Decision of the European Ombudsman closing his inquiry into complaint 491/2008/PB against the European Data Protection Supervisor

THE BACKGROUND TO THE COMPLAINT

1. The case concerns an alleged failure by the European Data Protection Supervisor (EDPS) to reply to correspondence and, more specifically, to grant access to documents.

2. In 2005/2006, the complainant, a former Commission official, obtained access to his personal and medical files at the European Commission. He did so following a request that he had made for the recognition of an occupational disease (and on which he eventually obtained a positive decision). Not being satisfied with the level and form of access that he had been granted, he complained to the EDPS concerning breaches of his data rights, and to the Ombudsman regarding an alleged breach of Regulation 1049/2001[1] regarding public access to documents (complaint 723/2006/(WP)PB; this inquiry was closed in December 2007).

3. Subsequently, on 30 October 2006, the EDPS sent the complainant a letter which essentially informed him of two decisions. One which examined a data protection issue that he had raised in a complaint against the Commission; and one which responded to the complainant's request for access to the case files and correspondence relating to two complaints that he had made to the EDPS against the European Commission. In December 2006, the complainant contested certain parts of the EDPS' letter. For a prolonged period (14 months), the EDPS sent the complainant holding letters but did not send him a substantive reply. As a result, in February 2008, the complainant turned to the Ombudsman.

4. The Ombudsman understood from the EDPS' holding replies to the complainant that the preparation of a substantive reply was in its final phase at the end of 2007. He, therefore, decided to use a 'telephone procedure' to find out quickly whether the EDPS would be able to send the complainant a prompt reply. The EDPS informed the Ombudsman that this would not be possible. The Ombudsman, therefore, opened the present full inquiry.

THE SUBJECT MATTER OF THE INQUIRY

5. The Ombudsman opened his inquiry into the following allegations and claim.

Allegations:

1. The EDPS' decision C2006-0390 of 30 October 2006, insofar as it concerns the complainant's request for access to documents, was not compliant with the relevant rules.
2. The EDPS failed to provide a substantive reply to a request for re-examination made by the complainant on 10 December 2006.
3. The EDPS' failure to reply, over a period of approximately 14 months, to the complainant's above-mentioned request of 10 December 2006, and the repeated failures to fulfil express commitments to reply, constitute maladministration.

The complainant claimed (implicitly) a substantive reply to the request for re-examination that he had made to the EDPS in December 2006.

THE INQUIRY

6. On 14 March 2008, the Ombudsman asked the EDPS to send an opinion on the above allegations and claims by 30 June 2008. On 12 September 2008, the EDPS sent his opinion, which was forwarded to the complainant for observations. On 15 October 2008, the complainant submitted his observations.

THE OMBUDSMAN'S ANALYSIS AND CONCLUSIONS

Preliminary remarks

7. In his opinion, the EDPS considered that the complainant's first allegation was unfounded. In this context, he drew attention to the content of a letter that he had sent to the complainant on 28 July 2008. The examination of this allegation and of the content of the EDPS' aforementioned letter is discussed further below.

8. With regard to the complainant's second and third allegations, the EDPS referred to the fact that, following the opening of the present inquiry, he had sent the aforementioned letter of 28 July 2008 to the complainant. As for the third allegation, the EDPS stated that "[t]his allegation is essentially correct, and I would like to express my deep regrets and sincere apologies for these unacceptable failures. Appropriate measures have been taken to prevent any such events from happening again."

9. In his observations regarding the second and the third allegations, the complainant took note of the fact that the EDPS had eventually sent him a reply and made an appropriate apology. He stated that he accepted the apology and informed the Ombudsman that he had, in the meantime, obtained appropriate access to the relevant documents and information.

10. In light of the above, the Ombudsman concludes that it is unnecessary to further examine the second and third allegations taken up for inquiry in the present case, as well as the related claim.

11. With regard to the first allegation, the complainant stated in his observations that, in light of the above developments, he was now specifically and primarily interested in issues relating to a Commission practice which had been examined by the EDPS. Under this practice, the Commission only provides sensitive medical data to a doctor selected by the staff member concerned. The practice was adopted on the basis of Article 26a of the Staff Regulations, which stipulates that access to the medical file is to be granted "in accordance with arrangements to be laid down by the institutions". Conclusion 221/04, adopted by the College of Heads of Administration on 19 February 2004, lays down these arrangements. As regards reports drawn up by a psychiatrist or a psychologist, this text provides that access is to be granted to the official concerned through the intermediary of a doctor designated by him or her. This rule that is intended to best serve the interests of the official concerned.

