Made in accordance with Article 4(1) of the Statute of the European Ombudsman^[1]

Background to the complaint

1. In May 2022, the European Commission issued a legislative proposal[2] laying down rules to prevent and combat child sexual abuse. Amongst other things, the proposed rules include an obligation for providers (such as webmail and messaging services) proactively to detect, report and remove child sexual abuse material on their services.

2. When preparing this proposal, the Commission consulted various stakeholders, including Thorn, an organisation which describes itself as an NGO that has developed and sells tools for detecting child sexual abuse material (CSAM).

3. The Commission’s proposal (also called ‘CSAM proposal’) drew some criticism, including from expert bodies such as the European Data Protection Supervisor (EDPS), questioning the effectiveness, necessity and proportionality of the proposed rules. For example, concerns were raised about a possible generalised and indiscriminate scanning of content of electronic communications and the fundamental rights implications this would entail.[3]

4. In June 2022, the complainant, a journalist, made a request[4] for public access to documents to the Commission, asking for disclosure of all communication with the above mentioned organisation as well as related documents since 1 January 2021.

5. The Commission identified 20 documents as falling within the scope of the complainant’s request. It gave full access to five documents and refused to disclose (parts of) the remaining documents. In refusing access, the Commission relied on the need to protect personal data, commercial interests and its decision-making.[5]

6. The complainant asked the Commission to review its decision (he made a ‘confirmatory application’) concerning nine[6] documents to which it had refused to give access (in full or in part).

7. In October 2023, the Commission granted the complainant wider access to seven documents (‘documents 12 to 18’). It maintained its refusal to disclose two documents in their entirety (‘documents 19 and 20’). At this stage, the Commission invoked the need to protect personal data and the need to protect the commercial interests of the organisation concerned. As regards one document (‘document 19’), the Commission also invoked the need to protect the public interest as regards public security.[7]

8. Dissatisfied with the access granted, the complainant turned to the Ombudsman, challenging the Commission’s application of the exception for the protection of commercial interests in relation to four[8] documents (documents 13, 14, 17 and 20). Three of these documents describe the technology developed by the organisation concerned, and the fourth document contains minutes of a meeting between the Commission and the organisation.

The inquiry

9. The Ombudsman opened an inquiry into the Commission’s refusal to grant public access to (parts of) the four documents at issue in the complaint.

10. In the course of the inquiry, the Ombudsman inquiry team inspected the four documents in question as well as the Commission’s exchanges with the organisation concerned, which the Commission had consulted on the complainant’s access request.

Arguments presented

11. In his confirmatory application, the complainant contended that not all information about a commercial entity is confidential as such. He added that the organisation concerned has itself published a significant amount of information on its technology. He suspected that some of the redacted information might be included in the organisation’s promotional material for potential customers and public authorities. Based on this, he considered that information on the functioning or efficacy of the organisation’s tools could not be sensitive.

12. The complainant also argued that, in light of the criticism that the CSAM proposal has drawn, there is an overriding public interest. Specifically, given that software such as the tools concerned have high error rates, and that the deliberations on the CSAM proposal are ongoing, the documents would serve to inform the public debate in this context.

13. The Commission took the view that it is irrelevant whether any information is already public elsewhere.

14. The Commission also argued that the documents concern the organisation’s business strategy on deployment of products and its specific thoughts, ideas and suggestions on legislation and regulation. The organisation provided its expertise on a confidential basis and some of the information has not, to date, been publicly released. Disclosure could thus impact on the organisation’s relationship with partners who may have counterbalancing interests and/or opinions, thereby affecting its revenue-generating business.

15. The Commission added that three documents illustrate how the organisation developed its products, their status as well as their functionality. This information, it said, constitutes intellectual property of the organisation. Disclosure would harm its competitive advantage, market share and revenue potential, and put a strain on the organisation’s relationships with third parties.

16. The Commission acknowledged that there is a public interest in the EU Strategy for a more effective fight against child sexual abuse. However, it argued, general considerations or references to a public debate are not sufficient for the existence of an overriding public interest. Nor is criticism towards certain technologies that can be used against CSAM sufficiently specific. Rather, disclosure would have to contribute, in a concrete manner, to the protection of a public interest that is more pressing than the interest protected by the relevant provision.

17. In his complaint to the Ombudsman, the complainant argued that the CSAM proposal is based on technical data provided by stakeholders such as the organisation concerned. Referring to a study conducted by the European Parliament, the complainant contended that the precision rate of technologies like those developed by the organisation are often overestimated. It is therefore essential that any technical claims made by the organisation concerned are made public as this would facilitate the critical assessment of the proposal.

18. The complainant also considered that the withheld information should be subject to particularly high standards of public scrutiny, given that “the algorithmic functions enshrined in software have a quasi-normative effect.”

The Ombudsman's assessment leading to a recommendation

19. Commercial information, including intellectual property, can be protected under the EU legislation on public access to documents (Regulation 1049/2001).[9] However, EU institutions cannot rely on the need to protect commercial interests simply because information relates to a company/organisation or its products. The relevant exception serves to protect commercially sensitive information, that is, information that, if disclosed, would undermine legitimate commercial interests of the entity concerned. This can be the case where information relates to an entity’s business strategy or its expertise (for example, a specific methodology unique to an entity and unknown to competitors).

20. When applying this exception, EU institutions thus have to explain how disclosure would specifically and actually undermine the legitimate commercial interests at stake. In addition, the risk that the suspected damage would occur must be reasonably foreseeable and not purely hypothetical.[10]

21. Having reviewed the four documents at issue, the Ombudsman is not convinced that the Commission’s arguments are such as to justify the non-disclosure of the majority of the withheld information.

