Strasbourg, 10 July 2007

Dear Mr X,

On 3 February 2005, you made a complaint to the European Ombudsman against the European Commission. You complained against the Commission's Directorate-General Press and Communication concerning the disclosure to, and appearance in, a Maltese newspaper of 16 January 2005, of the names of several candidates for the post of Head of the Representation of the Commission in Malta. In accordance with your request, your complaint has been treated confidentially.

On 22 March 2005, I forwarded your complaint to the Commission and asked it to submit an opinion. The Commission submitted its opinion on 22 June 2005. I forwarded the opinion to you with an invitation to make observations, which you sent on 11 July 2005.

On 19 April 2005, you sent additional information concerning your complaint.

On 21 July 2005, I forwarded your correspondence of 19 April 2005 and your observations to the Commission, for information. Given that the Commission referred, in its opinion, to the pending investigations of the European Data Protection Supervisor ("EDPS") into the events that gave rise to your complaint, I also asked the EDPS for information on the outcome of his inquiries. By another letter of the same day, I requested your consent to my disclosing your name and contact details to the EDPS.

By letter of 26 July 2005, you consented to my informing the EDPS of your name, contact details and any other information that you had provided me concerning this case.

By letters of 13 September 2005 and 12 October 2005, the EDPS's Assistant Supervisor informed me of the outcome of his inquiries into the disclosure of the names of candidates for the post of Head of Representation to a Maltese newspaper of 16 January 2005.

On 7 November 2005, I addressed further inquiries to the Commission, to which it replied on 13 January 2006.

On 17 February 2006, I also addressed further inquiries to the Commission. The Commission sent a French-language reply on 10 May 2006, and supplied an English translation thereof on 1 June 2006. I forwarded both language versions of the reply to you on 7 June 2006.

On 4 July 2006, the Commission sent a French-language version of a complementary report of its services concerning the leaks of the names of candidates for the post of Head of Representation to the Maltese press, and supplied an English translation thereof on 14 July 2006.

On 19 July 2006, I forwarded the English translation of the complementary report to you with an invitation to comment on it, if you so wished, by 15 September 2006. To date, no comments have been received from you concerning that report.

On 26 January 2007, I informed you of the status your complaint file.

I am writing now to let you know the results of the inquiries that have been made.

THE COMPLAINT

The complainant applied for the post of Head of Representation of the European Commission in Malta (the "Representation ")(1). On 16 January 2005, the Malta Independent on Sunday published the names of several candidates for this post. The same article could also be consulted online on the website of the above newspaper. The complainant's name did not appear in the article.

By e-mail of 19 January 2005, the complainant notified the Commission of the above article and requested that appropriate disciplinary measures be taken against the person(s) responsible for the disclosure of the names of the candidates to the press. The Commission neither answered the complainant's e-mail, nor sent him an acknowlegement of receipt.

The complainant considered the leak to the press of the candidates' names as a breach of trust and of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data(2) ("Regulation 45/2001"). Therefore, on 3 February 2005, he submitted a complaint to the European Ombudsman, in which he alleged that the Commission breached Regulation 45/2001. He claimed that the Commission should (i) take appropriate disciplinary measures against the person(s) responsible for the disclosure and (ii) assure him that such disclosure would not occur in the future.

THE INQUIRY

The opinion of the Commission

The Commission's opinion can be summarised as follows:

The Commission first stated that it had, unfortunately, no concrete information about how the disclosure of the candidates' names to the press could have occurred. At the same time, the Commission deeply regretted the disclosure and confirmed that the recruitment process was personal and confidential, and that the usual precautions had been taken to ensure the protection of the personal data of the candidates.

The Commission also pointed to the fact that the Malta Independent on Sunday of 16 January 2005 also mentioned the names of two persons who in fact did not apply for the post of Head of Representation. According to the Commission, this fact clearly indicated the unreliability of the source of the names published.

The Commission further referred to the investigations which the EDPS had opened into this case, as well as to internal examinations of all Commission services involved in the recruitment procedure. Due to these pending investigations, the Commission was unable to provide any further details concerning the outcome of the examinations and the possible consequences for the persons responsible for the disclosure. The Commission noted, however, that it cannot confirm that the leak originated within its services.

