The background to the complaint

1. The complainant is a former member of the contract staff of the European Centre for Disease Prevention and Control (the 'ECDC') located in Stockholm, Sweden. He asked the ECDC whether Mr X's name was included in the reserve list of a selection procedure organised by that agency. The complainant considered that the inclusion of Mr X's name on the reserve list could demonstrate that there had been irregular recruitment. He expressed the wish that an external body review the ECDC's practices. The ECDC replied that the names of the candidates on the reserve list constitute confidential information and thus cannot be communicated.

2. On 29 January 2012, the complainant turned to the European Ombudsman.

The subject matter of the inquiry

3. In his complaint, the complainant alleged that the ECDC failed properly to handle his request for public access to the selection procedure's reserve list.

4. The complainant claimed that the ECDC should apologise to him for the above failure and grant him access to the requested document or, alternatively, properly justify its refusal.

The inquiry

5. On 7 March 2012, the Ombudsman forwarded the complaint to the ECDC for an opinion. The opinion was subsequently forwarded to the complainant with an invitation to submit observations. After careful consideration of the ECDC's opinion and of the complainant's observations thereon, the Ombudsman made a draft recommendation on 22 January 2013, in accordance with Article 3(6) of the Ombudsman's Statute. On 27 May 2013, the Ombudsman received the ECDC's reply, which was forwarded to the complainant with an invitation to make observations. The complainant submitted his observations on 9 June 2013.

The Ombudsman's analysis and conclusions

A. Alleged failure properly to handle a request for public access to a document and related claim

The draft recommendation[1]

6. The Ombudsman's draft recommendation to the ECDC reads as follows:

"[t]he ECDC should properly reply to the complainant's request for access to the selection procedure's reserve list, in accordance with the applicable legislation and the case-law of the CJEU, and either give access to that document or properly justify why it cannot do so.

When so doing, in addition to the information which the complainant already provided in support of his request, the ECDC should take account of the additional information provided by the complainant in his observations, which the Ombudsman shall transmit to the ECDC for that purpose."

7. For the purposes of his draft recommendation, the Ombudsman made two final remarks to the ECDC. First, the Ombudsman found it useful to refer the ECDC to the European Data Protection Supervisor's (the 'EDPS') position paper of 24 March 2011 on "Public access to documents containing personal data after the Bavarian Lager ruling", which sets out the EDPS's views on the consequences of the above ruling for the processing of personal data by the EU institutions[2]. Second, the Ombudsman pointed out that the European Personnel Selection Office ('EPSO') publishes the reserve lists resulting from its competitions both on its website and in the Official Journal of the European Union. These lists contain the full names of the successful candidates. EPSO omits such candidates' names from the reserve lists resulting from its open competitions only when it is requested to do so[3].

The arguments presented to the Ombudsman after the draft recommendation

8. In its reply, while referring to the complainant's repeated requests for information in respect of Mr X, the ECDC acknowledged having failed to treat the complainant's e-mail of 20 December 2011 as an initial application for public access to a document and to explain which remedies were available to him when replying to his confirmatory application of 21 January 2012, in accordance with Regulation 1049/2001. It nevertheless emphasised that the complainant was aware of those remedies, since he submitted a complaint to the Ombudsman.

9. The ECDC also took note of the fact that the complainant sought information in respect of only one individual. It took the view that contacting all the successful candidates included in the selection procedure's reserve list with an eye to obtaining their agreement to the disclosure of their names was therefore disproportionate.

10. According to the ECDC, the present case poses a significant problem in respect of the application of Case C-28/08 P Commission v Bavarian Lager[4]. If the ECDC were to approach Mr X to obtain his consent to disclose his personal data, in accordance with Article 8(b) of Regulation 45/2001[5], then it could be assumed that Mr X was indeed the data subject and that, by definition, his name appeared on the reserve list. If, on the contrary, Mr X's name was not on the list, then he would not be the data subject and no personal data would exist. In such a case, it would not make any sense to ask him about non-existent data. Having regard to the EDPS's position paper of 24 March 2011 on "Public access to documents containing personal data after the Bavarian Lager ruling"[6], the consent, or otherwise, of the data subject is not the only factor to be taken into account when assessing whether an individual's interests might be prejudiced. Hence, the ECDC took account of Article 6 TEU when deciding not to disclose to the complainant information on whether or not it had approached Mr X.

