The background to the complaint

1. The complainant, who works for a Czech association for the protection of small and medium-sized companies, complained that the Commission had failed to disclose the names of staff who worked on a State aid investigation. The investigation concerned the privatisation of a Czech company, OKD a.s.

2. When it received the request for disclosure, the Commission informed the complainant of the unit that had handled the investigation in DG Competition. It also disclosed the name of the Head of that unit, but not the names of other officials involved in the investigation.

3. The complainant then requested the names of other persons involved in the case. He stated that disclosing the names of these officials would allow him to identify possible undue influence by lobbyists in the process leading to the adoption of the State aid decision. The complainant stated that the association he represents seeks to ensure that the competition rules, including State aid rules, are properly applied.

4. The Commission replied that no document containing the list of persons having worked on the case, existed, and that the names could not be disclosed for data protection reasons.  

5. The complainant then turned to the European Ombudsman and challenged the Commission's refusal to inform him of the names of all the officials who had handled the case.

The inquiry

6. The Ombudsman identified the following allegation:

The Commission wrongly refused to inform the complainant of the names of the officials who had dealt with the State aid case in question.

7. In the course of the inquiry, the Ombudsman received a reply from the Commission and comments from the complainant on the Commission's reply. Subsequently, the Commission sent an opinion and the complainant sent his observations on that opinion.

The Commission also provided a further opinion, on which the complainant did not make any observations.

In conducting the inquiry, the Ombudsman has taken into account the arguments and opinions put forward by the parties.

8. Moreover, the Ombudsman consulted the European Data Protection Supervisor (EDPS) in accordance with the Memorandum of Understanding between the European Ombudsman and the EDPS. The EDPS submitted an opinion which was based on the summary of the case provided by the Ombudsman. The Ombudsman has taken this opinion of the EDPS into account.[1]

Allegation that the Commission wrongly refused to disclose the names of the officials concerned

9. It is useful first to set out the opinion of the EDPS.

The opinion of the European Data Protection Supervisor

10. The EDPS stated that the names of EU officials are personal data within the meaning of Regulation 45/2001 on Data Protection. He took the view that in the case of a request such as the one at hand the institution concerned needs to follow a 3-stage analysis, under Article 8 of the Regulation. First, it has to examine whether the complainant has sufficiently demonstrated the necessity of the transfer of the personal data to him. If this is the case, the institution has to establish whether the legitimate interests of the "data subjects" could be undermined by the transfer (the data subjects in this case are the officials of DG Competition). Finally, as a third step, the institution has to carry out a balancing exercise between the interests of the person seeking access to the personal data and the legitimate interests of the data subjects (DG Competition officials).

11. As regards the first step of the test (the need to show that the transfer of the personal data was necessary), the EDPS stated that the burden of proof lies with the applicant, who has to provide "express and legitimate justifications" for obtaining the names of the officials.[2] The EDPS then referred to situations in which an applicant might be able to demonstrate the necessity for reasons closely related to the general interest of transparency. This could, for example, be the case when a journalist asks for access to some information in order to instigate or contribute to a debate of public interest. 

12. In this case, the EDPS took the view that it was not clear why the identification of the unit in charge of the case and of the Head of unit was not sufficient to establish the integrity of the procedure followed by the Commission and to reach a conclusion on the issue of whether there was undue influence from lobbyists. It was further not clear how exactly the requested personal data of individual case handlers could contribute to the achievement of the complainant's aims since, in particular, given their hierarchical status, the case handlers' influence on the formal procedure followed by the Commission would seem limited. In addition, it should be examined whether there was any objective evidence supporting the suspicion of undue influence of lobbyists, or whether there was simply some general suspicion. The burden of proof requires the complainant to demonstrate the necessity. A mere conjecture would be insufficient. Overall, the EDPS took the view, on the basis of the Ombudsman's summary of the facts, that the necessity test did not seem to be satisfied at the time he was consulted by the Ombudsman.

13. As regards the second step of the test (harm to legitimate interest), the EDPS pointed out that State aid was a particularly sensitivity area of law. Therefore, there could be legitimate interests of the individual case handlers that required protection, despite their professional status as public employees. The EDPS also stated that one must take account of the data subjects' right to information (Article 11 of the Data Protection Regulation) and the right to object (Article 18 of the Data Protection Regulation). The individual case handlers should therefore be asked in advance of disclosure whether there was a specific reason to require non-disclosure showing a concrete objective, not hypothetical, risk that a protected interest might be affected, e.g. relating to a likely action by the applicant against them.

