Background to the complaint

1. In May 2022, the European Commission issued a legislative proposal[1] laying down rules to prevent and combat child sexual abuse. Amongst other things, the proposed rules include an obligation for providers (such as webmail and messaging services) proactively to detect, report and remove child sexual abuse material on their services.

2. When preparing this proposal, the Commission consulted various stakeholders, including Thorn, an organisation which describes itself as a non-governmental organisation and which has developed and sells tools for detecting child sexual abuse material (CSAM).

3. The Commission’s proposal (also called ‘CSAM proposal’) drew some criticism, including from expert bodies such as the European Data Protection Supervisor (EDPS), questioning the effectiveness, necessity and proportionality of the proposed rules. For example, concerns were raised about a possible generalised and indiscriminate scanning of content of electronic communications and the fundamental rights implications this would entail.[2]

4. In June 2022, the complainant, a journalist, made a request[3] for public access to documents to the Commission, asking for disclosure of all communication with [Thorn] as well as related documents since 1 January 2021.

5. The Commission identified 20 documents as falling within the scope of the complainant’s request. It gave full access to five documents and refused to disclose (parts of) the remaining documents. In refusing access, the Commission relied on the need to protect personal data, commercial interests and its decision-making.[4]

6. The complainant asked the Commission to review its decision (he made a ‘confirmatory application’) concerning nine[5] documents to which it had refused to give access (in full or in part).

7. In October 2023, the Commission granted the complainant wider access to seven documents (‘documents 12 to 18’). It maintained its refusal to disclose two documents in their entirety (‘documents 19 and 20’). At this stage, the Commission invoked the need to protect personal data and the need to protect the commercial interests of the organisation concerned. As regards one document (‘document 19’), the Commission also invoked the need to protect the public interest as regards public security.[6]

8. Dissatisfied with the access granted, the complainant turned to the Ombudsman, challenging the Commission’s application of the exception for the protection of commercial interests in relation to four documents (documents 13, 14, 17 and 20). Three of these documents originate from Thorn and describe the technology it developed; the fourth document contains minutes of a meeting between the Commission and the organisation.

9. The Ombudsman opened an inquiry into the Commission’s refusal to grant public access to (parts of) the four documents at issue in the complaint.

10. In the course of the inquiry, the Ombudsman inquiry team inspected the four documents in question as well as the Commission’s exchanges with Thorn, which had been consulted[7] on the complainant’s access request.

The Ombudsman's recommendation

11. The Ombudsman noted that commercial information can be withheld under the EU legislation on public access to documents (Regulation 1049/2001) if it can reasonably be considered to be sensitive and the feared risk is reasonably foreseeable and not purely hypothetical.[8]

12. The Ombudsman was not convinced that the non-disclosure of the majority of the withheld information was justified. Specifically, she considered that large parts of this information was rather general in nature and/or already published by the organisation concerned.

13. The Ombudsman also found that the Commission had not considered all elements that could establish the existence of an overriding public interest. In this context, the Ombudsman noted that disclosure would (i) enable the public to participate more effectively in a decision-making process that will very likely directly affect citizens’ day-to-day life by limiting their right to privacy and (ii) allow the public to scrutinise who and what had informed the legislative proposal in question.

14. Finally, the Ombudsman shared her concerns about the delay incurred by the Commission in dealing with the complainant’s request for public access to documents.

15. The Ombudsman concluded that the Commission’s (partial) refusal of public access to the four documents at issue constituted maladministration. She therefore made the following recommendation[9] to the Commission:

The European Commission should re-consider its decision to refuse to give public access to (parts) of the four documents at issue in the complaint with a view to providing significantly increased, if not full, public access to these documents.

16. In reply, the Commission maintained that no further access could be granted to the documents.

17. Specifically, it said that “the detailed description of [Thorn’s] products, combined with the information on [its] business strategy and advice in relation to the pending legislation, created a risk to Thorn’s commercial interests.” The Commission therefore “remains of the belief that, if disclosed, this information may harm [Thorn’s] competitive position.”

18. As regards a possible overriding public interest in disclosure, the Commission stated that the information in the documents constituted “proprietary business data” which Thorn had “not shared (...) to influence the drafting of the CSAM proposal, but to provide its expertise on the matter, exclusively for the Commission’s consideration”. It was therefore “not obvious how further disclosure (...) would address any alleged issues of access to the public debate or significantly increase the quality or the results of this debate.”

19. The complainant did not comment on the Commission’s response.

The Ombudsman's assessment after the recommendation

20. The Ombudsman remains unconvinced that the information at issue is such as to warrant protection under Regulation 1049/2001. As stated in the recommendation to the Commission, the review by the Ombudsman inquiry team showed that the documents are rather general in nature, and that large parts had already been disclosed by the organisation in question. The Commission was aware of this. It was therefore unreasonable for the Commission to withhold this information based on the need to protect the organisation’s commercial interests.

21. In addition, the documents at issue have in the meantime been lawfully disclosed to the complainant by national authorities under their relevant rules on freedom of information. In light of this, it is very difficult to understand how, months later, the Commission can possibly maintain its view that disclosure through its services would undermine Thorn’s commercial interests.

22. Even if Thorn’s commercial interests could reasonably be considered to be undermined by disclosure, the Ombudsman is concerned about the Commission’s statement in its assessment of an overriding public interest that Thorn, by providing its expertise, did not aim to influence the decision-making in relation to the CSAM proposal. This statement appears far removed from reality. As the Commission itself said when invoking the commercial interest exception, the documents at issue “concern business strategy on deployment of Thorn products, as well as Thorn’s views on legislation and regulation”. Also, it is clear, for example, from the Commission’s impact assessment[10] that the input provided by Thorn did very much inform the Commission’s decision-making. The public interest in disclosure is thus self-evident.[11]

23. In these circumstances, the Ombudsman cannot but confirm her finding of maladministration.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following finding:

The refusal to give increased, if not full, public access to the documents at issue was maladministration by the European Commission.

The complainant and the Commission will be informed of this decision.

 

Emily O'Reilly

European Ombudsman

Strasbourg, 12/07/2024

 

 

[1] Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM%3A2022%3A209%3AFIN.

[2] See, for example, EDPS, Briefing note on the CSAM proposal: “The Point of No Return”, available at: https://edps.europa.eu/data-protection/our-work/publications/factsheets/2023-10-23-briefing-note-csam-point-no-return_en.

[3] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: http://data.europa.eu/eli/reg/2001/1049/oj.

[4] In accordance with Articles 4(1)(b), (2) first indent and (3) of Regulation 1049/2001.

[5] Described as ‘documents 12 to 20’ by the Commission.

[6] In accordance with Article 4(1)(a) of Regulation 1049/2001.

[7] In accordance with Article 4(4) of Regulation 1049/2001.

[8] See, for example, judgment of the Court of First Instance of 13 April 2005, VKI v Commission, T-2/03, paragraph 69:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62003TJ0002&qid=1666343897772.

[9] The full text of the Ombudsman’s recommendation is available at: https://www.ombudsman.europa.eu/en/recommendation/en/179395.

[10] Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=SWD:2022:209:FIN&from=EN.

[11] See also the Ombudsman’s recommendation in case 2421/2023/MIG on how the European Commission dealt with a request for public access to documents concerning its proposal for a regulation to prevent and combat online child sexual abuse, paragraph 46: https://www.ombudsman.europa.eu/en/recommendation/en/185538.