Background to the complaint

1. One of the tasks of the European Anti-Fraud Office (OLAF) is to conduct independent administrative investigations into serious misconduct by staff and members of the EU institutions. Following its investigations, OLAF can make recommendations for actions to be taken by the EU institution concerned, including ‘disciplinary recommendations’ aimed at sanctioning wrongdoing by the person(s) concerned.[1]

2. In June 2024, the complainant, a journalist, asked the EIB for public access[2] to documents relating to OLAF’s investigations into EIB staff members for the period from 2015 to 2023. In particular, the complainant sought public access to:

• OLAF’s final written reports and recommendations; and
• the EIB’s final disciplinary decisions.

3. In August 2024, the EIB replied. It stated that OLAF had issued 13 reports relating to allegations of breaches of the EIB rules by EIB staff members. It said that it followed up on all cases and that it adopted 20 disciplinary sanctions and six written warnings. It closed four cases without adopting any disciplinary measures and two cases were suspended. The EIB refused public access to all documents in their entirety, arguing that disclosure would undermine the purpose of investigations[3], the protection of personal data[4] and the EIB’s decision-making process[5].

4. The complainant asked the EIB to review its decision (by making a ‘confirmatory application’).

5. In February 2025, the EIB issued its final decision. It granted partial access to ten OLAF reports but maintained its refusal to disclose the remaining three OLAF reports and documents related to the EIB disciplinary follow-up decisions. In doing so, it argued that full disclosure would undermine the protection of the purpose of investigations, personal data and its decision-making process.

6. With its refusal, the EIB provided the complainant with a one-page overview of the follow-up actions it had taken concerning the OLAF reports and recommendations. Following its investigations, OLAF issued 31 disciplinary recommendations to the EIB. The EIB took follow-up actions in all 31 cases. 28 cases are now closed, two are suspended while follow-up actions are going on at national level, and 1 case is still ongoing at the EIB. Out of the 28 cases that are now closed, three were referred to disciplinary proceedings with a Disciplinary Committee. The first case resulted in the dismissal of the staff member; the second case resulted in a reduced pensions for a period of eight years; and the third case was closed without any sanctions. 16 cases were referred to disciplinary proceedings without a Disciplinary Committee and were closed with a written reprimand. Six cases were closed with a written warning, and three cases were closed without further measures.

7. Dissatisfied with the EIB’s refusal to grant full public access to the requested documents, the complainant turned to the Ombudsman in March 2025.

The inquiry

8. The Ombudsman opened an inquiry into the EIB’s refusal to give full public access to the requested documents.

9. During the inquiry, the Ombudsman received the EIB’s additional views and the Ombudsman inquiry team inspected the documents at issue.

Arguments presented to the Ombudsman

By the complainant

10. The complainant considered that the redactions of personal data, as well as those to protect OLAF’s investigation methods and the decision-making process, made in the ten partially disclosed OLAF reports, are excessive. He argued that the EIB failed to demonstrate a necessity for such extensive redactions in relation to the content that was disclosed.

11. The complainant noted that OLAF’s investigations and the EIB’s follow-up disciplinary actions have been concluded. He argued that, in accordance with EU case law[6], documents relating to closed investigations should generally be accessible, subject only to limited and well-justified exceptions.

12. The complainant further argued that the EIB was wrong when it concluded that the public interest in disclosure does not override the exceptions applied. He noted that the Court of Justice[7] held that transparency is essential to ensuring accountability within EU institutions. Given that the requested documents concern EU staff misconduct and disciplinary actions within a key EU financial institution, there is a significant public interest in transparency, accountability and policy improvement within the EU institutions. The public has a strong interest in understanding how such cases were handled. The complainant considered that the EIB’s refusal to disclose meaningful information about these cases erodes trust in its accountability mechanism and fails to align with the EU’s commitment to open governance.

13. The complainant further noted that the Court of Justice has consistently ruled that restrictions on public access to documents must be proportionate and subject to a case-by-case assessment.[8] He considered that the EIB did not provide sufficient justifications as to why wider access could not be given.