The complainant's e-mail of 19 April 2005

After the Ombudsman opened his inquiry into the complainant's allegation and his claims, the complainant informed the Ombudsman, by e-mail of 19 April 2005, that further information had appeared in the Times of Malta of 18 April 2005, in which nine candidates shortlisted for the interview were named.

The complainant's observations on the Commission's opinion

In his observations dated 11 July 2005 , the complainant made remarks on the following three points:

First, the complainant noted that the leaks of personal data of candidates for the post of Head of Representation continued to occur after the Malta Independent on Sunday revealed the names of candidates on 16 January 2005. In this regard, the complainant referred to his e-mail of 19 April 2005, in which he drew the Ombudsman's attention to the fact that the Times of Malta of 18 April 2005, referring to sources close to the Commission, named nine candidates shortlisted for interview. The complainant added that, on the very date of his observations, that is, on 11 July 2005, another report by the Times of Malta, citing Commission sources, had given the names of three female candidates who were allegedly shortlisted for the post of Head of Representation.

Second, the complainant addressed the Commission's argument that the fact that the article in the Malta Independent on Sunday of 16 January 2005 contained the names of two persons who in fact did not apply for the post called into question the reliability of the source of the names published. In this regard, the complainant took the view that, even if third parties were involved in the leaks, the Commission could not escape responsibility. Moreover, the complainant noted that, while the Commission suggested that third parties may have been the source of the leaks, it gave no indication as to whether any third parties had had access to the candidates' personal data and if so, for what purpose.

Further, the complainant pointed out that all but two names published in the Malta Independent on Sunday of 16 January 2005 were correct, and that this correct information could only have been derived from the Commission.

On the other hand, if the repeated leaks to the press occurred as a result of the activities of third parties who gained unauthorised access to the information, the Commission's handling of confidential information was, according to the complainant, obviously deficient.

Finally, if third parties, such as external consultants, had legitimate access to the information, the investigation should extend to such third parties. Such third parties are, according to the complainant, also bound to maintain the confidentiality of personal data, if not directly under Regulation 45/2001, then under national law.

Third, the complainant wished to be informed of the outcome of the EDPS's investigations, and, in particular, of the actions taken as a result of those investigations.

Further inquiries
The Ombudsman's letter of 21 July 2005 to the EDPS

Given that, in its opinion, the Commission referred to the pending investigations of the EDPS into the events which gave rise to the present complaint, the Ombudsman, by letter of 21 July 2005, asked the EDPS for information on the outcome of his inquiries, and informed him of the further leaks of 18 April 2005 and 11 July 2005.

The EDPS's letter of 13 September 2005

By letter of 13 September 2005, the EDPS's Assistant Supervisor informed the Ombudsman that the EDPS opened investigations into the first leak concerning the article in the Malta Independent on Sunday of 16 January 2005 and requested information from the Commission's Directorate-General for Press and Communication ("DG Communication")(3) and Directorate-General for Personnel and Administration ("DG Personnel"). According to the Assistant Supervisor, the EDPS asked the above Directorates-General (i) to try to locate the leak, and (ii) to detail the security measures put in place to ensure that the data of candidates are well protected. The Assistant Supervisor added that the EDPS received a detailed account of the investigation carried out by DG Communication. According to the Assistant Supervisor, DG Communication was unfortunately unable to determine the source of the leak, but pointed to the fact that two of the persons named in the Malta Independent on Sunday of 16 January 2005 had not applied for the post and had subsequently had this fact published in the same newspaper . The Assistant Supervisor concluded by stating that one could expect that a list stolen or leaked from the Commission would have been correct. While acknowledging that there could have been some omissions in such a stolen or leaked list, there should not have been extra names.

The EDPS's letter of 12 October 2005

By further letter of 12 October 2005, the Assistant Supervisor informed the Ombudsman that the EDPS had obtained information from DG Personnel which, however, did not substantially differ from the one provided by DG Communication. According to the Assistant Supervisor, both Directorates-General stated that it was difficult for them to determine exactly how this disclosure could have occurred but they assumed that it might have been disclosed orally. The Assistant Supervisor reiterated the fact that the article in the Malta Independent on Sunday of 16 January 2005 contained two errors involving the first names and two erroneous surnames, and concluded that the leak did not necessarily come from the Commission. The Assistant Supervisor finally stated that the EDPS considered the case closed and would therefore not carry out any further investigation into it. He added that the EDPS welcomed the proposal by DG Personnel for the improvement of the security measures by marking information exchanges either by electronic means or on paper, and would follow up the implementation of this proposal in the procedures of that DG.

