Background to the complaint

1. When people who seek asylum arrive in the EU, Member States are required to provide them with ‘reception conditions’. These include food, clothing, accommodation, as well as access to healthcare and to education for minors. In line with the 1951 Geneva Convention,[1] reception conditions play a crucial role in ensuring that refugees have access to dignified living conditions.

2. In recent years, the deteriorating reception conditions in migration facilities located in the Greek Eastern Aegean islands have been criticised.[2] The European Union Agency for Asylum (EUAA) is present in these facilities and assist the Greek authorities in providing reception conditions in line with EU asylum legislation.

3. In February 2025, the complainant requested from the EUAA[3] to have access to documents related to reception conditions for unaccompanied and separated minors in migration facilities in the Greek islands of Kos, Lesbos, Samos, Leros and Chios during the months of December 2024 and January 2025.

4. In March 2025, the EUAA identified 53 documents as falling within the scope of the complainant’s request, the vast majority of which were reports drafted by EUAA staff members deployed to work with the national authorities in the reception centres. Other documents were, according to the EUAA, minutes of meetings.

5. Having consulted the national authorities, the EUAA granted wide partial access to the requested documents. It redacted parts of the documents containing specific information provided by national authorities, including statistical figures, while disclosing the context to which these figures related. In doing so, the EUAA invoked several exceptions to public access to documents, based on the protection of the privacy and integrity of individuals[4] and the decision-making process,[5] as well as the public interest as regards public security.[6]

6. The complainant asked the EUAA to reconsider its decision by making a ‘confirmatory application’. The complainant challenged the extent of the applied redactions in the disclosed documents.

7. Having consulted the national authorities anew, in June 2025, the EUAA upheld its initial decision.

8. Dissatisfied with the EUAA’s final decision, the complainant turned to the Ombudsman.

The inquiry

9. The Ombudsman opened an inquiry into the EUAA’s decision to give only partial access to the requested documents.

10. During the inquiry, the Ombudsman inquiry team inspected the unredacted versions of the requested documents, as well as documents relating to the consultations of the national authorities on the complainant’s access request.

11. Moreover, the Ombudsman inquiry team held a meeting with EUAA representatives to discuss the redactions applied in the disclosed documents.

Arguments presented to the Ombudsman

Privacy and integrity of individuals

12. The EUAA argued that the requested documents contain names, professional profiles, and contact details of individuals, that needed to be redacted. In the EUAA’s view, given the small number of individuals working on certain positions within the EUAA, it was also necessary to redact certain contextual information because specific information contained in the reports could make their authors identifiable. The same considerations related to the redaction of the specific locations and the timeframe to which the reports related.

13. The EUAA also argued that it needed to redact the details of individual cases of applicants for asylum staying in specific facilities.

14. The complainant argued that some redactions of personal data, such as the numbers of unaccompanied minors, were excessive. The complainant also argued that such data is routinely made public by other EU institutions and national authorities.

15. During the meeting with the Ombudsman inquiry team, the EUAA representatives clarified that some redacted information, including statistical figures, might seemingly concern groups of individuals staying in specific facilities rather than specific individuals, thereby not constituting personal data at first sight. However, this information may in fact allow for the identification of specific individuals in combination with other contextual information, for instance by disclosing that individuals staying during a specific timeframe in a specific location suffered from a specific health condition. In the EUAA’s view, the combination of this information (time, location, health issue) significantly narrows down the number of individuals concerned.

16. Moreover, according to the EUAA representatives, disclosing certain information, including statistical information, about the population of these centres might contribute to spreading negative stereotypes about them, for example concerning their health. Therefore, the EUAA redacted some information to protect the integrity of relevant individuals. At the same time, the EUAA took the view that it left enough contextual information unredacted to allow the readers to obtain more general information, such as that there have been some (unspecified) health issues occurring in the facilities.

17. In addition, the EUAA representatives pointed out that the statistical information contained in the requested documents is more detailed, as it is related to a precise location and timeframe, and thus not comparable to the aggregated information usually published by international bodies.

Public security

18. The EUAA argued that the requested documents contain detailed information on its operational activities and its daily collaboration with national authorities. The redacted information includes statistical information, such as capacity or occupancy data, population analyses or numbers of cases managed in each location, but this information may contain inaccuracies because it has been shared by the national authorities with the EUAA on a preliminary basis and confidentially in the context of day-to-day operations. The EUAA therefore consulted the Greek authorities on disclosure of some of the requested documents. The EUAA considered that disclosure would compromise the mutual trust between the EUAA and the national authorities, thereby undermining the functioning of the Common European Asylum System and, in turn, public security.