14. As regards the third step of the test (balancing exercise), the EDPS pointed out that it can be carried out only when the complainant has demonstrated the necessity of the data transfer. The various interests of the parties concerned need to be weighed up. In doing so the institution concerned needs to take into account the following key principles: the principle of proportionality, the principle of the right to information as well as the right of the data subject to know.  

Arguments presented to the Ombudsman

15. The complainant considered that the identity of the officials who dealt with the State aid case should be made public in order to allow the public to be satisfied that there had been no undue lobbying in the process leading to the adoption of the State aid decision. This was necessary, he stated, because the Commission decision to close the State aid investigation made no sense. He argued, in particular, that the Commission had closed its State aid investigation although  criminal proceedings had been initiated in the Czech Republic regarding the award of the State aid. He added that Czech media reports seemed to suggest that lobbyists had influenced the Czech State’s award of the aid. The complainant then stated that, without knowing the names of the officials who had worked on the State aid case, it was not possible to exclude the possibilitythat the Commisison could have been unduly influenced by lobbyists. 

16. As regards the necessity test to be carried out under Article 8 of the Data Protection Regulation, the complainant argued that the Commission could have been unduly influenced by lobbyists.  In his view, the Commission's assessment of the State aid case was obviously flawed. This could only have happened, he argued, if its officials were incompetent or if the Commission was  influenced by lobbyists.  The complainant submitted, in particular:

• The Commission based its conclusions on an expert opinion submitted by the Czech government. Yet, criminal proceedings had been brought against the expert in question in the Czech Republic.
• The expert did not assess significant parts of the company's assets and property. This property included the largest  residential property portfolio in Central Europe.
•  The purchaser of the State's share in the privatised company published its own evaluation of the company's value shortly after the privatisation. According to this assessment, the State's share, which had been sold for approximately 151 000 000 EUR, was now worth 370 000 000 EUR.
• The complainant pointed to the relationship between the Director General of DG Competition and a former Czech Commissioner who became a lobbyist in Brussels for the purchaser of OKD. The Director General previously worked in the Commissioner's cabinet. The complainant thus considered that the Director General, or some officials, might have been influenced by lobbyists.

18. As regards the harm test to be carried out under Article 8 of the Data Protection Regulation, the complainant submitted that neither he nor the association that he represented intended to attack the Commission's officials concerned either unlawfully or unethically. However, this did not exclude the possibility that the complainant might initiate procedures to sanction the officials involved for any actions which were not in accordance with the applicable rules.  The request for the names would not interfere with the officials' private or family life.

19. The Commission maintained its refusal to disclose the identity of the officials concerned.

20. It first stated that there was no document listing the names of all the officials who worked on the case. It stated that the composition of a team involved in a case is registered electronically in the Commission's case management system. This however includes only officials from DG Competition but not officials consulted in other services, for instance the Legal Service.

21. The Commission then pointed out that it had already informed the complainant of the identity of the unit having dealt with the case and of the name of the Head of that unit. As regards the other team members, the Data Protection Regulation opposes disclosure. By nature, personal data, including names, are considered as sensitive in the EU legal order. This is supported by the inclusion of specific provisions protecting personal data in the Treaty on the Functioning of the European Union (Article 16), the EU Charter of Fundamental Rights (Article 8) and specific legislation (the Data Protection Regulation and Directive 95/46). The Transparency Regulation 1049/2001 also includes a specific provision concerning the protection of personal data (Article 4(1)(b)).

22. The Commission then noted that under Article 8 of the Data Protection Regulation, personal data can be provided only if the recipient demonstrates the necessity of the data transfer and if there is no reason to think that legitimate interests of the data subject could be harmed. 

23. As regards the necessity test, the Commission referred to the ruling in the Bavarian Lager case. According to the ruling, the applicant has to establish that there is an "express and legitimate justification or any convincing argument in order to demonstrate the necessity for those personal data to be transferred".[3] In the Commission's view, the complainant had failed to provide any convincing arguments why the disclosure should be necessary. 

24. The Commission said that DG Competition applies high ethical standards with the intention, amongst other things, of ensuring that decisions are not taken on the basis of any undue influence or of a conflict of interest. It further pointed out that the cases the DG treats are complex. Moreover, the members of case teams preparing draft Commission decisions on State aid cases are subject to the rules on independence and conflict of interest set out in the Staff Regulations for EU officials. The draft decisions prepared by the case teams in DG Competition are subject to review by DG Competition's hierarchy as well as by other services of the Commission. At the end, the decisions are adopted by the College of Commissioners as a whole and not by officials from DG Competition. This system of extensive checks and balances offers sufficient protection against the risk of inappropriate lobbying and conflicts of interest. Moreover, Commission decisions may be challenged in Court.