22. Specifically, parts of the withheld information cannot reasonably be considered to be covered by the exception for the protection of commercial interests, either because the information appears to be rather general in nature, or because the information is already in the public domain, as the Commission itself stated in its confirmatory decision. Examples of such information are contained in the confidential annex to this recommendation.

23. In this context, the Commission’s argument that it is irrelevant whether some information is already public elsewhere, must be rejected. While an EU institution is under no obligation to disclose a document that has been leaked, the fact that information is already lawfully public is relevant to the question whether disclosure of this information could possibly undermine commercial interests.

24. Notably, in this case, the information that is already public was made available by the organisation itself. It is unclear how disclosing that the organisation also shared this information with the Commission could possibly affect its commercial interests. The fact that the Commission seems to have promised the organisation that the information would be treated confidentially does not alter this as such a promise cannot circumvent the application of Regulation 1049/2001.

25. As regards those redacted parts of the documents that are more detailed, not yet publicly known and might reasonably be considered to be able to undermine commercial interests, if disclosed, it should be noted that EU institutions must proactively assess whether there is an overriding public interest in disclosure.[11] In this case, the Commission examined and dismissed the arguments put forward by the complainant in this context. However, the Commission does not seem to have considered other elements that could establish the existence of an overriding public interest.

26. In particular, the public debate that could benefit from disclosure does not take place in isolation. Rather, the concerns raised by the wider public were made in the context of an ongoing legislative procedure. The documents at issue have, presumably, been shared with the Commission with the aim of informing and/or influencing the drafting of the CSAM proposal that forms the basis of this procedure. What is more, the outcome of the legislative procedure will have a direct impact on children’s fundamental rights to human dignity and to the integrity of the person and to the prohibition of inhuman or degrading treatment, as well as the fundamental rights of citizens related to the protection of their personal data.

27. One of the core principles of the EU is openness in its decision-making.[12] Openness facilitates public participation and ensures more accountability of the decision-makers. This is even more important where the decision-making results in new legislation, and specifically if new legislation will effectively restrict fundamental rights of citizens. Openness in that respect contributes to strengthening democracy by allowing citizens to scrutinize all the information which has formed the basis of a legislative act.[13]

28. Disclosure of the documents at issue is therefore necessary for two reasons. Firstly, it will enable the public to participate more effectively in a decision-making process that will very likely directly affect citizen’s day-to-day life by limiting their right to privacy. Secondly, transparency will allow the public to scrutinise who and what informed the legislative proposal in question. Stakeholders who actively provide input should not be allowed to do so behind closed doors.[14]

29. Finally, as stated many times before, the Ombudsman considers that access delayed is access denied. This is particularly true in cases that concern an ongoing decision-making process where the granting of public access to specific documents is required to give effect to citizens’ right to take part in this process.

30. In light of the above, the Ombudsman finds that the Commission’s (partial) refusal of public access to the four documents at issue constituted maladministration. She therefore makes a corresponding recommendation below.

Recommendation

On the basis of the inquiry into this complaint, the Ombudsman makes the following recommendation to the Commission:

The European Commission should re-consider its decision to refuse to give public access to (parts) of the four documents at issue in the complaint with a view to providing significantly increased, if not full, public access to these documents.

The Commission and the complainant will be informed of this recommendation. In accordance with Article 4(2) of the Statute of the European Ombudsman, the Commission shall send a detailed opinion by 19 March 2024.

 

Emily O'Reilly
European Ombudsman

Strasbourg, 19/12/2023

 

[1] Available at: http://data.europa.eu/eli/reg/2021/1163/oj.

[2] Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM%3A2022%3A209%3AFIN.

[3] See, for example, EDPS, Briefing note on the CSAM proposal: “The Point of No Return”, available at: https://edps.europa.eu/data-protection/our-work/publications/factsheets/2023-10-23-briefing-note-csam-point-no-return_en.

[4] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: http://data.europa.eu/eli/reg/2001/1049/oj.

[5] In accordance with Articles 4(1)(b), (2) first indent and (3) of Regulation 1049/2001.

[6] Described as ‘documents 12 to 20’ by the Commission.

[7] In accordance with Article 4(1)(a) of Regulation 1049/2001.

[8] Documents 13, 14, 17 and 20.

[9] In accordance with Article 4(2), first indent of Regulation 1049/2001.

[10] See, for example, judgment of the Court of First Instance of 13 April 2005, VKI v Commission, T-2/03, paragraph 69:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62003TJ0002&qid=1666343897772.

[11] See, for example, judgment of the Court of Justice of 1 July 2008, joined cases C-39/05 P and C-52/05 P, Sweden & Turco v Council, paragraph 44: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62005CJ0039&qid=1700736581523.

[12] Article 15(1) TFEU.

[13] Judgment of the Court (Grand Chamber) of 1 July 2008. Kingdom of Sweden and Maurizio Turco v Council of the European Union. Joined cases C-39/05 P and C-52/05 P, paragraph 46, available at: https://curia.europa.eu/juris/document/document.jsf?text=&docid=67058&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=2167118.

[14] This is also reflected in the Commission’s ‘Better Regulation Guidelines’ that set out that relations with stakeholders are governed by four principles, including the principle to “make the consultation process and how it has affected policymaking transparent to those involved and to the general public’: https://commission.europa.eu/system/files/2021-11/swd2021_305_en.pdf (see Chapter II, point 3.).