(made in accordance with Art. 3 (7) of the Statute of the European Ombudsman[1])

The complaint

The complainant, Mr R., is Director of the Bavarian Lager Company Ltd., which imports German beer into the United Kingdom.  He found difficulty in selling his product because of exclusive purchasing agreements, which require many pubs in the UK to obtain their supplies of beer from particular UK breweries.  These agreements are regulated by a United Kingdom law, known as the "Guest Beer Provision", which allows pubs also to buy certain beers from other suppliers.

The complainant considered that the Guest Beer Provision infringes Article 30 (now Article 28) of the EC Treaty by discriminating against imported beers.  In April 1993, he complained about the matter to the European Commission.  The Commission registered the complaint as P/93/4490/UK and began an investigation under Article 169 (now Article 226) of the EC Treaty.

In August 1996, the complainant learnt from a press release issued by the UK Department of Trade and Industry that a tripartite meeting was to take place in October 1996 between the Commission, the UK authorities and a trade association, the Confédération des Brasseurs du Marché commun (CBMC), to discuss the Guest Beer Provision.  He asked the Commission to allow him to attend the meeting, but his request was refused.

At the beginning of March 1997, the UK authorities proposed an amendment to the Guest Beer Provision.  The Commission considered the proposed amendment to be satisfactory and dropped its Article 169 investigation.

In May 1998, the complainant applied under Commission Decision 94/90 on public access to documents, for access to any submissions made under file reference P/93/4490/UK by eleven named companies and organisations and by three defined categories of person or company.  The Commission refused the request and a confirmatory application.  On 8 July 1998, Mr R. complained to the Ombudsman against this refusal.

In February 1999, during the Ombudsman's inquiry, the complainant made clear that his real concern is to obtain information.  He wants to know who made submissions to the Commission during its Article 169 investigation into the Guest Beer Provision and which representatives of the CBMC attended the tripartite meeting in October 1996.  The complainant attempted to obtain the latter information directly from the CBMC, which advised him that he must seek the answer from the Commission since the relevant personnel had left the organisation and the files had been destroyed.

Mr R. wants this information because he suspects improper behaviour by certain persons who, at relevant times, were amongst the UK officials and politicians responsible for the brewing industry.

In accordance with normal procedure, the Ombudsman has kept the complainant informed, in writing of the progress of the inquiry.

The inquiry

The Ombudsman's inquiry originally focussed on the question of rights of access to documents under Commission Decision 94/90.  However, when it became clear that the complainant's real objective is to obtain information, the Ombudsman considered that it was appropriate to propose a friendly solution.  He therefore wrote to the Commission on 3 March 1999 in accordance with Article 3 (5) of the Statute of the Ombudsman, proposing that the Commission provide the information which the complainant wants.

The Commission's reply

In its reply dated 7 June 1999, the Commission considered that the Data Protection Directive[2] prevents it from disclosing the identities of the persons concerned without their express permission.  The Commission indicated its willingness to seek an ad hoc solution to the complaint by asking the persons concerned to allow it to supply their names to the complainant.  The Commission also stated that it would inform the Ombudsman of their replies and communicate their names where authorised to do so.

The Ombudsman's response

On 30 July 1999, the Ombudsman wrote to the Commission.  He stated that he did not accept that the Data Protection Directive could prevent the Commission from providing the information in question without seeking the consent of the persons concerned. However, in view of the ad hoc solution proposed by the Commission, it still appeared possible to achieve a friendly solution.  The Ombudsman therefore asked the Commission to inform him by 30 September 1999 of the number of persons from whom the Commission had asked consent to communicate their names, and the number of positive and negative replies received.

In October and November 1999, the Commission informed the Ombudsman that it had written to the persons concerned requesting approval to disclose their identities to the complainant, that 45 letters were sent in total and that 20 replies had been received, of which 14 were positive and 6 negative.  The Commission also supplied the names and addresses of those persons who had replied positively.

The Commission's response was forwarded to the complainant, whose observations made clear that the incomplete information supplied by the Commission does not satisfy him. The Ombudsman therefore informed the Commission in December 1999 that a friendly solution to the complaint is not possible.  He also asked the Commission to provide an explanation of its legal stand that the Data Protection Directive prevents it from disclosing the identities of the persons concerned without their express permission, including precise reference to the provisions of the Directive which the Commission considers to impose a legal obligation of secrecy in this case.

In January 2000, the Commission replied as follows:

"By virtue of Article 286 of the EC Treaty, Directive 95/46/EC applies to the Commission as well.