25. According to the Commission, the fact that the complainant was not satisfied with the outcome of the investigation in the State aid case does not, by itself, suggest that there was anyundue influence at play or that the case was mishandled. An unsubstantiated, very general statement, claiming that the Commission might have mishandled a state aid case, and an insinuation that there might have been undue influence from lobbyists, without any more specific indications in that regard, did not meet the standard of a legitimate justification or a convincing argument required by the Bavarian Lager ruling.

26. The Commission failed to understand the link made between the previous function of the Director General of Competition in the cabinet of a previous Commissioner of Czech nationality, whose term of office had been of limited duration, and the alleged need to obtain the names of the officials that had dealt with the State aid case.

27. As regards the issue of a potential harm to the legitimate interests of the officials concerned, the Commission submitted that not disclosing the names of its officials working on certain projects or investigations is a measure which helps preserve their independence and security, by making it more difficult for external stakeholders to contact them directly, and thereby influence them or, possibly, to threaten them.

28. The Commission provided an example of another State aid case involving a football club where the supporters of that club allegedly harassed the official on social networks. A Member State official in the same case received actual threats. Therefore, there were reasons for the Commission to assume that disclosing such personal information to the public at large might prejudice the legitimate interests of case handlers.

The Ombudsman's assessment

29. The issue is whether the test under Article 8 of the Data Protection Regulation is fulfilled so that the data requested should be disclosed. The Ombudsman has reached the view that the test is not fulfilled in this case.

30. The Ombudsman first remarks that the names of officials cannot be considered as particularly sensitive or private. In the second place, it must be noted that objective, independent and impartial decision-making is one of the cornerstones on which the EU administration is based. In  this context it is important that lobbying is transparent. At a time when the legitimacy of the EU administration is being questioned, increased transparency is one of the keys to winning citizens' trust. Against that background the EU administration should not set too high a treshold for considering that the test under Article 8 of the Data Protection Regulation is fulfilled in cases like this one. The test must be applied reasonably so as to allow interested persons, including journalists, representatives of associations or interest groups, and members of the public at large to satisfy themselves as to the integrity of a particular decision and to be enabled to contribute to uncovering excessive or inappropriate lobbying. When applying Article 8 of the Data Protection Regulation, the Commission should, in the Ombudsman’s view, have an open mind as to what the citizen reasonably considers necessary.

32. The Ombudsman notes also the Commission’s very understandable concern to protect its staff from being exposed to undue pressure. On the other hand, the Ombudsman considers that single unfortunate instances should not be taken to mean that, in general, names of officials cannot be disclosed.

33. Notwithstanding the above, the Ombudsman finds, on balance, that it is understandable that the Commission refused to disclose the names of the officials in the present case. Article 8 of the Data Protection Regulation has been enacted by the Union legislature and the tests it establishes must be construed in a manner which gives the provision proper effect. If the mere assertion that a decision is wrong would suffice to make the administration liable to disclose the names of the officials who participated in that decision, this would be tantamount to depriving the necessity test under Article 8 of meaning.

34. In the present case there is no doubt that the complainant considers the State aid decision at issue to have been wrong. However, it seems to be a matter of speculation when the complainant asserts that the decision was the result either of incompetence or of excessive or inappropriate lobbying. The Ombudsman holds that mere speculation does not fulfill the necessity test under Article 8 of the Data Protection Regulation. Moreover, it is very difficult to see that the factual circumstances alleged by the complainant bear any relation to the necessity test under Article 8. Accordingly, the Ombudsman finds that in this case the complainant has not, as required under Article 8 of the Data Protection Regulation, established “the necessity of having the data transferred”. Given this finding, it is not necessary to take a position on whether or not, or to what extent, disclosure of the personal data (names) of the officials involved would prejudice their legitimate interests. 

35.Against this background the Ombudsman finds that the inquiry has not disclosed maladministration on the part of the Commission. The Ombudsman, however, emphasises that the Commission should not apply Article 8 of the Data Protection Regulation in a restrictive manner when names of officials are at issue.

Conclusion

On the basis of the inquiry into this complaint, the Ombudsman closes it with the following conclusion:

The Ombudsman finds no maladministration by the Commission.

The complainant and the Commission will be informed of this decision.

Strasbourg, 19/12/2016

Emily O'Reilly

European Ombudsman

 

[1] The EDPS was consulted at the same point of time as the Ombudsman invited the Commission to submit an opinion on the complaint. Therefore, the EDPS did not have at his disposal the Commission's opinion and the complainant's observations on that opinion.

[2] Cf. Case C-28/08 Commission v Bavarian Lager, paragraph 78.

[3] Case C-28/08 Commission v. Bavarian Lager, paragraph 78.