19. The complainant considered the EUAA’s arguments too broad and insufficiently specific.

20. During the meeting with the Ombudsman inquiry team, the EUAA representatives clarified that the EUAA does not disclose statistical information about the reception centres that has not been officially verified and published by national authorities, to protect the latter’s trust towards the EUAA. This is because this trust has been built up with great effort and the EUAA must prevent any impediments to data exchanges between itself and national authorities, as such exchanges are critical to the fieldwork of its deployed staff. To this end, the EUAA systematically compares the information contained in requested documents with the information published by national authorities and applies redactions accordingly. The EUAA representatives moreover confirmed that they are in regular contact with the national authorities to ensure that the widest possible access is given. In addition, the EUAA redacted information about ongoing national projects, as the EUAA is not responsible for the information about these projects.

Decision-making process

21. The EUAA argued that the documents contain individual opinions, observations, and suggestions made by staff members of the EUAA who are deployed to work with the national authorities in the reception facilities. These comments are intended for internal use within the EUAA. Their disclosure would result in the risk of self-censorship in the future, especially where the authors of specific comments may be identifiable based on the substance of their comments, which would in turn impede the EUAA’s normal operations.

22. At the same time, the EUAA pointed out that it had already disclosed to the complainant parts of the requested documents containing a variety of factual information about the situation in specific locations, and even listed the categories of disclosed factual information in its confirmatory decision to emphasise its commitment to transparency.

23. The complainant argued that the EUAA’s application of redactions to protect its decision-making processes was too broad, disregarded the fact that many operations have already been completed, and obstructed public oversight of EU-funded activities.

Overriding public interest in disclosure

24. The complainant argued that there is an overriding public interest in the disclosure of the requested documents, as the documents concern the treatment of minors, whereas the EUAA failed to conduct a meaningful analysis in this regard.

25. The EUAA acknowledged the existence of a public interest in issues related to the situation of unaccompanied minors in reception facilities. However, it also argued that it had already provided the complainant with wide partial access to the information in this regard, thereby demonstrating its commitment in terms of upholding transparency. The EUAA emphasised that it had performed an individual assessment of each document and had applied redactions only where necessary. It considered that the complainant had not put forward a sufficiently substantiated argument as to what would constitute the public interest in disclosure overriding the concerns put forward by the EUAA.

The Ombudsman's assessment

26. When an EU institution is asked to disclose a document, it must conduct an individual assessment of whether the document is covered by one or several exceptions to the right of public access to documents.[7] Exceptions to public access must be applied as strictly as possible,[8] and only to those (parts of the) documents covered by it.[9] When refusing access, EU institutions must explain how disclosure of the relevant document could specifically and actually undermine the interest protected by the exception on which they are relying.[10] Finally, when applying the exceptions under Article 4(2) and (3) of Regulation 1049/2001, the institutions must weigh up the public interest in disclosure with the competing interest they are seeking to protect.

27. Based on the inspection of documents, the Ombudsman found that the EUAA performed in this case a thorough individual assessment of the requested documents, with the result of granting wide public access, thereby giving effect to her solution proposals made in the context of previous inquiries.[11]

Privacy and integrity of individuals

28. The concept of ‘personal data’^[12] is very broad and covers any information related to an identified or identifiable person. The information does not need to directly identify a person; it can also do so indirectly. According to EU case-law,^[13] “[t]he use by the EU legislature of the word ‘indirectly’ suggests that, in order to treat information as personal data, it is not necessary that that information alone allows the [individual concerned] to be identified.” Rather, it is sufficient if that information, in combination with other information from the same or from different sources, allows for the identification of the individual in question. In addition, it is not necessary that the public at large can deduce the individual’s identity on that basis. It is enough if one person, for example, someone working in the same field as the individual in question and familiar with their professional background, can identify them.^[14]

29. Based on the inspection of the relevant documents, the Ombudsman notes that, in this case, the EUAA redacted not only personal data which directly identifies a person, but also contextual information from which the identity of a person, such as the authors of the requested documents or individual asylum seekers, could be inferred. The Ombudsman accepts that it was reasonable for the EUAA to take into account the limited number of its staff deployed to work in specific facilities, making them easily identifiable. The Ombudsman also accepts that, in this specific context, it was not unreasonable for the EUAA to consider that the limited size of certain groups of asylum seekers in combination with other contextual information might make specific individuals identifiable.

30. Any disclosure of personal data must fulfil the conditions set out in the EU legislation on data protection (Regulation 2018/1725[15]). According to these rules, EU institutions must follow a three-stage analysis in considering whether personal data can be disclosed.^[16] First, they must assess whether the applicant established a specific need for disclosure of the personal data that is in the public interest. Second, if such ‘necessity’ exists, they must assess whether disclosure might undermine the legitimate interests of the individual(s) concerned. Third, if this is the case, they must establish that, in light of the objective pursued by the applicant, disclosure would be proportionate, nevertheless.

31. The Ombudsman notes that the complainant put forward the need to assess the situation of minors in the relevant facilities and to hold the relevant authorities to account. However, even if the complainant demonstrated a necessity for the transfer of personal data for a purpose in the public interest, the Ombudsman acknowledges that, in the specific context in which the EUAA documents contain sensitive information about the personal situation of particularly vulnerable individuals staying in the reception facilities, the EUAA rightly considered that the personal data’s disclosure could undermine the legitimate interests of the data subjects. In this context, it was not unreasonable for the EUAA to consider that it would be disproportionate, even in light of the objective pursued by the applicant, to disclose information that might make specific individuals identifiable and hence undermine the legitimate interests of the data subjects.