The Ombudsman's letter of 7 November 2005 to the Commission

The Ombudsman suggested that the Commission could consider whether problems such as those that have arisen in the present complaint could be avoided in future by adopting an open procedure for high-level appointments, and asked the Commission to inform him of its position. In this context, the Ombudsman pointed to the EDPS's finding that disclosure of the names of participants in recruitment procedures complies with Article 4 of Regulation 45/2001 if candidates are informed in advance that such disclosure is to be made and have the opportunity to ask for confidentiality on legitimate grounds(4).

The Ombudsman also asked the Commission to provide him with lists of its staff members and/or third parties who were authorised by the Commission to have access to the personal data that appeared in the press on 16 January 2005, 18 April 2005 and 11 July 2005 respectively.

Along with his letter addressing further inquiries to the Commission, the Ombudsman enclosed copies of the complainant's further correspondence of 19 April 2005 and observations of 11 July 2005, which contained the information on the second and third leaks to the press of the names of the candidates for the post of Head of Representation.

The Commission's reply of 13 January 2006

As regards the possibility of adopting an open procedure for high-level appointments, the Commission stated that it had made the entire procedure regarding its Senior Management recruitment transparent. It referred to the document Guidelines for Directorates General - Senior Management Selection and Appointment Procedures (the "Guidelines"), dated August 2003 and updated in September 2004(5), and added that it is in favour of any further measures enhancing procedural transparency.

The Commission also stated that t he details of the data processing in the context of Senior Management selection procedures would be shortly submitted to the EDPS for a prior checking pursuant to Article 27 of Regulation 45/2001(6).

In light of the above, the Commission took the position that the possibility of disclosing to the public the names of participants in Senior Management recruitment procedures not contribute meaningfully to the transparency of the procedure as such, and is, on the contrary, likely to discourage well-suited candidates from submitting an application. According to the Commission, most of the candidates with the appropriate profile for a Senior Management post are in positions in which disclosure of their participation in the recruitment procedure may be detrimental to their current jobs. Moreover, as such candidates would opt out of disclosure, any list of candidates divulged to the public was likely to be incomplete and therefore of little added value. Therefore, the Commission concluded that it would continue to adhere to the principle of confidentiality in Senior Management recruitment procedures.

As regards the Ombudsman's request that the Commission provide him with lists of its staff members and/or third parties who were authorised by the Commission to have access to the personal data that appeared in the press on 16 January 2005, 18 April 2005 and 11 July 2005, the Commission regretted to inform the Ombudsman that an exhaustive list of persons having access to the information on which the press articles were based could not be established because of (i) the large number of recipients of the document PERS (2004) 251(7), (ii) the numerous secretariats and staff involved, and (iii) the potential number of people with access to the electronic data in question.

The Ombudsman's letter of 17 February 2006 to the Commission

The Ombudsman requested the Commission to provide:

(i) Comments on the complainant's new allegations, raised in his e-mail correspondence of 19 April 2005 and his observations on the Commission's opinion. The Ombudsman specifically stated:

The complainant alleges that further leaks of personal data of the participants in the recruitment procedure occurred on 18 April 2005 and on 11 July 2005, and that these further leaks also constitute a breach by the Commission of Regulation 45/2001.

(ii) Its reaction on the complainant's claims that the Commission should take appropriate disciplinary measures against the person(s) responsible for the disclosure, and assure the complainant that such disclosure will not occur in future, also taking into account the facts which gave rise to his new allegations.

(iii) Identification of document PERS (2004) 251 mentioned in the Commission's reply to the Ombudsman's further inquiries of 7 November 2005.

(iv) Observations on whether, in its view, it is good administrative practice formally to adhere to the principle of confidentiality in Senior Management recruitment procedures, while at the same time providing the confidential information to a "large number of recipients" and "numerous secretariats and staff involved"(8).

The Commission's reply of 10 May 2006

The Commission stated that it had started investigations into the information contained in the press articles of 18 April 2005 and 11 July 2005, and would inform the Ombudsman of the outcome.