By the EIB

14. The EIB argued that full disclosure of the requested documents would undermine the protection of personal data, ongoing and future investigations and the decision-making process.

OLAF documents

15. Concerning the complainant’s argument that the investigations are closed, the EIB considered that a distinction must be made between the three cases for which follow-up activities were still ongoing and therefore a presumption of non-disclosure could apply, and the ten closed investigations. As regards the latter, the fact that relevant investigations and follow-up proceedings were closed did not imply that the requested documents had to be disclosed. The exceptions to public access could continue to still apply to these documents, notwithstanding the closure of the investigations. The EIB granted partial access to those documents providing the following arguments.

16. First, the EIB noted that the documents in question contain not only the names of EIB staff members but also those of their family members and information relating to their daily lives. It argued that full disclosure of such information would make the individuals identifiable and would thereby undermine their privacy and integrity.[9]

17. Second, the EIB argued that the documents contain details on the methods, timing and strategies used by OLAF to carry out its investigations. Disclosure would risk jeopardising the integrity and effectiveness of ongoing and future investigations, by putting individuals or entities that are currently under investigation (or those under investigation in the future) in an advantageous position, as they could adapt their behaviour to avoid detection. This would, ultimately, affect the effectiveness and the purpose of ongoing and future investigations carried out by OLAF.

18. Finally, the EIB considered that disclosure would also reveal detailed information on how OLAF collaborates with the EIB services in carrying out its investigations.[10] Information on strategies and methods used by the EIB and OLAF may be combined with information available in the EIB’s reports on the disciplinary follow-up. Disclosure would therefore interfere with the EIB’s ability to determine how to proceed internally with these investigations, with a negative impact on the collaboration with OLAF. This would seriously undermine the EIB’s decision-making process.[11]

19. As far as the three OLAF reports, which were withheld in their entirety, are concerned, the EIB stated that they concerned cases, where the relevant disciplinary, judicial or administrative procedures were still ongoing. Disclosure of these reports and any information relating to these pending cases was therefore presumed to undermine the protection of the purpose of the ongoing investigations.[12]

EIB documents

20. The EIB stated that most of the information contained in the EIB’s disciplinary decisions is covered by the need to protect the privacy and integrity of the individual. The reports contain personal data of family members and information regarding their daily lives. Furthermore, the reports contain information on sources, methods, timing and strategies used by OLAF. Disclosure would therefore undermine OLAF’s investigations. The reports on the EIB’s follow-up to OLAF’s recommendations contain also opinions drawn up for internal use. Each case is unique, as are the follow-up actions that the EIB takes. Disclosure of the various actions and decisions taken without being able to provide details on the specificities of each case could lead to an incomplete and misleading representation of how the EIB addresses OLAF investigations and recommendations and would put an unnecessary burden on the EIB in handling future cases. Furthermore, disclosure could reveal the EIB’s own strategies and methodologies which would allow staff members in future cases to anticipate and counteract future investigative measures and their follow-up.

21. The EIB concluded that partial access to the decisions would not be meaningful. Instead, it provided a summary of the information the complainant requested. 

Overriding public interest

22. Concerning the complainant’s argument that disclosure of the requested documents is in the public interest, the EIB noted that the exception concerning the privacy and integrity of the individual cannot be overridden by a public interest in disclosure.

23. Furthermore, the EIB disagreed with the complainant’s view that disclosure would serve to enhance public trust in the EIB’s commitment to addressing serious misconduct. It noted that the EIB’s high standards of integrity are detailed in its publicly available policy documents and its annual reports that show how it addresses misconduct cases.

The Ombudsman’s assessment

Withheld documents

24. The EIB refused public access to three OLAF reports and its recommendations, as well as to all the EIB’s disciplinary decisions in their entirety.

OLAF reports

25. In refusing access to the three OLAF reports, the EIB relied on a general presumption of confidentiality that is set out in its Transparency Policy[13], arguing that even partial disclosure of the documents would undermine the protection of the purpose of OLAF’s investigations.