11. The ECDC therefore took the view that it considered the requirements set out in Article 8(b) of Regulation 45/2001 when "[m]aking a decision on whether to disclose or not". It took into account the complainant's statement that Mr X was not entitled to be on the reserve list and that he needed the information requested in order to pursue an external legal review of the issue whether irregularities had taken place within the ECDC. When balancing the various interests at stake, the ECDC found that the complainant failed to provide convincing arguments demonstrating the necessity for the personal data to be transferred. This was because the complainant's suspicions were already known to the ECDC and were transmitted by it to the European Anti-Fraud Office ('OLAF') (which dismissed the case). The ECDC further considered that it "was unable to demonstrate to the complainant that it has weighted up the interests of the parties as it had been unable to explicitly identify any approach to the potential data subject as to do so would mean providing the information sought by the complainant and effectively circumventing the provisions of the data protection legislation. As such... it was impossible to prove to the complainant that it had weighed up the respective interests without disregarding the rights of the individual about whom the data was sought. It is however, accepted that the response to the complainant was, by necessity, not as comprehensive as it could have been if a general proactive approach to informing data subjects on reserve lists had been taken and the Centre will accordingly be seeking to apply this approach in subsequent recruitment procedures to avoid the issue in the future." The ECDC emphasised that, in the meantime, it completed its previous reply confirming its decisions rejecting the complainant's request by means of a letter sent to him on 30 May 2013[7].

12. Finally, the ECDC informed the Ombudsman that it has in place an internal procedure on public access to its documents[8]. Reference to this internal procedure is made during the compulsory Professional Ethics training for staff. The ECDC stated that it intends to review the above procedure. Moreover, it will issue instructions to staff in respect of the handling of requests for access to documents and the need to adopt a proactive approach in relation to the personal data contained in reserve lists. The ECDC emphasised that it is a relatively young agency. It thanked the Ombudsman for assisting it in identifying specific areas for improvement.

13. In his observations, among other things, the complainant took the view that all the requirements of Article 8(b) of Regulation 45/2001 were fulfilled and that, therefore, the ECDC did not need to approach Mr X to obtain his consent. He also noted that although the ECDC apologised to him in January 2012 for failing to reply to his initial application for access to documents, it did not offer any apologies for the other instances of maladministration he considered it to have committed.

The Ombudsman's assessment after the draft recommendation

14. According to Case C-28/08 P Commission v Bavarian Lager, "[w]here a request based on Regulation No 1049/2001 seeks to obtain access to documents including personal data, the provisions of Regulation No 45/2001 become applicable in their entirety, including Articles 8 and 18 thereof."

15. Article 8 of Regulation 45/2001 provides that "[p]ersonal data shall only be transferred to recipients...

(a) if the recipient establishes that the data are necessary for the performance of a task carried out in the public interest or subject to the exercise of public authority, or

(b) if the recipient establishes the necessity of having the data transferred and if there is no reason to assume that the data subject's legitimate interests might be prejudiced."

According to Article 18 of the same regulation, "[t]he data subject shall have the right:

(a) to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her, except in cases covered by Article 5(b), (c) and (d) [that is, when (Article 5(b)) processing is necessary for compliance with a legal obligation to which the controller is subject, or (Article 5(c)) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, or (Article 5(d)) the data subject has unambiguously given his or her consent]. Where there is a justified objection, the processing in question may no longer involve those data;

(b) to be informed before personal data are disclosed for the first time to third parties or before they are used on their behalf for the purposes of direct marketing, and to be expressly offered the right to object free of charge to such disclosure or use."