In reply to the Ombudsman's request that it identify document PERS (2004) 251, the Commission stated that the document is an unmarked, unclassified file of its Secretariat-General dated 22 December 2004. It is entitled "Vacancy notice 225/2004 (DG Press and Communications)" and contains, as annexes, the vacancy notice for the A* 12 temporary agent's post of Head of Representation and 31 applications for the post with sur names and first names listed and CVs attached. Copies of the document had been made and sent to some forty recipients.

The Ombudsman had requested the Commission to take a position on whether, in its view, it is good administrative practice formally to adhere to the principle of confidentiality in Senior Management recruitment procedures, while at the same time providing the confidential information to a "large number of recipients" and "numerous secretariats and staff involved". In reply, the Commission stated that its recruitment procedure for senior staff was being overhauled with a view to ensuring its conformity with Regulation 45/2001. The Commission went on to say that the proposed measures included: (i) ensuring the security of electronic mail; (ii) restricting the number of recipients to the strict minimum at every stage of the procedure in order to avoid any unwarranted dissemination of personal data; and (iii) inclusion of a confidentiality clause to the data sent or made available, which would remind the recipients of their obligations under Regulation 45/2001.

The Commission informed the Ombudsman of the outcome of its investigations into the information contained in the Times of Malta of 18 April 2005 and 11 July 2005, by forwarding to him the French original and English translation of a Note for the file dated 3 July 2006 and entitled "Reports in the Maltese press on the recruitment of a Head of Representation in Valletta (continued)" ("the Note for the file").

According to the Note for the file, three officials of DG Communication, five persons attending meetings of the selection panel and the rapporteur had access to the information "on the procedure followed". The Note for the file pointed to the fact that, while the report in the Times of Malta of 18 April 2005 mentioned that nine applicants were shortlisted for interview, in fact ten applicants were selected. According to the Note for the file, after the selection panel had held the interviews, three successful candidates and seven unsuccessful candidates were individually notified of the outcome. The Note for the file also mentions that the three shortlisted candidates were invited to attend another interview at DG Communication on 23 June 2005, and that the reminder of the procedure took place after 11 July 2005. The Note for the file concludes by stating that no objective evidence was found that would enable the Commission to identify the source of the leaked data. It points out that the candidates were informed at each stage of the procedure concerning them, so they could have conferred with each other. Moreover, the error in the press article of 18 April 2005 concerning the number of selected candidates suggests that the information circulated orally rather than in the written form.

THE DECISION

1 The first leak

1.1 On 16 January 2005, the Malta Independent on Sunday published the names of several candidates for the post of Head of Representation of the European Commission in Malta (the "Representation "). The same article could also be consulted on the website of the newspaper. In his complaint to the European Ombudsman, the complainant, who was one of the candidates for the above post but whose name did not appear in the article, alleged that the Commission breached Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data(9) ("Regulation 45/2001").

1.2 In its opinion, the Commission deeply regretted the disclosure and confirmed that the recruitment process was personal and confidential, and that the usual precautions had been taken to ensure the protection of personal data of the candidates. The Commission also pointed to the fact that the Malta Independent on Sunday of 16 January 2005 mentioned the names of two persons who did not apply for the post of Head of Representation, and added that, in its opinion, this clearly indicated the unreliability of the source of the names published. On this basis, the Commission stated that it "cannot confirm that the leak originated from the Commission."

1.3 At the outset, the Ombudsman notes that the EDPS conducted inquiries into the first leak of the personal data of the applicants for the post of Head of Representation to the Malta Independent on Sunday of 16 January 2005, and concluded that the first leak did not necessarily come from the Commission.

1.4 The Ombudsman points out that, in accordance with the first indent in part B of the Memorandum of Understanding between the European Ombudsman and the European Data Protection Supervisor of 30 November 2006(10), "[n]either authority envisages opening an inquiry if the other authority is dealing, or has dealt, with what is essentially the same complaint, unless the complainant presents significant new evidence in a case where the other authority has already concluded its inquiry. (...)".

1.5 Taking into account the above provision, the Ombudsman considers, by analogy, that it would not be appropriate for him to continue his inquiry in so far as the first leak of personal data to the Malta Independent on Sunday of 16 January 2005 as such is concerned.