As regards the interpretation of this Directive, it should be recalled that by virtue of Article 2 thereof the data requested by Mr R. are personal data within the meaning of the Directive.  Communicating these data to Mr R. constitutes processing of personal data within the meaning of the Directive.

By virtue of Article 7 of the Directive, the processing of personal data is only allowed if it is covered by one of the six options listed under this provision. Therefore, disclosure to Mr R. of the names concerned is only allowed if one of the options under Article 7 applies. In the view of the Commission, the processing of personal data in this case is only permissible under Article 7(a). The other options of this provision do not apply in the case of Mr R.. Therefore, it is required that the data subject "unambiguously gives his or her consent". If he or she refuses to give his or her consent the personal data cannot be processed." (footnote reference omitted)

The Ombudsman's draft recommendation

On 17 May 2000, the Ombudsman addressed the following draft recommendation to the Commission, in accordance with Article 3 (6) of the Statute of the European Ombudsman:

"The Commission should inform the complainant of the names of the delegates of the Confédération des brasseurs du marché commun who attended a meeting organised by the Commission on 11 October 1996 and of companies and persons in the 14 categories identified in the complainant's original request for access to documents who made submissions to the Commission under file reference P/93/4490/YK."[3]

The European Ombudsman gave reasons for the draft recommendation as follows:

1   The obligation to provide information

1.1       The complainant requested the Commission to inform him of the names of those persons who made submissions in relation to his complaint against the UK Guest Beer provision and of the representatives of a trade association (the Confédération des brasseurs du marché commun) who attended a meeting organised by the Commission in the context of its investigation of the complainant's allegation of a possible infringement of Community law by a Member State.

1.2       The principles of good administrative behaviour require that an official who has responsibility for the matter concerned shall supply members of the public with the information that they request.[4]  The complainant should therefore be supplied with the names he has requested unless the Commission has a legal obligation to keep this information confidential.

1.3       The only legal basis for such an obligation to which the Commission has referred is the Data Protection Directive.[5]  The Commission considers that the Directive prevents it from supplying to the complainant the names of the persons concerned without first obtaining their consent.  This claim is evaluated in the next section.

2   The Data Protection Directive

2.1      Article 286 of the EC Treaty provides that Community acts on the protection of individuals with regard to the processing of personal data and the free movement of such data shall apply to the institutions and bodies set up by, or on the basis of, the Treaty. Accordingly, the Data Protection Directive[6] applies to the Community institutions and bodies, including the Commission.[7]

2.2      The Directive establishes certain principles which are to be implemented by detailed legislation in the Member States.  In considering the application of the Directive to the Commission, it should be recalled that no detailed implementing legislation binding on Community institutions and bodies yet exists.

2.3      At the level of principle, the Ombudsman notes that Article 1 of the Directive defines its object as being to ensure protection of "the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data". 

2.4      Information supplied to an administrative authority by a person who participates in an administrative procedure does not seem to be "personal data" relating to that person merely by reason of the fact that he or she has supplied it.  The contrary view would imply that there exists a fundamental right to supply information to an administrative authority in secret, which is not the case.

2.5      Moreover, in interpreting and applying the Directive, it is important also to take account of the principle that decisions should be taken as openly as possible.  This principle is affirmed by the Declaration on the right of access to information attached to the final act of the Maastricht Treaty[8], by the case-law of the Community Courts[9] and by Article 1[10] of the Treaty on European Union.

2.6      Article 7[11] of the Directive provides for six categories of processing (which includes transmission) of personal data to be permissible.  Three of these categories appear to be applicable to public disclosure by the Commission of information submitted to it concerning the exercise of one of its functions.  Such disclosure could be considered to be necessary for:

- compliance with a legal obligation, since the Treaty on European Union establishes that openness is an obligation of the European institutions;

- the performance of a task carried out in the public interest or in the exercise of official authority, since making information public is a normal part of the performance of a task carried out in the exercise of official authority;

-  for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, since granting and receiving access to official information are legitimate interests pursued by the controller and by third parties respectively.

2.7      For the reasons given above, the Ombudsman is of the view that the right to privacy with respect to the processing of personal data under the Data Protection Directive does not require the Commission to treat as secret views or information which have been submitted to it concerning the exercise of its functions, nor the names of the persons who submitted the views or information.

2.8      The Ombudsman therefore considers that the Commission has misunderstood its obligations under the Data Protection Directive and has thereby infringed the principle of openness.  This is an instance of maladministration.  Since a friendly solution is not possible, the Ombudsman makes a draft recommendation to the Commission, in accordance with Article 3 (6) of the Statute of the Ombudsman.

The Commission's detailed opinion

After receiving the draft recommendation and in accordance with Article 3 (6) of the Statute of the European Ombudsman, the Commission sent a detailed opinion on 3 July 1999.