16. As rightly pointed out by the ECDC, the complainant requested access to the reserve list in order to establish whether or not Mr X's name was on that list. Logically, it would have been sufficient for the ECDC simply to confirm or deny the inclusion of Mr X's name on that list in order to reply to the complainant's query, but it did not do so. It also did not demonstrate why it was necessary not to reveal whether or not Mr X's name was on the list. In this respect, the Ombudsman again emphasises that EPSO, for example, publishes reserve lists containing the names of successful candidates and that it does not do so only when candidates specifically request it not to publish their names.

17. The ECDC thus refused to provide the complainant with a straightforward reply to his query and, instead, denied him access to the reserve list as a whole. It argued that the personal data contained therein was confidential information. Consequently, the ECDC treated the successful candidates whose names were on that list as data subjects.

18. Once the ECDC adopted such an approach, Regulation 1049/2001, together with the relevant case-law of the CJEU, became applicable. In light of Case C-28/08 P Commission v Bavarian Lager, in order to justify its refusal to grant access to the personal data contained in the entire reserve list, the ECDC should have applied the provisions of Articles 8 and 18 of Regulation 45/2001 to the successful candidates whose names appeared on the list. Should the successful candidates not have consented to the disclosure of their names, the ECDC would have had to balance the different interests at stake.

19. While the ECDC appears to have carried out such an exercise in respect of the complainant (though only after the Ombudsman intervened)[9], it failed to do so in respect of the data subjects because it simply did not ask them to give their view. While the ECDC argued in its opinion that it strived to protect the privacy of the successful candidates whose names appeared on the reserve list, it did not explain clearly, either directly to the complainant or in the context of the present inquiry, how disclosing the reserve list would result in the data subjects' legitimate interests being prejudiced[10]. Furthermore, it did not clearly demonstrate why complying with this legal obligation was disproportionate.

20. However, in the Ombudsman's view, this failure does not have major consequences. This is because, first, the ECDC introduced appropriate measures to remedy it, namely a review of its internal procedure on access to documents, which is referred to in its Professional Ethics training programme. The Ombudsman trusts that this should be sufficient to avoid similar problems from occurring in the future. Second, the ECDC informed OLAF of the complainant's allegations of irregularities so that it could investigate them. OLAF then decided "[t]o dismiss the case due to the weakness of sufficient suspicious irregularities"[11]. It follows from the above that a body external to the ECDC, which could have requested all the necessary information and/or investigated the matter in order to confirm the irregularities alleged by the complainant (whose suspicions justified his request for public access to the reserve list), has already looked into the matter. Consequently, the goal which the complainant sought to pursue when requesting access to the reserve list has already been achieved in practice[12] and the necessity of having the personal data in question transferred to him no longer subsists. In the circumstances, no further inquiries by the Ombudsman into the ECDC's handling of the complainant's request for access to documents are justified.

21. Notwithstanding the above conclusion, the Ombudsman would appreciate if the ECDC were to inform her about the measures introduced in order to improve its handling of requests for public access to its documents. She will make a further remark in this respect below.

B. Conclusions

On the basis of the inquiry into this complaint, the Ombudsman closes it with the following conclusion:

No further inquiries are justified.

The complainant and the Director of the ECDC will be informed of this decision.

Further remark

The Ombudsman would appreciate if the ECDC were to inform her about the measures introduced in order to improve its handing of requests for public access to its documents.

When replying, the ECDC should take account of

(i) the remarks which the complainant made in his observations on the ECDC's reply to the Ombudsman's draft recommendation[13], which the Ombudsman shall transmit to the ECDC; and

(ii) the fact that EPSO publishes reserve lists containing the full names of the successful candidates and that it only omits such names when specifically requested to do so by the successful candidates.

The Ombudsman will decide on the need to open an own-initiative inquiry into these matters after analysing the ECDC's reply to her further remark. She notes and appreciates the ECDC's willingness to receive assistance for identifying areas for improvement.

 

Emily O'Reilly

Done in Strasbourg on 3 March 2014

---

[1] The full text of the draft recommendation may be consulted at: http://www.ombudsman.europa.eu/cases/draftrecommendation.faces/en/48926/html.bookmark

[2] Available at: www.edps.europa.eu

[3] In such cases, EPSO includes a footnote in the reserve list in question which states that: "[a] successful candidate may explicitly request his/her name not be published."