2 Further leaks

2.1 In his e-mail correspondence of 19 April 2005 and his observations of 11 July 2005, the complainant made new allegations that further leaks of personal data of candidates for the post of Head of Representation to the press had occurred. In this regard, the Times of Malta of 18 April 2005 named nine candidates shortlisted for the interview, and a report in the same newspaper of 11 July 2005 gave the names of three female candidates who were allegedly shortlisted for the post.

The complainant claimed that the Commission should take appropriate disciplinary measures against the person(s) responsible for the disclosures, and assure him that such disclosures would not occur in the future.

2.2 The Ombudsman therefore requested the Commission to comment on the complainant's new allegations, and to take a stance on the complainant's claims, taking those new allegations into account.

2.3 In its further reply of 10 May 2006, the Commission stated that it had started internal investigations into the information contained in the press articles of 18 April 2005 and 11 July 2005.

The Commission also transmitted to the Ombudsman the French original and English translation of a Note for the file dated 3 July 2006 and entitled "Reports in the Maltese press on the recruitment of a Head of Representation in Valletta (continued)" ("the Note for the file"), which contained the results of the above investigations. The Note for the file mainly pointed to the fact that, while the report in the Times of Malta of 18 April 2005 mentioned that nine applicants were shortlisted for interview, in fact ten applicants were selected. This error suggests, according to the Note for the file, that the information circulated orally rather than in written form. The Note for the file also mentions that, after the selection panel held the interviews, three successful candidates and seven unsuccessful candidates were notified individually of the outcome. These three shortlisted candidates were invited to attend another interview at DG Communication on 23 June 2005. The Note for the file concludes that no objective evidence was found that would enable the Commission to identify the source of the leaked data. It points out, however, that the candidates were informed of their progress at each stage of the procedure concerning them and could thus have conferred with each other.

As regards the possibility of adopting an open procedure for high-level appointments, the Commission stated, in its further reply of 13 January 2006, that it had made transparent the entire Senior Management recruitment procedures and was in favour of any further measures enhancing procedural transparency. However, the Commission took the view that the possibility of disclosing to the public the names of participants in such procedures would not contribute meaningfully to the transparency of the procedure as such and would be likely to discourage well-suited candidates from applying.

The Ombudsman requested that the Commission provide him with lists of its staff members and/or third parties who were authorised to have access to the personal data that appeared in the press on 16 January 2005, 18 April 2005 and 11 July 2005. In its further reply of 13 January 2006, the Commission stated that an exhaustive list of persons having access to the information on which the press articles were based could not be established because of (i) the large number of recipients of the document PERS (2004) 251(11), (ii) the numerous secretariats and staff involved, and (iii) the potential number of persons with access to the electronic data in question.

In its further reply of 10 May 2006, the Commission also stated that its recruitment procedure for senior staff was being overhauled with a view to ensuring its conformity with Regulation 45/2001, and outlined that the measures proposed consist of (i) ensuring the security of electronic mail; (ii) restricting the number of recipients to the strict minimum at every stage of the procedure; and (iii) inclusion of a confidentiality clause to the data sent or made available, reminding the recipients of their obligations under Regulation 45/2001.

2.4 First, the Ombudsman notes the remark by the EDPS's Assistant Supervisor, made in his letter of 13 September 2005 to the Ombudsman concerning the first leak of 16 January 2005, that, if the newspaper report had been based on a leak from the Commission, one would not have expected the report to contain names that were not on the Commission's list , but some names could have been missing.

In this respect, the Ombudsman notes that, while the article in the Times of Malta of 18 April 2005 mentioned nine applicants shortlisted for interview, in fact ten applicants were selected according to the Commission.

Second, the Ombudsman notes that the Commission did not argue that the information, published in the Times of Malta of 11 July 2005, which gave the names of three female candidates allegedly shortlisted for the post in question, was incorrect. Moreover, Ms J. D., whose name appeared in all three press articles, was indeed appointed as Head of Representation(12).

2.5 The Ombudsman also notes the Commission's statement, made in its reply of 13 January 2006 to his further inquiries of 7 November 2005 and concerning the possibility of disclosing the names of candidates for Senior Management posts to the public. The Commission expressed the view that such disclosure would be likely to discourage well-suited candidates from participating in recruitment procedures since most of them are in positions in which disclosure of their participation could be detrimental to their current jobs.

In the Ombudsman's view, such candidates would therefore be hardly likely to inform the public about their individual candidature and/or each other of their personal progress in the procedure, as suggested in the Commission's Note for the file.

