT infrastructure to increased risks of exploitation, intrusion, or attack by malicious actors.

20. The SRB also said that it had redacted information concerning critical processes and crisis management scenarios. Finally, the SRB argued that certain redactions were necessary to protect against the ‘risk of exploitation or attack such as data breach’.

21. The SRB argued that disclosure of the above information would seriously undermine its operations and subsequently result in detrimental effects on the functioning of the SRB, thereby adversely affecting financial stability.

Overriding public interest

22. The SRB considered that the complainant’s arguments were of a too general nature to demonstrate an overriding public interest in disclosure.

The Ombudsman's assessment

23. The purpose of Regulation 1049/2001 is to give the public the widest possible access to documents held by the EU institutions. However, the right to public access is subject to certain exceptions to protect public or private interests set out in Article 4 of Regulation 1049/2001.

24. The SRB refused public access to parts of the eighteen documents at issue on the basis of Article 4(1)(b) (protection of privacy and the integrity of the individual), Article 4(2) first indent (protection of commercial interests), Article 4(2) third indent (protection of the purpose of inspections, investigations and audits) and Article 4(1)(a) fourth indent (protection of the public interest as regards the financial, economic or monetary policy of the EU or a Member State) of Regulation 1049/2001.

Privacy and the integrity of the individual (Article 4(1)(b) of Regulation 1049/2001)

25. The concept of ‘personal data’[14] is very broad. It covers any information related to an identified or identifiable person. 

26. Based on the inspection of the relevant documents, the Ombudsman confirms that the information that the SRB redacted to protect privacy and the integrity of individuals was limited and can reasonably be considered to constitute personal data.

27. Any disclosure of personal data must fulfil the conditions set out in the EU legislation on data protection (Regulation 2018/1725). According to these rules, EU institutions must follow a three-stage analysis in considering whether personal data can be disclosed.[15] First, they must assess whether the applicant established a specific need for disclosure of the personal data that is in the public interest. Second, if such ‘necessity’ exists, they must assess whether disclosure might undermine the legitimate interests of the individual(s) concerned. Third, if this is the case, they must establish that, in light of the objective pursued by the applicant, disclosure would be proportionate, nevertheless.

28. As regards the need for disclosure, the complainant argued, in essence, that wider access to the documents at issue should be given to ensure procurement transparency and to enable public scrutiny of the SRB’s compliance with the EU Financial Regulation.

29. The Ombudsman considers that the complainant has not explained how disclosure of the personal data contained in the documents would contribute to ensuring procurement transparency or public scrutiny of the SRB’s compliance with the EU Financial Regulation. The Ombudsman notes, in this respect, that the SRB has granted wide public access to the documents at issue and the redactions made under Article 4(1)(b) of Regulation 1049/2001 do not render the documents illegible.

30. The Ombudsman therefore finds that the complainant did not establish a necessity for disclosure of the personal data in question. This means that the assessment of the second and third stages of the test described above is not necessary.

31. The Ombudsman thus finds that the redactions that the SRB made to protect personal data were justified.

Commercial interests of a natural or legal person (Article 4(2), first indent Regulation 1049/2001)

32. The inspection of the documents showed that the SRB redacted, under the commercial interests exception, the bids of the selected tenderers and the names of the non-selected tenderers.

33. The Ombudsman confirms that the redactions of the bids of successful tenderers are in line with the case law cited by the SRB.[16]

34. As regards the redactions of the information concerning unsuccessful tenderers, the Ombudsman notes that, in line with existing case law, damage to the reputation of an undertaking constitutes damage to its commercial interests insofar as the reputation is essential for the performance of its economic activities.[17] Therefore, the Ombudsman considers the SRB’s position - that the release of the names of unsuccessful tenderers would likely undermine their reputation and hence their commercial interests - to be reasonable.

The purpose of inspections, investigations and audits (Article 4(2), third indent of Regulation 1049/2001)

35. The SRB considered that a general presumption of non-disclosure could be applied to parts of the ten internal audit reports at issue. Specifically, the SRB argued that the General Court acknowledged that ‘the documents forming part of the administrative file of an audit can be considered as manifestly covered, in their entirety, by the exception referred to in the third indent of Article 4(2) of Regulation 1049/2001, at least as long as the audit procedure is ongoing’.[18]

36. The Ombudsman notes that Article 74(9) of the SRB Financial Regulation[19] replicates in essence the content of Article 118(9) of the EU Financial Regulation, notably that ‘the reports and findings of the internal auditor (...) shall be accessible to the public only after validation by the internal auditor of the action taken for their implementation’.

37. The General Court has ruled that Article 4(2), third indent of Regulation 1049/2001 has to be read in conjunction with the above provision of the EU Financial Regulation, as both provisions have equal status[20]. The case law has also recognised a general presumption that the documents forming part of the administrative file of an audit can be considered as manifestly covered, in their entirety, by the exception set out in the third indent of Article 4(2) of Regulation 1049/2001[21]. Furthermore, as long as the internal auditor has not validated actions taken for the implementation of certain audit findings, those findings are covered by this exception.[22]

38. The Ombudsman notes that the SRB nevertheless conducted an individual assessment of the content of each internal audit report and granted partial access, which she commends.

39. Based on the inspection of the requested documents and the additional information provided by the SRB, the Ombudsman confirms that the SRB redacted only those parts of the relevant documents, which, at the time of the adoption of the confirmatory decision, related to findings with actions pending validation by the internal auditor.