26. In this context, the Ombudsman notes that EU case-law[14] recognises a general presumption of confidentiality for documents in OLAF investigations. In accordance with this case-law, the general presumption applies to ongoing investigations and to their follow-up, to the extent that the follow-up takes place within a reasonable period.[15] While this case law was established in relation to the exceptions to public access set out in Regulation 1049/2001, the principles that the Courts developed apply in this case by analogy.

27. The inspection and the additional views that the EIB provided confirm that follow-up activities were ongoing in relation to the three OLAF reports in question. Specifically, there were judicial proceedings ongoing at national level relating to two OLAF reports, and there were administrative follow-up proceedings ongoing at the EIB relating to the third OLAF report.

28. Thus, the EIB’s refusal to grant public access to the three OLAF reports based on a general presumption of confidentiality is justified.

EIB disciplinary decisions and OLAF recommendations

29. The EIB also refused access to OLAF’s recommendations and the EIB’s disciplinary decisions, arguing that disclosure would undermine the protection of personal data, the purpose of investigations and its decision-making process.

30. The concept of ‘personal data’^[16] is very broad. It covers any information related to an identified or identifiable person. The information does not need to be linked to a person’s private life. Information concerning a person’s professional activity can also constitute personal data, namely if it allows, “directly or indirectly”, for the identification of the individual concerned. According to EU case-law^[17], “[t]he use by the EU legislature of the word ‘indirectly’ suggests that, in order to treat information as personal data, it is not necessary that that information alone allows the [individual concerned] to be identified.”  Rather, it is sufficient if that information, in combination with other information from the same or from different sources, allows for the identification of the individual in question. In addition, it is not necessary that the public at large can deduce the individual’s identity on that basis. It is enough if one person, for example, someone working in the same field as the individual in question and familiar with their professional background, can identify them.^[18]

31. It was therefore reasonable for the EIB to consider that not only the names and contact details of individuals contained in the documents at issue constitute personal data, but also other information that would make the individuals concerned identifiable, on its own or in combination, including with publicly available information. This includes the individuals’ position and years of service.

32. Based on the inspection of the documents, the Ombudsman confirms that the documents contain a significant amount of personal data in the form of the name, position, and years of service of individual staff members of the EIB. The documents contain also other information that, if disclosed, could make the individuals identifiable. As such, this information constitutes personal data. The inspection however also showed that the requested documents contain limited information on procedural aspects that cannot be considered personal data as such.

33. Before personal data may be transmitted to an applicant, three cumulative conditions must be met.[19] The applicant must first show that the transfer of the requested personal data is necessary for a specific purpose in the public interest. For such a ‘necessity’ to be established, it must be demonstrated that disclosure of the personal data is the most appropriate means among other possible measures to achieve the objective pursued.[20] Where the applicant has established such a necessity, the institution must show, after having weighted the various competing interests, that there is no reason to assume that the individual’s legitimate interests might be prejudiced by the disclosure of the personal data. Third, if this is the case, they must establish that, in light of the objective pursued by the applicant, disclosure would be proportionate nevertheless.

34. As regards the need for disclosure, the complainant argued, in essence, that disclosure was essential to ensure transparency, accountability and public trust.

35. While the Ombudsman considers that the complainant pursues a legitimate objective, she is not convinced that disclosure of the personal data contained in the documents would contribute to this objective. Staff members who breach their obligations under the EU Staff Regulations[21] do not forfeit their right to privacy. Such misconduct is addressed by the relevant administrative procedures, including investigations by OLAF and possible disciplinary measures. Furthermore, disclosure would no longer be proportionate, as the EIB has provided the complainant with a summary of all the follow-up actions it has taken, following the 31 recommendations that OLAF issued: While one case is still ongoing at EIB level and two further cases are suspended pending the judicial proceedings at national level, the EIB closed the remaining 28 cases with the following disciplinary measures:

• Three cases were referred to disciplinary proceedings with a Disciplinary Committee. One case was closed with the dismissal of the EIB staff member, another case was closed with a sanction in the form of a reduced pension for a period of eight years, and the last case was closed without a sanction;
• 16 cases were referred to disciplinary proceedings without a Disciplinary Committee and were closed with a written reprimand;
• Six cases were closed with a written warning; and
• Three cases were closed without further measures.

