Background to the complaint

1. In March 2022, the European Health and Digital Executive Agency (HaDEA) signed a grant agreement[1] for the implementation of the VECTOR project. The aim of the project was to develop human-centred solutions for a socially acceptable, responsible and sustainable supply of critical raw materials in Europe. The project started in June 2022 and ended in May 2025.

2. In July 2023, while the VECTOR project was still ongoing, the complainant requested public access[2] to the VECTOR grant agreement[3].  

3. In August 2023, HaDEA sent its initial reply. It refused access to the grant agreement in its entirety, arguing that disclosure would undermine the protection of personal data[4] and commercial interests of natural or legal persons and that no overriding public interest could be identified[5].

4. The complainant asked HaDEA to review its decision (by making a ‘confirmatory application’).

5. In September 2023, HaDEA replied to the complainant’s confirmatory application. After having consulted the project coordinator, it granted wide partial access to the grant agreement, maintaining that full disclosure was prevented by the need to protect personal data and commercially sensitive information.

6. Dissatisfied with this outcome, the complainant turned to the Ombudsman in July 2025.

The inquiry

7. The Ombudsman opened an inquiry into HaDEA’s refusal to grant full public access to the requested grant agreement. During the inquiry, HaDEA provided its additional views, and the inquiry team inspected the document at issue.

Arguments presented to the Ombudsman

By HaDEA

8. HaDEA claimed that full disclosure was prevented by the need to protect personal data and the commercial interests of the project consortium. It considered that there was no overriding public interest in disclosure and that the widest partial access had been granted in accordance with Article 4(6) of Regulation 1049/2001.

Personal data

9. HaDEA stated that the individuals who signed the grant agreement on behalf of the project consortium and HaDEA agreed to the disclosure of their names. It considered that the complainant did not challenge the redaction of other personal data.

Commercial interests and overriding public interest

10. HaDEA stated that the redacted information corresponds to specific aspects of the project implementation such as the staff effort per participant, the list of identified risks, the work plan, resources as well as other specific sensitive information about the work packages, the deliverables and the exploitation[6]. It noted that the exception set out in Article 4(2) first indent of Regulation 1049/2001 can be applied to business secrets and to the methods proposed for carrying out the tasks set out in the project proposal. HaDEA argued that disclosing this information would hinder the implementation of the project and reveal to competitors the consortium’s ideas, plans and strategies, which contributed to the award of the funding. This would ultimately result in unfair competition.

11. HaDEA stated that the exception protecting commercial interests of the project consortium must be read in light of Article 339 TFEU[7], which prohibits EU institutions from disclosing information covered by the obligation of professional secrecy. It considered that a general interest of the public in having access to the document or in assessing whether the relevant procedure for awarding the grant is in line with the applicable rules does not outweigh the negative and irreversible impact on the consortium’s ability to exploit successfully their work in the context of the project. HaDEA noted in this context that the EU Financial Regulation[8] already provides for the necessary legal and procedural guarantees and that transparency about the project is ensured through publication on the Commission’s CORIDS[9] platform and Financial Transparency System[10].

By the complainant

12. The complainant claimed that the redactions are unnecessary and excessive and cover publicly available information.

Personal data and necessity

13. Concerning the personal data, the complainant noted that he never specified that his request related only to the signatories of the grant agreement. Rather, his request for access to the grant agreement includes access to the names of any high-level executives and directors of research.

14. The complainant argued that the names must be disclosed, as this is necessary for a specific purpose in the public interest. The complainant noted that it is public knowledge that private mining companies and corporations are involved in the project. The public and especially NGOs should know who exactly is involved so that they can be held accountable and so that their impartiality and objectivity can be ascertained.

15. The complainant took the view that there is also no reason to assume that the data subjects’ legitimate interests might be prejudiced. He argued that if an individual or a company is benefitting from public funds, their legitimate interest should not be harmed if a limited amount of information is made public. Publication of such information does not go beyond what is necessary in a democratic society given the need to protect the EU’s financial interests and the need for public accountability over the use of EU funds. Rather, disclosure would make it possible for suspicions of partiality to be dispelled.

Commercial information

16. In his confirmatory application, the complainant considered that HaDEA’s argument that public access would give the consortium’s competitors an unfair advantage is not enough to refuse access. He argued that the commercial interest exception would not apply, as the VECTOR project is a research project and not a project with private commercial interests.

Overriding public interest

17. The complainant also considered that there is an overriding public interest in disclosure, given the large amount of EU funds involved. In his view, public access is necessary to understand the terms under which those funds have been granted. The complainant argued that, as one of the mines in the project is controversial, disclosure is also necessary to understand why a certain consortium member is receiving EU funds and whether this can be considered as formal support for the mining project that has been cancelled. He further noted that the project raises environmental concerns such as potential harm to waterways and biodiversity. In this context, the complainant alleged that one of the project beneficiaries admitted its drilling activities in a third country were causing environmental damage.