40. In this context, the Ombudsman finds it reasonable for the SRB to consider that the release of the relevant parts of the documents would undermine the purpose of the audits.

The public interest as regards the financial, economic or monetary policy of the EU or a Member State (Article 4(1)(a), fourth indent of Regulation 1049/2001)

41. The EU institutions enjoy a wide margin of discretion when determining whether disclosing a document would undermine any of the public interests protected under Article 4(1)(a) of Regulation 1049/2001, such as the financial, economic or monetary interest of the EU and its Member States.[23] As such, the Ombudsman’s inquiry aimed to assess if there was a manifest error in the SRB’s assessment that the relevant parts of the documents at issue could not be disclosed.

42. The inspection of the documents by the Ombudsman inquiry team showed that the SRB invoked this exception only for limited parts of the documents at issue.

43. Therefore, the Ombudsman found no manifest error in the SRB’s assessment that disclosure of the redacted parts, at the time of the adoption of the confirmatory decision, could have exposed vulnerabilities of the SRB, undermine its functioning and, as a result, affect financial stability.

Overriding public interest

44. The public interests protected by Article 4(1)(a) of Regulation 1049/2001 cannot be superseded by another public interest that is deemed more important. This means that, if an institution considers that any of these interests could be undermined by disclosure, it must refuse access.

45. However, the exceptions for the protection of commercial interests and the purpose of inspections, investigations and audits can be set aside by another public interest that is deemed more important.

46. In this context, the Ombudsman considers that it was reasonable for the SRB to consider the complainant’s references to procurement transparency and ‘scrutiny of SRB’s compliance with Financial Regulation 2018/1046’ too broad and general in nature to demonstrate an overriding public interest in disclosure of the relevant parts.

47. On the basis of the above, the Ombudsman considers that the SRB was justified in refusing full public access to the eighteen documents at issue.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

There was no maladministration by the Single Resolution Board in refusing to give full public access to the documents at issue.

The complainant and the Single Resolution Board will be informed of this decision.

Teresa Anjinho
European Ombudsman

Strasbourg, 24/04/2026

 

[1] In accordance with Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32001R1049, and the SRB Decision of 9 February 2017 on public access to the SRB documents: https://www.srb.europa.eu/system/files/media/document/srb-es-2017-01_decision_public_access_to_the_srb_documents.pdf.

[2] European Court of Auditors Special Report 28/2023 Procurement in EU agencies: room for improvement: https://www.eca.europa.eu/ECAPublications/SR-2023-28/SR-2023-28_EN.pdf

[3] Article 4(1)(b) of Regulation 1049/2001.

[4] Article 4(2), first indent of Regulation 1049/2001.

[5] Article 4(2), third indent of Regulation 1049/2001.

[6] Article 74(9) of the Decision of the Single Resolution Board of 17 January 2020 adopting the Financial Regulation of the Single Resolution Board (SRB/ PS/2020/05): https://www.srb.europa.eu/system/files/media/document/srb_financial_regulation.docx_.pdf

[7] Article 4(1)(a), fourth indent of Regulation 1049/2001.

[8] Regulation 2018/1046 on the financial rules applicable to the general budget of the Union: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1046-20221214

[9] Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data: http://data.europa.eu/eli/reg/2018/1725/oj.

[10] Judgment of the Court of Justice of 14 February 2008, Varec v Commission, C-450/06, paragraphs 33-35 and judgment of the General Court of 26 March 2020, ViasSat Inc. v Commission, T-734-17, paragraph 43.

[11] Judgment of the General Court of 12 May 2015, Technion v Commission, T- 480/11, paragraphs 55-65.

[12] Judgment of the General Court of 26 March 2020, Bonnafous v European Commission, T-646/18, paragraph 74 and the case law cited therein.

[13] To support its argument, the SRB referred to the following judgments: of 6 July 2006, Franchet and Byk v Commission, T-391/03 and T-70/04, paragraphs 109 and 110; of 12 May 2015, Technion v Commission, T- 480/11, paragraphs 55­65; of 26 March 2020, Bonnafous v European Commission, T-646/18, paragraph 74 and the case law cited therein.

[14] Article 3(1) of Regulation 2018/1725, cited above.

[15] Article 9(1)(b) of Regulation 2018/1725.

[16] Judgment of the Court of Justice of 14 February 2008, Varec v Commission, C-450/06, paragraphs 33-35 and judgment of the General Court of 26 March 2020, ViasSat Inc. v European Commission, T-734-17, paragraph 43.

[17] Judgment of the General Court of 17 July 2024, Auken et al. v Commission T‑689/21, paragraph 167.

[18] Judgment of the General Court of 12 May 2015 Technion v Commission, T-480/11, paragraphs 55-65.

[19] Article 74(9) of the SRB Financial Regulation reads as follows: ‘The reports and findings of the internal auditor shall be accessible to the public only after validation by the internal auditor of the action taken for their implementation.’

[20] Judgment of the General Court of 12 May 2015, Technion v Commission, T-480/11, paragraphs 55-74.

[21] Judgment of the General Court of 12 May 2015, Technion v Commission, T- 480/11, paragraphs 55-65.

[22] Judgment of the General Court of 26 March 2020, Bonnafous v European Commission, T-646/18, paragraphs 73-76.

[23] See, for example, judgment of the General Court of 11 July 2018, ClientEarth v Commission, T­644/16.