Furthermore, following OLAF’s financial recommendations, the EIB has finalised all relevant recoveries.

36. As set out above, the inspection showed that not all information that is contained in the requested documents constitutes personal data. While some of this information, such as whether the disciplinary proceedings involved the Disciplinary Committee or certain mitigating factors, may not, in isolation, be considered to constitute personal data as such, these parts must still be considered in the broader context of the documents at issue, where their disclosure could contribute to identifying the respective individuals. When deciding on the disclosure of documents that contain a significant amount of personal data, institutions must undertake a very delicate balancing exercise. The institution must assess whether there is a risk that the individual could be directly or indirectly identified from the information disclosed. The fact that additional information is necessary to identify the individual does not mean that the data at issue cannot be classified as personal data.[22] Neither does the fact that such additional information comes from a different source.[23] The EU Courts have also found that the risk is insignificant only where it is ‘prohibited by law or impossible in practice’.[24]

37. In view of the fact that the requested documents contain such a significant amount of personal data, the delicate balancing exercise that the EIB had to undertake in deciding whether public access could be granted and the fact that the EIB provided the complainant with a summary of the follow-up actions it has taken and the sanctions it has imposed, the Ombudsman considers that, overall, the EIB’s refusal to disclose its disciplinary decisions and OLAF’s recommendations was not unreasonable. However, she will make a suggestion for improvement to the EIB to consider if at least some parts of the EIB disciplinary decisions that contain purely administrative information could be disclosed to the complainant without risking disclosing personal data.  

Partially disclosed documents

38. The EIB granted partial access to ten OLAF reports, redacting personal data, investigation methods and information to its decision-making process.

39. The documents contain a significant amount of personal data in the form of the names of the individual staff members and other information that, if disclosed, would make the staff members identifiable.

40. As set out in paragraph 33 above, before such personal data can be disclosed, three cumulative conditions must be met. First, the disclosure must be necessary for a specific purpose in the public interest. As also set out above, while the complainant’s objectives are legitimate, they are not, in themselves, sufficient to establish a necessity. The Ombudsman therefore considers that withholding the personal data in the documents is justified.

41. The documents furthermore contain information about OLAF’s investigation methods as well as the EIB’s internal decision-making. The EIB argued that disclosure of this information would risk jeopardising the integrity and effectiveness of ongoing and future investigations thereby giving individuals or entities that are under investigation, now or in future, an advantage, as it would allow them to adapt their behaviour to avoid detection. Furthermore, disclosure would interfere with the EIB’s ability to determine how to proceed internally with these investigations, with a negative impact on the collaboration with OLAF.

42. While the inspection showed that some of the information, in particular information related to the investigative activities carried out by OLAF is very generic, the remainder of the information also contains personal data and relates to the EIB’s internal audit and decision-making activities. The inspection further showed that this information is interlinked throughout 12 of the 13 OLAF reports.

43. The complainant argued that transparency is essential in ensuring accountability within the EU institution and that there was a strong public interest in understanding how the EIB handled these cases.

44. In accordance with EU case-law[25], considerations of a purely general nature are not enough to establish an overriding public interest in disclosure. The Ombudsman thus considers that the complainant’s general references to transparency, accountability and the public trust are not sufficient to establish and overriding public interest in disclosure. In particular in view of the overview of the follow-up actions that the EIB has provided to the complainant. It informed the complainant that it finalised all recoveries and launched pre-disciplinary proceedings in all cases.

45. In light of the above, the Ombudsman considers that the EIB’s decision to refuse full public access was overall reasonable.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

There was no maladministration in the EIB’s refusal to give full public access to the requested documents.