12. The complainant has expressed doubts as to the legality of the above-mentioned 'indirect' access. In this respect, the Ombudsman wishes to point out that he has already found the above-mentioned practice to be reasonable[2]. Where an official is considered to suffer from psychological problems, it may indeed be in his or her best interest if any report or documents containing conclusion that are relevant in this respect were first looked at by his or her own doctor. There is, therefore, nothing to suggest that the arrangement laid down in conclusion 221/04 would be incompatible with Article 26a of the Staff Regulations. This is furthermore supported by relevant case-law of the Community courts[3].

13. Accordingly, the Ombudsman does not consider it necessary or justified to examine the above-mentioned issue raised by the complainant.

A. The allegation concerning the request for access to documents held by the EDPS

Preliminary remarks

14. In the following paragraphs, the Ombudsman examines whether the EDPS' decision of 30 October 2006, refusing the complainant access to documents ('the disputed decision'), was compliant with the relevant rules. Specifically, the Ombudsman examines whether the EDPS gave valid and adequate grounds for refusing access to documents.

15. With regard to the legal basis and principles, the EDPS first informed the complainant that his request appeared to be one for public access to documents under Regulation 1049/2001. He drew attention to certain pertinent differences between the access rights under this regulation and Regulation 45/2001 regarding personal data protection[4], the latter equally providing for a right of access for data subjects. The EDPS informed the complainant that "I have decided to deal with your request in a way most favourable to your position". He responded to the access request by invoking provisions in both of the above-mentioned regulations.

16. The EDPS further informed the complainant that he had dealt with his request using three categories: (a) "documents exchanged between yourself and my office"; (b) "documents exchanged between my office and PMO"; and (c) "documents for internal use within my office". The EDPS decided not to grant access to the documents in category (a), noting that the complainant was already in possession of these documents. For category (b) and (c), he refused access on the grounds examined further below.

17. The complainant has not specifically challenged the EDPS' decision to handle his access request in the way described above. The Ombudsman considers that the manner in which the EDPS dealt with the complainant's access request was appropriate.

The arguments presented by the parties

18. The complainant essentially argued that the EDPS' refusal to grant access to the case files here concerned (Case 2006-0120 and Case 2005-0015, based on complaints the complainant submitted) was not supported by valid and adequate grounds. Specifically, he put forward that the EDPS (a) relied on a provision of Regulation 45/2001 which was irrelevant in this case and (b) did not respect the standards for justifying a refusal of access under Regulation 1049/2001 regarding public access to documents.

19. In his observations, the EDPS essentially maintained that his refusal to grant access was justified and adequately reasoned.

20. The relevant specific and detailed facts and arguments are set out under the 'Ombudsman's assessment' below.

The Ombudsman's assessment

The standards applicable to Regulation 1049/2001

21. As noted above, the EDPS invoked provisions in Regulation 1049/2001 in order to reject parts of the complainant's access request. The Ombudsman welcomes the fact that the EDPS applied Regulation 1049/2001, considering that the decision setting up his office does not expressly stipulate that this regulation is binding upon it[5]. However, the Ombudsman emphasises that once an institution or body applies Regulation 1049/2001, it must act consistently with that decision by fully respecting the relevant applicable rules. These include, in particular, the following.

22. The examination required for the purpose of processing a request for access to documents must be specific in nature. First, the mere fact that a document concerns an interest protected by an exception cannot justify the application of that exception in itself. Such application may, in principle, be justified only if the institution has previously assessed, first, whether access to the document would specifically and actually undermine the protected interest and, second, in the circumstances referred to in Article 4(2) and (3) of Regulation 1049/2001, whether there was no overriding public interest in disclosure. The risk of a protected interest being undermined must also be reasonably foreseeable and not purely hypothetical. Consequently, the examination which an institution must undertake in order to apply an exception must be carried out in a concrete manner and must be apparent from the reasons given for the decision[6]. An assessment of documents based on categories of documents rather than the actual information contained in those documents is, in principle, insufficient. This is because an institution's examination must enable it to assess specifically whether or not an exception invoked actually applies to all the information contained in those documents[7]. Similarly, the statement of reasons required by Article 253 EC must enable the persons concerned to evaluate the propriety of the reasons for the decision and, in case of a relevant complaint to the Ombudsman, enable him to exercise his power of review[8].

23. In the present case, the EDPS invoked the following exceptions in Regulation 1049/2001 (underlining added).

"Case 2006-0120

[...]

b. documents exchanged between my office and PMO

These documents are relevant for the investigation of your complaint. As to the first part of your complaint, some elements have been received under strict confidentiality. As to the second part of your complaint, the investigation is still ongoing. Most of these elements have been excluded from access, because they are covered either by Article 4(2) of Regulation 1049/2001 or the confidentiality which is inherent in the role of the EDPS further to Article 20(4) of Regulation 45/2001[9]. This obligation is expressed in Article 45 of Regulation 45/2001. Disclosing them would undermine the supervisory task of the EDPS ...

