Background to the complaint

1. On 25 September 2019, the complainant asked the European Commission for public access to all the documents it held relating to a Spanish hotel and catering management school.

2. On 16 October 2019, the European Commission informed the complainant that it did not have in its possession any relevant documents (“initial decision”).

3. On 3 November 2019, the complainant submitted to the European Commission a request for review, a so-called “confirmatory application.”

4. On 8 January 2020, the Commission informed the complainant that it had identified six documents related to the Spanish hotel and catering management school concerning the Erasmus+ programme (“confirmatory decision”). The Commission refused public access to the requested documents based on the need to protect the privacy and integrity of persons identified in the documents ^[1] and the need to protect the commercial interests of the school and its partner organisations.^[2]

5. Dissatisfied with the Commission’s response, the complainant turned to the Ombudsman on 25 March 2020.

The inquiry

6. The Ombudsman opened an inquiry into the complaint that the European Commission wrongly refused public access to the requested documents.

7. In the course of the inquiry, the Ombudsman’s inquiry team contacted the Commission and asked for copies of the requested documents, which the Commission provided on 16 April 2020.

The European Commission’s response to the complainant

Protection of the privacy and integrity of the individual

8. The Commission noted that the requested documents contain personal data, such as the names, contact details and handwritten signatures of staff and representatives of the hotel and catering management school in question, and its partner organisations, involved in Erasmus+ projects.

9. The Commission explained that the complainant had not established the necessity of having the personal data transmitted, as required by EU data protection rules. It noted that any such necessity must serve a specific purpose and that this specific purpose must be in the public interest. Further, the Commission stated that there was a real and non-hypothetical risk that disclosure of the personal data would undermine the privacy of the data subjects, prejudice their legitimate interests and expose them to unsolicited external contacts.

Protection of the commercial interests of a natural or legal person

10. The Commission explained that the documents are applications made under a call for project proposals in the “Erasmus +” programme. They contain a detailed description of the tasks and the projects’ implementation plans. They also contain information on the internal allocation of the tasks, their distribution among the project partners and the description of the projects’ results. The documents also provide budgetary information, such as the estimated costs of the projects.

11. The Commission pointed out that the public disclosure of the requested documents would clearly undermine the commercial interests of those participating in the projects. It would, for example, give an undue advantage to potential competitors applying for grants in the framework of the Erasmus+ programme.

12. The Commission noted that the complainant had not referred to any overriding public interest which might justify the public disclosure of the requested documents. The Commission added that it could not identify an overriding public interest itself which might justify the public disclosure of the requested documents.

The Ombudsman's assessment

Regarding the protection of the privacy and integrity of individuals

13. Personal data is any information related to an identified or identifiable person.^[3] Therefore, the names, contact details, and the handwritten signatures of the representatives of the hotel and catering management school and third parties are personal data.

14. If a request for public access to documents containing personal data is made, any potential disclosure must be assessed by reference to the EU rules on the protection of personal data.^[4]

15. Under EU data protection legislation^[5], the Commission must follow a three-stage analysis before it can grant a request to make personal data public. First, the recipient needs to demonstrate the need for transferring the data for a specific purpose in the public interest. Second, there must be no reason to believe that such transfer might undermine the legitimate interests of the data subject. Third, the controller (the Commission) needs to establish that it is proportionate to transmit the personal data for that specific purpose, having weighed up the various competing interests.

16. From the documents provided to the Ombudsman, it appears that the complainant did not raise any arguments as to why he considers that there is a specific need to have the personal data contained in the requested documents transferred to him.

17. Furthermore, the Ombudsman agrees with the Commission that there is a real and non-hypothetical risk that the disclosure of the personal data could undermine the data subjects’ privacy, prejudice their legitimate interest and expose them to unsolicited external contacts, including from the complainant. The Ombudsman draws this conclusion based on the extensive communications she has received from the complainant, which illustrate the difficult nature of his relationship with the school.

18. In light of the above, the Ombudsman takes the view that the European Commission was justified in refusing access to the personal data contained in the documents.

Regarding the protection of the commercial interests of a natural or legal person

19. EU case law^[6] establishes that documents submitted in a competitive procedure are, by their nature, likely to contain confidential technical and economic information about the successful applicant. In particular, information on that applicant’s competencies and working methods, know-how, internal organisation, costs and proposed prices. Therefore, there is a general presumption that the disclosure of such documents would, in principle, undermine the protection of commercial interest.^[7]

20. The Ombudsman has examined the documents at issue in this case. They contain detailed project descriptions and information on its staged implementation, the partners involved, as well as financial information concerning the estimated budget figures and costs of the project. If disclosed, this information could be useful to persons seeking to obtain similar funding in the future, thus prejudicing, in a competitive process, the legitimate commercial interests of the school and, potentially, others.

21. The Ombudsman thus agrees with the Commission that there is a real and not hypothetical risk that public access to the documents would undermine the commercial interests of the entities concerned.

22. The Ombudsman has not identified any overriding public interest in disclosure.

23. Therefore, the Ombudsman finds that the Commission was justified in refusing access to the requested documents to protect the commercial interests of the school and other entities participating in the projects.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following finding:

There was no maladministration by the Commission in refusing to grant public access to the requested documents.

The complainant and the European Commission will be informed of this decision.

 

Emily O'Reilly

European Ombudsman

Strasbourg, 01/07/2020

 

 

[1] Article 4(1)(b) of Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents, available at: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32001R1049.

[2] Article 4(2), first indent, of Regulation 1049/2001.

[3] Article 3(1) of Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725.

[4] Judgement of the Court (Grand Chamber) of 29 June 2010, Commission v. Bavarian Lager, C-28/08 P, ECLI:EU:C:2010:378, paragraph 59.

[5] Article 9(1)(b) of Regulation 2018/1725.

[6] Judgement of the General Court (Second Chamber) of 26 March 2020, Case T-734/17, ViaSat, Inc. v. European Commission, Case T-734/17, ECLI:EU:T:2020:123, paragraph 59.

[7] See footnote 6, paragraph 51.