Background to the complaint

1. In October 2022, the complainant, a civil society organisation (European Digital Rights, or ‘EDRi’)[1] made a request for public access[2] to documents held by the European Commission. The documents requested were questionnaires sent by the Commission to Member States on the topic of encryption in 2021, the Member States’ replies to these questionnaires and any presentation material or compilation prepared by the Commission based on the replies.

2. The Commission identified six documents as falling within the scope of the request. It granted full access to one document (a meeting agenda) but refused access in full to the remaining five documents, arguing that disclosure of these documents would undermine the protection of the public interest as regards public security as well as undermine the decision-making process of the Commission in relation to encryption in the law enforcement context. The complainant asked the Commission to review its decision (by making a ‘confirmatory application’).

3. The Commission acknowledged receipt of the confirmatory application and said it would reply within the applicable time limits, before 15 February 2023. It then informed the complainant that, due to the need to carry out consultations, it would not be in a position to reply in time. After having sent two reminders, to which the Commission failed to reply, the complainant turned to the Ombudsman in April 2023.

The inquiry

4. The Ombudsman opened an inquiry into the Commission’s failure to reply to the confirmatory application submitted by the complainant.

5. In the course of the inquiry, and in view of the persisting delay, the Ombudsman inquiry team inspected the documents at issue. Following a review of the documents, the Ombudsman made a proposal for a solution that the Commission grant the widest possible access to the five documents at issue.

6. The Commission replied, after a very significant delay, to the confirmatory application and, a few weeks later, to the Ombudsman’s proposal for a solution. The Ombudsman received the complainant’s comments on the Commission’s reply.

The Ombudsman's proposal for a solution

7. Following the inspection of the documents by her inquiry team, the Ombudsman took the view that the Commission should have granted partial access to the documents.

8. The five documents at issue are:

• Document 1, containing 27 questionnaires that the Commission sent to the Member States’ authorities in order to gather their replies as regards applicable national legislation and case law concerning encryption (“questionnaire A”) and operational practices and needs in each Member State, including quantitative data, where available (“questionnaire B”).
• Document 2, containing the same 27 questionnaires with the Member States’ replies.
• Documents 3, 4 and 6[3] are summaries of the replies, presentation slides and a background discussion paper presenting the main takeaways of the Member States’ replies to the questionnaires.

9. The Ombudsman considered that wide parts of the documents could be disclosed to the public, in particular the parts that describe applicable national legislation or case-law (“questionnaire A”). These parts do not appear to be covered by any of the exceptions invoked by the Commission.

10. She underlined that there is a strong public interest in disclosure of the documents, not only because of the importance of the topic of encryption and how it relates to the fundamental right to privacy, but also because civil society organisations such as the complainant rely on documents disclosed in response to public access requests in order to exercise their role of watchdogs.

11. The Ombudsman therefore proposed that the Commission reconsider its position on the public access request with a view of granting the widest possible access to the five documents at issue.[4]

12. Following the Ombudsman’s solution proposal, the Commission replied to the complainant’s confirmatory application (in January 2024). The Commission granted full access to documents 1 and 6 (the “blank” questionnaires and a background paper). It granted wide partial access to document 2, containing the replies of the Member States to questionnaires A and B,[5] and partial access to documents 3 and 4 which are an executive summary of the replies received and a slideshow presentation on those replies. The Commission explained that it refused to disclose certain parts of the documents because their disclosure would undermine the protection of the public interest as regards public security.

13. In particular, the Commission said that it had consulted Member States on possible disclosure. Some Member States objected to disclosure of their replies because they contain sensitive information related, for instance, to technical arrangements or operational protocols in place, as well as information on decryption capacities and their possible limits. The Commission added that public disclosure of any element related to encryption vulnerabilities could serve to inform potential criminals and pose security risks at national and EU level.

14. The Commission subsequently replied to the Ombudsman’s proposal for a solution in February 2024.[6] In addition to the arguments presented in reply to the confirmatory application, the Commission explained that it had decided to protect parts of documents 3 and 4 as their disclosure would reveal directly or indirectly (by cross-referencing information with the replies to the questionnaires that Member States agreed to disclose) the content of the replies provided by individual Member States who did not agree to disclose all or part of their replies. The Commission added that a large majority of Member States had indicated, in reply to a question in questionnaire B, that they would object to disclosure of sensitive replies in case of a public access request.[7] The Commission underlined that the confirmatory decision granted substantial further access compared with the Ombudsman’s proposal as regards the replies to questionnaire B. The Commission considered that the widest possible access had been granted to the documents.