In its detailed opinion, the Commission firstly recalled that, by virtue of Article 286of the EC Treaty, the Data Protection Directive applies to the Commission as well. 

Secondly, the Commission maintained its point of view that the consent of the person concerned is necessary in order to authorise the communication of personal data in this type of case.  The detailed opinion then states:

"Article 7a of Directive 95/46/EC requires the unambiguous consent of the data subject.

 In the application of Article 7f of Directive 95/46/EC, the interest for fundamental rights and freedoms of the data subject, in particular his/her private life, do prevail over the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed if the consent of the data subject is not obtained.

The Commission is nevertheless of the opinion that, in the present case, the interests of the data subjects to whom a letter has been addressed in order to obtain their consent do not prevail where no response is received, regard being had to the following factors.  On the one hand, the letter followed prior contact between the Commission and the data subjects and, on the other hand, it was addressed to those persons by the Commission as a public authority.  In other words, in the absence of a response to the letter, and bearing in mind the particular circumstances in this case, the Commission is of the opinion that the interests or fundamental rights and freedoms of the data subjects do not prevail."

The Commission enclosed an updated table, including the names of 25 persons who had not given any reply to the Commission's letter inviting them to give their consent to the release of their names to the complainant.

The Ombudsman's evaluation of the Commission's detailed opinion

In summary, the Commission's detailed opinion:

- does not contest the Ombudsman's view that the principles of good administrative behaviour require it to supply the names of the persons concerned, unless it has a legal obligation to keep this information confidential

- maintains the view that the Data Protection Directive forbids the Commission to supply the names of the persons concerned without their unambiguous consent, having regard, in particular, to their interest in their private life

-  considers that in the present case, it should supply the names of all the persons concerned with the exception of those who have expressly refused their consent.

The Commission's detailed opinion does not directly answer the legal arguments contained in the Ombudsman's draft recommendation.  The detailed opinion refers, however, to "the interest for fundamental rights and freedoms of the data subject, in particular his/her private life."  Whilst acknowledging the fundamental importance of this interest, the Ombudsman considers, for reasons stated in the draft recommendation of 17 May 2000 that there is no fundamental right to supply information to an administrative authority in secret and that the Data Protection Directive does not require the Commission keep secret the names of persons who submit views or information to it concerning the exercise of its functions.

The Ombudsman's recommendation

In the Ombudsman's view, the Commission's detailed opinion does not state a valid reason for not complying in full with the Ombudsman's draft recommendation of 17 May 2000. The Ombudsman therefore re-states the draft recommendation as a recommendation to the Commission:

The Commission should inform the complainant of the names of the delegates of the Confédération des brasseurs du marché commun who attended a meeting organised by the Commission on 11 October 1996 and of companies and persons in the 14 categories identified in the complainant's original request for access to documents who made submissions to the Commission under file reference P/93/4490/YK.

The European Parliament could consider adopting the recommendation as a resolution.

Strasbourg,

Jacob Söderman

 

---

 

[1] Decision 94/262 of 9 March 1994 of the European Parliament on the Regulations and General Conditions Governing the Performance of the Ombudsman's Duties, OJ 1994 L 113/15

[2] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, 1995 OJ L 281/31.

[3] An earlier version of the draft recommendation was made on 6 April 2000. It contained an error and was withdrawn with an apology to the complainant and to the Commission.

[4] See Article 22 of the European Ombudsman's Code of Good Administrative Behaviour of 19 July 1999.

[5] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, 1995 OJ L 281/31.

[6] ibid.

[7] The Directive also applies to the European Ombudsman. See the Ombudsman's decision of 30 November 1999 concerning the designation of a data protection officer, which is available on the Ombudsman's website: http://www.euro-ombudsman.eu.int/LBASIS/EN/Dataprot.htm

[8] Declaration 17: "The Conference considers that transparency of the decision-making process strengthens the democratic nature of the institutions and the public's confidence in the administration. The Conference accordingly recommends that the Commission submit to the Council no later than 1993 a report on measures designed to improve public access to the information available to the institutions."

[9] See for example, Case C-58/94, Netherlands v Council [1996] ECR I-2169.

[10] The second paragraph of which states: "This Treaty marks a new stage in the process of creating an ever closer union among the peoples of Europe, in which decisions are taken as openly as possible and as closely as possible to the citizen" (emphasis added).

[11] "Member States shall provide that personal data may be processed only if:

(a) the data subject has unambiguously given his consent; or

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject; or

(d) processing is necessary in order to protect the vital interests of the data subject; or

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; or

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1)."