Background to the complaint

1. In August 2018, the complainant submitted to EPSO a request for public access to about 23 000 letters by which EPSO informed the candidates of two selection procedures about their test results. The complainant wished to use the information contained in these letters to analyse whether the language choices of candidates influenced how well they performed in the tests.

2. EPSO refused access based on the need to protect the personal data of candidates. It also argued that releasing redacted copies of the requested documents would entail an excessive administrative burden and that the non-redacted information would be of no substantial value to the complainant.

3. In September 2018, the complainant made a confirmatory application to the Commission. She also complained about the fact that EPSO had provided her only with the total number of identified documents per competition (instead of the number per dataset^[1]).

4. The European Commission maintained EPSO’s decision refusing access, invoking also the exception for the protection of decision-making processes and referring to the secrecy of selection board proceedings.

5. Dissatisfied with the Commission’s reply, the complainant turned to the Ombudsman in December 2018.

The inquiry

6. The Ombudsman opened an inquiry into the complaint to determine whether the Commission had been right to refuse public access to the requested documents.

7. In the course of the inquiry, the Ombudsman’s inquiry team met with relevant representatives of the Commission and EPSO to obtain further clarifications on their view. The Ombudsman then provided the complainant with a report on this meeting and, subsequently, received the complainant’s comments.

Arguments presented to the Ombudsman

8. The Commission and EPSO stated that, besides names and candidate numbers, they consider also the candidates’ language choices and test scores to constitute personal data as, in certain circumstances, this data may enable third parties to identify indirectly the data subjects concerned. Regarding the transfer of the personal data contained in the documents, they stated that the complainant has to establish a necessity of transferring the data to her, which she had not.

9. In addition, they argued that EPSO has no means to redact automatically the personal data contained in the requested documents. However, even if the redaction could be done automatically, a subsequent manual check would be required to ensure that the personal data has been redacted properly. Given the amount of documents requested (23 000), redacting these documents would therefore, in any event, pose an excessive administrative burden.

10. EPSO also argued that its standard search tools do not allow for filtering documents according to parameters, such as candidates’ language choices. It is therefore not possible to provide the complainant with the number of letters identified per language, as sought in the access request (see footnote 1).

11. Regarding the possibility of offering a fair solution, that is, a compromise in cases that concern a very large number of documents^[2], the Commission and EPSO took the view that a limited number of letters (and therefore limited data samples) would not be of use to the complainant.

12. The complainant contested the view that candidates’ language choices and test scores constitute personal data. She argued that, for her analysis, she needed to know one of the two languages chosen by candidates and that it would be impossible to identify a candidate based on this limited information. The complainant agreed, however, that an identification might be possible in cases where only ten or less candidates have chosen the same language as their first language.

13. The complainant also argued that the necessary redactions could be made automatically. Redacting the documents would therefore not entail an excessive administrative burden. In the complainant’s view, this is also true for possible manual checks that are carried out subsequent to the automatic redaction, as they would not require an assessment of the data.

14. Regarding the required necessity, the complainant said that she intended to analyse the candidates’ test results to reassure the public that EPSO competitions are non-discriminatory and objective.

The Ombudsman's assessment

15. The requested documents contain personal data, such as the candidates’ names and how they performed in the tests.

16. EU law requires that a person seeking access to the personal data of third parties must demonstrate the necessity of transferring that data to him or to her. Even if such a necessity exists, the data can only be transferred if the transfer respects the legitimate interests of the data subjects, and is proportionate.

17. As regards whether the complainant has justified why she should be given access to the un-redacted letters, in her complaint to the Ombudsman the complainant stated that she wanted to analyse the letters in question to verify that all candidates in an EPSO competition have equal chances of success, independent of their language choices. It is unclear how the provision of the letters in question would allow the complainant to draw such conclusions. In any event, it would not be proportionate to make public un-redacted letters which would show how each candidate performed in the tests. Thus, the Ombudsman does not agree that the provision of the un-redacted letters would be compatible with EU law on data protection.

18. As regards whether it is possible to redact the letters to render them anonymous, the Ombudsman has confirmed that EPSO does not have the automated means to redact the names of candidates. However, even if an automated means were found to redact the names, the Ombudsman takes the view that a manual check of the redacted documents would still be required, prior to their disclosure, to ensure that the redactions were done properly^[3]. This would have to be done for each of the 23 000 letters and would entail an excessive administrative burden. EU case law recognises that requests for public access to documents can be refused if complying with them would impose an excessive administrative burden.

19. As regards whether a fair solution is possible, the Ombudsman has confirmed that it is not possible, by means of the available standard search tools, to extract from the database the number of candidates that have chosen specific languages as their first language, and the relative success rates of these candidates. The Ombudsman has also confirmed that it would not be useful to disclose only a limited number of the requested letters, as to do so would be of no use to the complainant given her stated aims (which are to compare the success rates of candidates using different languages). There is thus no fair solution that the Commission could have proposed to the complainant.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

There has been no maladministration by the Commission.

The complainant and the Commission will be informed of this decision.

 

Fergal Ó Regan

Coordination of Public Interest Inquiries - Unit 2

Strasbourg, 03/06/2019

 

[1] For each competition, the number of letters per the candidates’ first language choice and whether or not the respective candidate obtained the pass mark. There are 24 official EU languages, so that there are 48 datasets per competition.

[2] In accordance with Article 6(3) of Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32001R1049&from=EN.

[3] Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32018R1725&from=EN.