All other documents or relevant parts are attached and have been listed in annex A. In some cases you have had access to certain documents before. In such cases they have not been attached again.

c. documents for internal use within my office

These documents are excluded from access, because they are covered by Article 4(3) second paragraph of Regulation 1049/2001 or Article 45 of Regulation 45/2001. This relates to documents containing opinions for internal use as part of deliberations and preliminary consultations within the institution. Disclosing them, either now or at a later stage, would seriously undermine the decision making process. However, please note that relevant elements have been included in the final versions of documents sent to you earlier or made available now.

Case 2005-0015

As to our case file on your complaint of 26 January 2005, we have distinguished two categories of documents:

[...]

b. documents for internal use within my office

These documents are excluded for similar reasons as mentioned above. However, please note again that relevant elements have been included in the final versions of documents sent to you earlier." (Emphasis added.)

24. The above-cited invocation of the stated exceptions in Regulation 1049/2001 does not comply with the relevant standards referred to in paragraph 22 above, and is, therefore, insufficient. It merely contains references to the stated exceptions, and hence provides no properly reviewable grounds. A reply that merely states a (possibly valid) exception without providing further reasons or grounds is only permissible in cases where it is impossible to give reasons without disclosing the content of a document, and thereby depriving the exception of its very purpose[10]. However, if an institution claims that it is impossible to disclose the content of a document, it must at least briefly explain this in its decision refusing access.

The invocation of Articles 20(4) and 45 of Regulation 45/2001

25. The EDPS's above-cited statement referred to "... the confidentiality which is inherent in the role of the EDPS further to Article 20(4) of Regulation 45/2001." This provision relates to Article 20(1) of the said Regulation, which allows the data processor to restrict certain data protection rights (such as access rights), if one or more listed interests are at stake. Article 20(4) provides that:

"If a restriction provided for by paragraph 1 is relied upon to deny access to the data subject, the European Data Protection Supervisor shall, when investigating the complaint, only inform him or her of whether the data have been processed correctly and, if not, whether any necessary corrections have been made."

26. In the present case, the EDPS appears to have invoked this provision because he considered that the Commission had actually refused the complainant access to a draft medical report written by a Dr. H. (concerning the complainant's medical condition) in order to protect the complainant, and hence implicitly under Article 20(1) referred to above[11]. This, however, does not appear to be fully consistent with the relevant facts and correspondence. In a relevant letter of 2 June 2006 to the EDPS (reference PMO.3/LP/ls D(2006) 13484), relating to the complainant's complaint against the Commission, the latter merely referred to the draft nature of the above-mentioned medical report in order to explain why that report was not given to the complainant. It made no express or implied reference to the relevant exceptions in Article 20(1) of Regulation 45/2001. The Ombudsman points out that he, like the EDPS, has dealt with complaints from the complainant against the Commission concerning the allegedly inadequate access to the medical file here concerned[12]. The Commission's relevant replies or opinions in the framework of this inquiry do not suggest that the complainant was at any point denied access to the draft medical report by Dr. H., specifically or implicitly on the basis of Article 20(1) of Regulation 45/2001.

27. In light of the above, the EDPS decision of 30 October 2006 cannot be considered to have adequately explained why and how the perceived confidentiality obligation in Article 20(4) of Regulation 45/2001 was relevant to deny access to the document requested from the EDPS. It is true that the Commission's PMO (Office for administration and payment of individual entitlements) in the above-mentioned letter also informed the EDPS of a standard practice that could reasonably be understood to constitute an intended application of Article 20(1) of Regulation 45/2001, namely, the practice of sending the final version of medical reports containing sensitive data to a doctor of the concerned staff member's choice. If the Commission considered that Article 20(1) applied to Dr. H.'s final medical report, it would presumably consider that it also applied to the draft version, with the consequence that the perceived confidentiality obligation in Article 20(4) could be considered applicable. However, as indicated above, such an argument would have to be explained in specific terms in the relevant decision refusing access on the basis of that confidentiality obligation.

28. A second aspect of the EDPS' decision requiring examination concerns the adequacy of the information on the scope of the obligation understood to be implied in Article 20(4) of Regulation 45/2001.