Moreover, the possibility that candidates would inform each other about their own applications would presume that the candidates could identify each other, which, however, does not appear to be foreseen in the Guidelines for Directorates General - Senior Management Selection and Appointment Procedures referred to by the Commission or in the Guidelines for Candidates on Senior Management Appointment Procedures(13).

2.6 In light of the above, it is not excluded that both the second leak, concerning the article in the Times of Malta of 18 April 2005, and the third leak, concerning the article in the same newspaper of 11 July 2005, could have come from the Commission. The Ombudsman notes, in this regard, that the second and third leaks occurred after the Commission had already been made aware of the fact that information seemed to have been leaked to the press. The Commission thus had a particular duty of care to ensure that no further leaks occurred after the first one had come to light.

2.7 According to its Note for the file, the Commission was not able to determine, in the course of its own internal investigations, the source of the leaks. In this regard, the Ombudsman points out that, reasonably, the identification of the source of the leaks was much more difficult given the indications(14) that the leaks appear to have occurred orally. Further, the Ombudsman notes that, in such a situation, the Commission could not take appropriate disciplinary measures against any members of staff who could eventually be found responsible for the disclosure, as claimed by the complainant.

2.8 Nevertheless, the question arises whether the Commission itself could have contributed to the occurrence of the leaks.

2.9 In this regard, the Ombudsman notes that the Commission was not able to answer positively to his request for lists of the Commission staff members and/or third parties who were authorised by it to have access to the personal data that appeared in each of the press articles. The Commission stated instead that an exhaustive list of persons having access to the information on which the press articles were based could not be established because of (i) the large number of recipients of the document PERS (2004) 251(15), (ii) the numerous secretariats and staff involved, and (iii) the potential number of persons with access to the electronic data in question.

2.10 The Ombudsman points out however that providing the confidential information involved to a "large number of recipients" and "numerous secretariats and staff involved", as well as the subsequent impossibility to establish the lists of persons having access to that information might have reasonably increased the possibility of leaks thereof to unauthorised recipients.

In addition, the Ombudsman notes that Article 22 (Security of processing) of Regulation 45/2001 stipulates the following:

"1. Having regard to the state of the art and the cost of their implementation, the controller shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected.

Such measures shall be taken in particular to prevent any unauthorised disclosure or access, accidental or unlawful destruction or accidental loss, or alteration, and to prevent all other unlawful forms of processing.

2. Where personal data are processed by automated means, measures shall be taken as appropriate in view of the risks in particular with the aim of:

(a) preventing any unauthorised person from gaining access to computer systems processing personal data;

(b) preventing any unauthorised reading, copying, alteration or removal of storage media;

(c) preventing any unauthorised memory inputs as well as any unauthorised disclosure, alteration or erasure of stored personal data;

(…)

(f) recording which personal data have been communicated, at what times and to whom;

(g) ensuring that it will subsequently be possible to check which personal data have been processed, at what times and by whom;

(…)".

2.11 In the present case, however, the Commission provided the confidential information to a "large number of recipients" and "numerous secretariats and staff involved", and was subsequently unable to establish the lists of its staff members and/or third parties who were authorised by it to have access to the personal data that appeared in the three press articles. The Ombudsman thus arrives at the conclusion that such a situation was not compatible with the Commission's obligations under Article 22(1) of Regulation 45/2001 and constitutes an instance of maladministration.

2.12 Moreover, the Ombudsman recalls that the complainant, in his capacity as candidate for the post of Head of Representation, considered the leaks of the candidates' names to the press as a breach of trust. In this context, the Ombudsman finds it regrettable that, in the course of the present inquiry, the Commission, despite having been twice asked to do so, did not take a position on the complainant's second claim that it should assure him that further disclosures of personal data of the candidates for the post of Head of Representation would not occur in the future.

2.13 The Ombudsman notes the Commission's statements, made in its replies to his further inquiries, that

(i) the details of the data processing in the context of the Commission's Senior Management selection procedures would be shortly submitted to the EDPS for a prior checking pursuant to Article 27 of Regulation 45/2001; and

(ii) the Commission's recruitment procedure for senior staff was being overhauled with a view to ensuring its conformity with Regulation 45/2001 and that the measures proposed consist of (a) ensuring the security of electronic mail; (b) restricting the number of recipients to the strict minimum at every stage of the procedure; and (c) the inclusion of a confidentiality clause to the data sent or made available, reminding the recipients of their obligations under Regulation 45/2001.