Suggestion for improvement

The EIB should assess its follow-up disciplinary decisions again with a view of granting public access to the parts of these documents that contain purely administrative information and that could be disclosed to the public without risking disclosing personal data.

The complainant and the EIB will be informed of this decision.

Teresa Anjinho
European Ombudsman

Strasbourg, 29/07/2026

 

[1] For more information, visit: https://anti-fraud.ec.europa.eu/about-us/what-we-do_en

[2] The complainant made his public access request under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents; https://eur-lex.europa.eu/eli/reg/2001/1049/oj/eng. However, as Regulation 1049/2001 does not apply to the EIB, the EIB handled the request in line with its transparency policy; https://www.eib.org/en/publications/20250191-eib-group-transparency-policy.

[3] Article 5.6 EIB Group Transparency Policy.

[4] Article 5.4b EIB Group Transparency Policy.

[5] Article 5.7 EIB Group Transparency Policy.

[6] Judgment of the General Court of 22 March 2011 in Case T-233/09, Access Info Europe v Council; https://infocuria.curia.europa.eu/tabs/document/T/2009/T-0233-09-00000000RD-01-P-01/ARRET/84636-EN-1-html

[7] Judgment of the Court of 2 October 2014 in Case C-127/13 P, Strack v Commission; https://infocuria.curia.europa.eu/tabs/document/C/2013/C-0127-13-00000000PV-01-P-01/ARRET/158192-EN-1-html

[8] Judgment of the Court of 17 October 2013 in Case C-280/11 P, Access Info Europe v Council; https://infocuria.curia.europa.eu/tabs/document/C/2011/C-0280-11-00000000PV-01-P-01/ARRET/143182-EN-1-html

[9] Article 5.4b of the EIB Group Transparency Policy.

[10] Article 5.6 of the EIB Group Transparency Policy.

[11] Article 5.7 of the EIB Group Transparency Policy.

[12] Article 5.6 third bullet point of the EIB Group Transparency Policy.

[13] Article 5.6, 2nd paragraph of the EIB Group Transparency Policy.

[14] Judgment of the General Court of 26 May 2016 in Case T-110/15, IMG v Commission, para 33; https://infocuria.curia.europa.eu/tabs/document/T/2015/T-0110-15-00000000RD-01-P-01/ARRET/178781-EN-1-html

[15] Ibid, para 35.

[16] Article 3(1) of Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (Regulation 2018/1725); https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng

[17] Judgment of the Court of 7 March 2024 in Case C-479/22 P, OC v Commission, paras 46-47.: https://curia.europa.eu/juris/document/document.jsf?text=&docid=283526&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=26709  

[18] Ibid, para 60.

[19] Article 9(1)(b) of Regulation 2018/1725.

[20] See, for example, Judgment of the General Court of 18 June 2025, Zver v European Commission, T-235/24, paragraph 66: https://curia.europa.eu/juris/document/document.jsf?text=&docid=301286&pageIndex=0&doclang=FR&mode=lst&dir=&occ=first&part=1&cid=601186.

[21] Regulation 31 (EEC), 11 (EAEC), laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Economic Community and the European Atomic Energy Community: https://data.europa.eu/eli/reg/1962/31(1)/2014-05-01

[22] Judgment of the Court of 7 March 2024 in Case C-479/22 P, OC v Commission, para 49.: https://curia.europa.eu/juris/document/document.jsf?text=&docid=283526&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=26709 

[23] Ibid, para 55.

[24] Judgment of the Court of 19 October 2016 in Case C-582/14, Breyer v Bundesrepublik Deutschland, para 46; https://infocuria.curia.europa.eu/tabs/affair?sort=AFF_NUM-DESC&searchTerm=%22C-582%2F14%22&publishedId=C-582%2F14

[25] Judgment of the General Court of 2 October 2024 in Case T-606/23, Soares v Commission, para 60; https://infocuria.curia.europa.eu/tabs/document/T/2023/T-0606-23-00000000RD-01-P-01/ARRET_NP/290618-FR-1-html