29. The relevant part of the disputed decision of 30 October 2006 was set out under the broad heading "documents exchanged between yourself and my office", and stated that "[m]ost of these elements have been excluded from access ..." These statements did not contain any precise information on what documents the EDPS considered (or considers generally) to be covered by the above-mentioned provision. Importantly, it is not clear whether the EDPS understood that provision to cover exclusively documents specifically containing the data supposedly covered by Article 20(1) of Regulation 45/2001. It is also unclear whether the EDPS considered the provision to cover all documents - such as his correspondence with the Commission concerning the complainant's complaint against it - which simply related to the (supposed) application of Article 20(1) of Regulation 45/2001. In his opinion on the present complaint, the EDPS provided more information on this issue and referred to his enclosed letter of 28 July 2008 to the complainant. This letter stated that "Article 20(4) allows the EDPS to investigate the case without having to share any part of the relevant information at stake with the data subject". However, this statement does not clarify the scope of the confidentiality obligation invoked by the EDPS, given the obvious lack of specificity in the formulation "the relevant information at stake". In light of the foregoing, the Ombudsman finds that the EDPS also failed in this respect to provide sufficiently specific reasons in his response to the complainant's request for access to documents.

30. Finally, the disputed decision referred to Article 45 of Regulation 45/2001, which lays down the general professional secrecy obligations of the EDPS[13]. The invocation of this provision must equally be considered insufficient, given that it was not supported by any concrete and specific explanations.

31. In light of the facts and findings in paragraphs 21 - 30, the disputed decision here concerned cannot be considered to have been compliant with the relevant rules. In fact, the content of the disputed decision suggests that, at the time of handling the complainant's request, the EDPS does not seem to have adopted and to have had in place a clear and structured approach to the handling of document requests. As a result of this, and taking into account the information and comments provided by the complainant in his observations referred to further above, the Ombudsman considers that the most appropriate response is to close the case with a further remark.

C. Conclusions

In light of the above findings, the Ombudsman considers that no further inquiries are necessary.

The Ombudsman nevertheless considers it appropriate to make the further remark below. The EDPS will be invited, in accordance with the Ombudsman's standard procedures, to respond to that remark within six months.

The complainant and the EDPS will be informed of this decision.

FURTHER REMARK

The Ombudsman wishes to point out that the requirement to support refusals of access to documents with concrete and specific reasons is not merely aimed at guaranteeing a better understanding of the decision by the person being refused access. Such reasoning is also essential for the relevant reviewing bodies, which may be called upon to assess the case. In this respect, the Ombudsman would like to draw attention to the fact that he only opens full inquiries once he has examined whether there are grounds for doing so. This examination is carried out following prior administrative approaches made by the complainant to the institution or body concerned[14] and, as a result, takes into account the reply to the dispute already provided by the institution or body concerned. In cases involving refusals of access to documents, a lack of sufficiently concrete and specific reasons in the disputed decision will normally result in the opening of an inquiry.

 

P. Nikiforos DIAMANDOUROS

Done in Strasbourg on 15 December 2009

---

[1] Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents, OJ L 145, p. 43.

[2] The Ombudsman made the finding in a decision which, for reasons of confidentiality, has not been published.

[3] See, for example, the Judgment of 13 December 2006 of the Civil Service Tribunal in Case F-17/05 Sequeira Carvalho v Commission, paragraphs 67-68 and 109.

[4] Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, OJ L 8, p. 1.

[5] Decision No 1247/2002/EC of the European Parliament, of the Council and of the Commission of 1 July 2002 on the regulations and general conditions governing the performance of the European Data-protection Supervisor's duties, OJ 2002 L 183, p. 1. It may be noted, however, that the fifth recital of the decision encourages the EDPS to apply Regulation 1049/2001.

[6] See Case T-36/04 API v Commission, Judgment of 12 September 2007, not yet published in the ECR, paragraph 54 (and the cases cited therein). The general nature of the statement of reasons on which a refusal of access is based, as well as its brevity or its formulaic character, can be indicative of failure to carry out a concrete examination only where it is objectively possible to give the reasons justifying the refusal of access to each document, without disclosing the content of the document or an essential aspect of it and thereby depriving the exception of its very purpose. See also paragraph 67 of the aforementioned case.

[7] See Case T-36/04 cited above, paragraph 56.

[8] See Joined Cases T-110/03, T-150/03 and T-405/03 Sison v Council [2005] ECR II-01429, paragraph 59.

[9] The invocation of provisions contained in Regulation 45/2001 is examined further below.

[10] See Sison v Council cited above, paragraph 60.

[11] "Article 20, 'Exemptions and restrictions', 1. The Community institutions and bodies may restrict the application of Article 4(1), Article 11, Article 12(1), Articles 13 to 17 and Article 37(1) where such restriction constitutes a necessary measure to safeguard: ... (c) the protection of the data subject or of the rights and freedoms of others;"

[12] The main case in this respect is complaint 723/2006/(WP)PB.

[13] "The European Data Protection Supervisor and his or her staff shall, both during and after their term of office, be subject to a duty of professional secrecy with regard to any confidential information which has come to their knowledge in the course of the performance of their official duties."

[14] See Article 2(4) of the Ombudsman's Statute.