15. The complainant welcomed the Ombudsman’s proposed solution and accepted the Commission’s position that sensitive content could not be disclosed. However, the complainant questioned the redactions in document 4 (the presentation slides), which concerned the numbers of Member States that had replied in the same manner to certain questions (for example that “X” Member States had said that they have put in place specific legislation on encryption). The complainant could not understand why those numbers are sensitive and noted that they could easily be calculated based on the disclosed replies of the Member States in the questionnaires (document 2). The complainant contended that document 4 did not attribute any response to a specific Member State, and did not present any risk of undermining public security. The redactions in the document, the complainant said, made its disclosure pointless.

16. The complainant also observed the discrepancy between the Commission’s initial reply, refusing access in full to all documents, and its confirmatory decision providing wide partial access (after a very long wait). The complainant believed that the Commission should have given at least limited partial access at initial stage already, instead of “pushing” applicants to use the redress mechanisms such as the European Ombudsman or the Court of Justice of the EU.

The Ombudsman's assessment after the proposal for a solution

17. The Ombudsman welcomes the Commission’s positive reply to her solution proposal, and the wide partial access the Commission has now given to the documents at issue. The Member States’ replies in questionnaire A, concerning applicable national legislation and case law on encryption, have been disclosed with a few exceptions that appear justified in light of the security concerns explained by the Commission. The replies in questionnaire B, containing operational practices that may be considered as sensitive, have been disclosed partially (approximately half of the Member States’ replies have been made partly available). The Commission’s explanations on the possible security risks of disclosure are not manifestly wrong.

18. The Ombudsman notes the complainant’s concerns as regards the redactions applied by the Commission to document 4. However, she understands that the Commission decided to redact the aggregated numbers of Member States in that document in order to prevent cross-referencing information which would allow the public, albeit indirectly, to attribute some replies to specific Member States. The Commission provided explanations in this regard and referred to a specific question of questionnaire B concerning Member States’ objections to disclosure. The Ombudsman considers that the Commission’s explanations for the redactions are not manifestly unreasonable.

19. The Ombudsman therefore welcomes the Commission’s positive response to her solution proposal, and considers that it resolves the complaint.

20. However, the Ombudsman notes the egregious delay in this case. According to Regulation 1049/2001, an EU institution should, within 15 working days from registration of the confirmatory application, either grant access to the document requested or, in a written reply, state the reasons for the total or partial refusal. The time limit of 15 working days may be extended by a further 15 working days in exceptional circumstances.[8]

21. In this case, the Commission took almost one year to take a decision on the complainant’s confirmatory application. In a recent finding of maladministration concerning the systemic delays by the Commission in handling requests for public access to documents,[9] the Ombudsman set out a recommendation and several suggestions for improvement and urged the Commission to address the major issue of delays. The European Parliament endorsed a Special Report sent by the Ombudsman on the matter in a unanimous vote in its plenary session on 14 March 2024. As such, the Ombudsman will keep monitoring the issue, but will not repeat those elements in this decision.

Conclusions

Based on the inquiry, the Ombudsman closes this case with the following conclusions:

By agreeing to provide wider partial access to the requested documents, the Commission has resolved the complaint.

The Ombudsman profoundly regrets the delay incurred by the Commission in replying to the complainant’s request. She insists that failure to comply with the time limits established by the legislator in Regulation 1049/2001 cannot be good administration. She again urges the Commission to improve its handling of public access requests as a matter of priority, and refers it to the recommendation in her strategic inquiry OI/2/2022/OAM.

The complainant and the European Commission will be informed of this decision.

 

Emily O'Reilly
European Ombudsman

Strasbourg, 17/04/2024

 

[1] European Digital Rights (EDRi) is an association of civil and human rights organisations from across Europe, defending rights and freedoms in the digital environment. For more information, visit https://edri.org/

[2] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32001R1049&from=EN.

[3] Document 5 is the meeting agenda to which the Commission granted full public access at initial stage.

[4] The full text of the Ombudsman’s proposal for a solution is available at: https://www.ombudsman.europa.eu/solution/185085

[5] The Commission gave full access to the replies of 16 Member States, partial access to the replies of 5 Member States and no access to the replies of 6 Member States as regards Questionnaire A; it gave partial access to the replies of 14 Member States and no access to the replies of 13 Member States as regards Questionnaire B.

[6] The Commission’s reply is available at: https://www.ombudsman.europa.eu/doc/correspondence/185086

[7] Question 30 of questionnaire B: “Do you agree to the proposal that, in case the Commission receives a request for access to documents regarding these questionnaires, the answers to the questions marked as sensitive would not be disclosed?”

[8] Article 8 of Regulation 1049/2001.

[9] See the Recommendation on the time the European Commission takes to deal with requests for public access to documents (strategic inquiry OI/2/2022/OAM), available at: https://www.ombudsman.europa.eu/en/recommendation/en/167661