18. The complainant further contended that the fact that some information is available on CORDIS and the Financial Transparency System does not mean that there are no elements in the grant agreement that need to be made public.

The Ombudsman’s assessment

Personal data and necessity

19. The inspection of the grant agreement showed that it contains personal data in the form of the signatures of the representatives of the grant coordinator and of HaDEA, the bank details of the grant coordinator and the ‘participant identification codes[11]’ (PIC) of all participants.

20. The EU data protection rules[12] require a person seeking access to personal data to demonstrate a need in the public interest to have such access. If that need is demonstrated, the rules then require to consider the effect of access on the legitimate interests of the data subject. If the need for the specific purpose in the public interest is greater than the legitimate interest of the data subject, access can be granted.

21. In this case, the complainant stated that he never specified that he asked for access to the names of the signatories of the grant agreement only. Rather he would like access to the names of any high-level executives and directors of research. He justified his request arguing that the public should know exactly who is involved so that they can be held accountable and contended that, if companies benefit from public funds, the legitimate interests of these data subjects should not be harmed if limited information is made public.

22. However, the inspection of the requested grant agreement confirmed that it does not contain names of any high-level executives and directors of research. As for the personal data included in the document, the names of the signatories have been disclosed. In addition, the Ombudsman considers that the complainant did not establish a necessity in the public interest to have their signatures and bank account details, which are not in the public domain, disclosed as well. These redactions are therefore justified.

23. This said, the Ombudsman notes however that HaDEA redacted the PICs throughout the grant agreement. PICs, together with the names of project participants, are published and searchable on the Participant Register[13]. In accordance with EU case-law, if information is already in the public domain, access must be granted.[14] The redactions of the PICs are therefore not justified. This said, as these numbers can easily be found on the Participant Register, the Ombudsman considers that it would serve no useful purpose to make a suggestion for improvement that HaDEA disclose the PICs. However, she trusts that, in future, the PICs will no longer be redacted in similar public access requests.  

Commercial interests

24. To rely on the exception provided for in the first indent of Article 4(2) of Regulation 1049/2001, the EU body concerned must show that the requested documents contain elements the disclosure of which would undermine the commercial interests of a natural or legal person. This is the case where the document contains commercially sensitive information relating to the business strategies of the undertakings concerned, to their commercial relations and to working methods or where the document contains information particular to that undertaking which reveals its expertise.[15] The fact that information is not in the public domain, as a result of contractual agreements, is not sufficient in itself to qualify the information as commercially sensitive.[16]

25. The inspection of the grant agreement confirmed that the redacted sections contain information on the consortium’s know-how related to the project management, the project implementation, staff efforts and resources and is thus commercially sensitive.

Overriding public interest

26. However, the exception set out in the first indent of Article 4(2) of Regulation 1049/2001 must be set aside if there is an overriding public interest in disclosure. The complainant argues that there is such an overriding public interest, as the project raises environmental concerns and receives large amounts of EU funding.

27. An overriding public interest, which is capable of justifying the disclosure of a document adversely affecting the commercial interests of a legal person, must, in principle, be distinct from the general principle of transparency that is implemented via all the provisions of Regulation 1049/2001.[17] It is for the applicant seeking public access to rely on specific circumstances to show that there is an overriding public interest which justifies the disclosure of the document concerned. The applicant must demonstrate precisely that disclosure of the document would contribute specifically to ensuring the protection of that public interest to the extent that the principle of transparency prevails over the protection of the commercial interests.[18] General considerations that are linked to the protection of the environment cannot establish an overriding public interest in disclosure.[19] The General Court has also held that grant agreements form part of the award of a subsidy. Such an award procedure has already been the subject of some publicity, given that the call for proposals, the identity of the legal person receiving the grant, the nature of the subsidised project and the amount are already published. Since access to essential information concerning the procedure is guaranteed, transparency in itself cannot constitute an overriding public interest.[20] Moreover, the Financial Regulation[21] together with the regulatory framework for the Horizon Europe funding programme[22] and the grant agreement itself provide the necessary legal and procedural guarantees and controls to ensure transparency.[23]

28. In this case, the Ombudsman considers that the complainant has not established the existence of an overriding public interest to the required standards. Therefore, HaDEA’s refusal to grant full public access at the time of the confirmatory decision was not unreasonable.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following finding:

There was no maladministration.

The complainant and HaDEA will be informed of this decision.

Teresa Anjinho 
European Ombudsman 

Strasbourg, 05/11/2026 

 

[1] Grant agreement ID: 101058483; https://doi.org/10.3030/101058483

[2] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: https://eur-lex.europa.eu/eli/reg/2001/1049/oj/eng

[3] The complainant also requested access to communications with one of the companies associated with the project, but this inquiry concerned the request to the grant agreement only.