[4] Case C-28/08 P Commission v Bavarian Lager [2010] ECR I-6055.

[5] Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, OJ 2001 L 8, p. 1.

[6] The ECDC drew attention to a passage in p. 14 of the EDPS’s position paper on "Public access to documents containing personal data after the Bavarian Lager ruling" which reads as follows: "consent of the data subject is not required, the data subject can be asked to present his or her views."

[7] The ECDC enclosed a copy of the letter with its reply to the Ombudsman's draft recommendation.

[8] The ECDC enclosed a copy of the internal procedure with its reply to the Ombudsman's draft recommendation.

[9] According to the ECDC's letter of 30 May 2013 to the complainant, which the Agency enclosed with its reply: "in accordance with the Bavarian Lager case law, the request was dealt with under Article 8(b) of Regulation 45/2001/EC which states that: 'personal data shall only be transferred to recipients subject to the national law adopted for the implementation of Directive 95/46/EC... if the recipient establishes the necessity of having the data transferred and if there is no reason to assume that the data subject's legitimate interests might be prejudiced... '

Having reviewed the explanations provided... it is clear that your request was based upon a strong presumption that the data subject had 'unlawfully benefitted' from the EU budget. This presumption persisted even after as a staff member, you had reported these allegations both to your line manager and to your Director and neither had seen a basis for them. Even at the time of submitting your Observations in July 2012 [on the ECDC's opinion to the Ombudsman] you were aware that OLAF, the European Anti-Fraud Office, which had been approached by the Director to examine your allegations, had completed their investigations in June 2012 and decided 'to dismiss the case due to the weakness of suspicious irregularities' yet it appears that your presumptions persisted.

[… A]s such you were aware of bodies - such as OLAF - which were specifically mandated to investigate matters of alleged illegality and irregularity in relation to the EU budget and afforded wide ranging powers of investigation and that you had a right to report your concerns to them. Therefore, the decision not to transfer the document/information requested was based upon consideration of your stated rationale for requesting the document/information and whether, based on the evidence, the necessity of having the data transferred had been established. Having re-examined the facts, I am of the opinion that the decision not to release the requested document/information based upon your failure to establish the necessity of the transfer was well considered and fair as other options were clearly open to you to resolve any suspicions of misfeasance which did not necessitate the disclosure of personal data...."

[10] According to the EDPS's position paper of 24 March 2011 on "Public access to documents containing personal data after the Bavarian Lager ruling, "[u]nder Article 8(b), the following steps should be taken:

- the recipient should establish the necessity of having the data transferred, unless the reason for disclosing the data is manifest;

- the institution must balance the different interests at stake;

- the institution must consider whether there is any reason to assume that the data subject's legitimate interests might be prejudiced (consent of the data subject is not required, the data subject can be asked to present his or her views)..."

[11] OLAF made that statement in its letter to the ECDC of 21 May 2012, which was enclosed with the ECDC's reply to the Ombudsman's draft recommendation and which was forwarded to the complainant for his observations.

[12] In his initial request for access of 20 December 2011, the complainant stated as follows: "[I] am asking for this document because a person may be on that list (namely Mr [X]) who, in light of his having benefited, materially and otherwise, in the past from possible irregularity at ECDC, is not entitled to be on that list. Confirmation of his presence will allow me to consider pursuing a legal review of this new possible irregularity with instances external to ECDC". Similarly, in his observations on the ECDC's opinion, the complainant stated that: "[a]ccess to the reserve list would enable the complainant to verify whether that person (Mr [X]) has been placed thereon, and in such case pursue, with competent authorities, further examination of the possible maladministration of this inclusion... [The] employment history [of Mr X] appears to have brought him unlawful benefits to the detriment of the ECDC budget... [T] he complainant was justifiably concerned that Mr [X] may have... been unlawfully included in its reserve list. These concerns - known to ECDC in their detail - in any case justified the complainant's request for access to said reserve list" (emphasis added).

[13] Points 27 - 29 of the complainant's observations.