The Ombudsman also notes that the procedure for the appointment of Head of Representation in Malta was completed in July 2005.

For the above reasons, the Ombudsman does not consider it appropriate to propose a friendly solution or make a draft recommendation in the present case. The Ombudsman will therefore close the case with a critical remark.

3 Conclusion

On the basis of the Ombudsman's inquiries into this case, it is necessary to make the following critical remark:

In the present case, the Commission provided confidential information concerning the candidates for the post of Head of Representation in Malta to a "large number of recipients" and "numerous secretariats and staff involved", and was subsequently unable to establish the lists of its staff members and/or third parties who were authorised by it to have access to the personal data that appeared in the three press articles of 16 January 2005, 18 April 2005 and 11 July 2005 respectively. Such a situation was not compatible with the Commission's obligations under Article 22(1) of Regulation 45/2001, and constitutes an instance of maladministration.

For the reasons explained in point 2.13 above, the Ombudsman closes the case with the above critical remark.

The President of the Commission and the EDPS will be informed of this decision.

Yours sincerely,

 

P. Nikiforos DIAMANDOUROS

---

(1) Notice of vacancy COM/225/04, OJ 2004 C 252 A/07.

(2) OJ 2001 L 8, p. 1.

(3) Since 7 February 2006, this DG is known as the Directorate-General for Communication; see the Interinstitutional Style Guide, Section 9.6 (Commission directorates-general and services: official titles), which is available on the Commission's website (http://publications.europa.eu/code/en/en-390600.htm).

(4) Background Paper no 1 of July 2005, Public access to documents and data protection, p. 43 as regards candidates who have passed a competition. The Background Paper is available on the EDPS's website (http://www.edps.europa.eu/EDPSWEB/Jahia/lang/en/pid/21#BackgroundP).

(5) It appears that the version of the Guidelines referred to by the Commission was replaced by the Guidelines for Candidates on Senior Management Appointment Procedures of 8 June 2006, which can be consulted on the Commission's website (http://ec.europa.eu/civil_service/docs/guidelines_senior_mgt_en.pdf).

(6) According to Article 27(1) of Regulation 45/2001, "[p]rocessing operations likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes shall be subject to prior checking by the European Data Protection Supervisor." According to Article 27(3) of the same Regulation, "[t]he prior checks shall be carried out by the European Data Protection Supervisor following receipt of a notification from the Data Protection Officer (…)"

(7) No copy or explanation of that document was provided.

(8) As stated in the Commission's reply to the Ombudsman's further inquiries of 7 November 2005.

(9) OJ 2001 L 8, p. 1.

(10) The Memorandum of Understanding is available on the Ombudsman's website (http://www.ombudsman.europa.eu/dataprot/en/default.htm).

(11) According to the Commission's further reply of 10 May 2006, the document is an unmarked, unclassified file of its Secretariat-General dated 22 December 2004, entitled "Vacancy notice 225/2004 (DG Press and Communications)". It contains, as annexes, the relevant vacancy notice and 31 applications for the post with sur names and first names listed and CVs attached.

(12) See, for example, the Representation's website (http://ec.europa.eu/malta/who_we_are_en.htm) or the news article at MaltaMedia (http://www.maltamedia.com/cgi-bin/artman/exec/view.cgi?archive=5&num=6858).

(13) See footnote 5 above as regards these guidelines.

(14) According to the Commission's Note for the file of 3 July 2006, the error in the press article of 18 April 2005 suggests that the information circulated orally rather than in the form of documents. According to the press article of 18 April 2005, "[s]ources close to the Commission told The Times that (…) The sources said the Commission's short list is composed of (…)". According to the press article of 11 July 2005, "Commission sources said the shortlisted candidates are (…)" (emphasis added).

(15) According to the Commission's further reply of 10 May 2006, the document is an unmarked, unclassified file of its Secretariat-General dated 22 December 2004, entitled "Vacancy notice 225/2004 (DG Press and Communications)". It contains, as annexes, the relevant vacancy notice and 31 applications for the post with sur names and first names listed and CVs attached.