[4] Article 4(1)(b) of Regulation 1049/2001.

[5] Article 4(2) first indent of Regulation 1049/2001.

[6] Projects funded by the European Union produce a substantial number of research results. For the benefit of society, these EU funded results must be made available and used to generate further impact. The exploitation of research results focuses on the actual use of the results, that is translating the research concepts into concrete solutions that have a positive impact on the public. See: https://research-and-innovation.ec.europa.eu/strategy/dissemination-and-exploitation-research-results_en

[7] Treaty on the functioning of the European Union; https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12012E/TXT:en:PDF

[8] Regulation 2024/2509 of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union (recast); https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32024R2509

[9] The Community Research and Development Information Services (CORDIS) is the Commission’s primary source for the results of projects funded by the EU. It is a repository containing project information including factsheets, participants, reports, deliverables, and links to open-access publications. More information is available at: https://cordis.europa.eu/about

[10] The Commission’s Financial Transparency System publishes information on the beneficiaries of EU funding, such as the name and location of the beneficiary, the amount and the purpose of the fund, and the responsible funding body. More information available at: https://ec.europa.eu/budget/financial-transparency-system/about.html

[11] The ‘participant identification code’ (PIC) is a unique number used to identify participants in EU funded projects.

[12] Article 9(1)(b) of Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32018R1725. According to the rules set out in this article, EU institutions must follow a three-stage analysis in considering whether personal data can be disclosed. First, they must assess whether the applicant established a specific need for disclosure of the personal data that is in the public interest. Second, if such ‘necessity’ exists, they must assess whether disclosure might undermine the legitimate interests of the individual(s) concerned. Third, if this is the case, they must establish that, in light of the objective pursued by the applicant, disclosure would be proportionate, nevertheless.

[13] In the Participant Register on the EU Funding and Tender Portal all companies receiving EU funding are registered with an individual PIC. The public can search by company name or PIC to see in what project the company participated and how much funding the project received; https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/how-to-participate/participant-register-search?order=DESC&pageNumber=1&pageSize=50&sortBy=lastModified&isExactMatch=true&type=ORGANISATION

[14] Judgment of the Court of First Instance of 30 January 2008 in Case T-380/04, Terezakis v Commission, paragraphs 100-101; https://curia.europa.eu/juris/liste.jsf?language=en&num=T-380/04; Judgment of the Court of Justice of 3 July 2014 in Case C-350/12 P, Council v in 't Veld, paragraph 60: https://curia.europa.eu/juris/liste.jsf?num=C-350/12.

[15] Judgment of the General Court of 15 December 2021 in Case T-158/19, Breyer v European Research Executive Agency, paragraphs 83-84: https://infocuria.curia.europa.eu/tabs/document?source=document&text=&docid=251282&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=15328427  

[16] Judgment of General Court of 26 January 2022 in Case T-570/20, Kedrion SpA v European Medicines Agency, paragraphs 81-87: https://infocuria.curia.europa.eu/tabs/document/T/2020/T-0570-20-00000000RD-01-P-01/ARRET_NP/252767-FR-1-html

[17] Judgment of the General Court of 22 May 2012 in Case T-6/10, Sviluppo Globale v Commission, paragraph 86: https://infocuria.curia.europa.eu/tabs/document/T/2010/T-0006-10-00000000RD-01-P-01/ARRET_NP/122992-FR-1-html

[18] Judgment of the General Court of 19 November 2025 in Case T-623/22, SD v EMA, paragraphs 170-171: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62022TJ0623

[19] Judgment of the General Court of 25 March 2026 in Case T-359/21, ClientEarth v Commission, paragraphs 170-171: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62021TJ0359  

[20] Judgment of the General Court of 21 October 2010 in Case T-439/08, Agapiou Joséphidès, paragraphs 138-140: https://infocuria.curia.europa.eu/tabs/document?source=document&text=&docid=78734&pageIndex=0&doclang=fr&mode=lst&dir=&occ=first&part=1&cid=515436

[21] See for instance Article 38 of Regulation 2024/2509 of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L_202402509

[22] Article 39 of Regulation 2021/695 of the European Parliament and of the Council establishing Horizon Europe – the framework Programme for Research and Innovation, laying down its rules for participation and dissemination; https://eur-lex.europa.eu/eli/reg/2021/695/oj/eng; and Article 19 of the Grant agreement.

[23] See also Judgment of the General Court of 15 December 2021 in Case T-158/19, Breyer v REA, para 192 ff; https://infocuria.curia.europa.eu/tabs/document?source=document&text=&docid=251282&pageIndex=0&doclang=FR&mode=lst&dir=&occ=first&part=1&cid=394088.