32. That said, some specific redactions applied by the EUAA in this case concerning larger groups seem excessive. The Ombudsman reminds the EUAA that it should not use the exception concerning the privacy and integrity of individuals to redact generic information relating to certain groups and populations, which does not relate to individuals and cannot affect their privacy and integrity. The EUAA should apply the redaction of personal data restrictively and consistently.

Public security

33. EU institutions and agencies enjoy a wide margin of discretion when determining whether disclosing a document would undermine the protection of the public interests listed in Article 4(1)(a) of Regulation 1049/2001, which includes public security.[17] As such, the role of the Ombudsman is limited to assessing if there was a manifest error in the EUAA’s assessment in that regard.

34. The inspection of documents showed that they contain, in some parts, information relating to the operational activities in specific facilities. The EUAA argued that the national authorities shared this information with the EUAA on a confidential basis, that this information was not officially published by them and may contain inaccuracies. Therefore, in the EUAA’s view, the disclosure of this information would undermine the trust of the national authorities towards the EUAA and, consequently, undermine the operation of the Common European Asylum System and public security. Although the EUAA consulted the national authorities on the disclosure of some requested documents, it explained that the above considerations apply to all the requested documents, given their contents.

35. The Ombudsman considers that, as a matter of principle, the EUAA should consult the national authorities concerned prior to disclosing any documents containing information provided by these authorities, particularly where they might object to their disclosure. The Ombudsman trusts that the EUAA will do so in the future.

36. The Ombudsman also understands that the EUAA is conscious about protecting mutual trust with Greece. The Ombudsman has however in the past rejected general references to the need to protect mutual trust between EU bodies and Member States as a reason to justify the refusal of public access,[18] referring to the duty of sincere cooperation[19] and related case law[20].

37. In this case, the requested documents contain information shared by the Greek authorities, as part of their day-to-day activities, on a confidential basis with the EUAA staff deployed to work with these authorities in the challenging context of managing  reception facilities. The safety of vulnerable individuals staying in these facilities depends on the good cooperation between the EUAA and the Greek authorities. The Ombudsman notes that the daily work of the EUAA deployed staff largely depends on the trust of the national authorities and the level of information-sharing in which they are willing to engage. She also bears in mind the wide margin of discretion that EU bodies have when determining whether disclosing a document would undermine the protection of the public interest as regards public security. In view of this, the Ombudsman did not identify a manifest error in the EUAA’s assessment in this respect.

38. That said, while the Ombudsman understands that the information contained in the requested documents of the EUAA is more detailed, she also notes that similar statistical data is made public by non-governmental organisations, international organisations and by national authorities themselves.[21] In this context, the Ombudsman encourages the EUAA to consider, in the context of future requests for public access, the possibility to disclose statistical information and, if needed, to engage further with the national authorities about this issue.

Decision-making process

39. In accordance with EU case law, to refuse public access to documents based on the need to protect an ongoing or closed decision-making process, EU institutions and bodies must demonstrate that disclosure is likely to concretely, effectively and seriously undermine these processes.[22] With regard to closed decision-making processes, EU institutions and bodies may only protect “opinions for internal use as part of deliberations and preliminary consultations within the institution concerned”.[23]

40. The Ombudsman understands that the EUAA sought to protect the freedom of its staff deployed to work with national authorities to share their comments (that is, “opinions for internal use”) with the EUAA openly, including subjective comments and those containing preliminary, non-validated information. However, based on the inspection of documents, the Ombudsman is not convinced that all information redacted on this ground may be sensitive, as some opinions and suggestions appear to be generic in nature. Furthermore, the EUAA did not always consistently redact the same type of information.

41. Given that the EUAA has already granted wide public access to the requested documents, and that the redactions at issue are limited, the Ombudsman considers that pursuing this matter further would not be justified. She considers, however, that, in future cases, the EUAA should carefully review whether access to such generic information could be granted. The Ombudsman will make a corresponding suggestion for improvement below.

Overriding public interest

42. When EU institutions consider that disclosing a document would undermine their decision-making processes, they must balance the protection of that particular interest against the public interest in the document being made accessible.

43. The EUAA acknowledged the existence of a public interest in issues related to the situation of unaccompanied minors in the context of migration and reception conditions. However, the EUAA also considered that the complainant did not sufficiently substantiate the overriding nature of the public interest at stake, especially in the context in which the EUAA performed a thorough individual assessment of each requested document and redacted specific information only where necessary.

44. The Ombudsman acknowledges that the EUAA has granted wide public access to the requested documents, including a variety of factual information about the conditions in the reception centres, thereby giving effect to the heightened need for transparency in this area.

45. Nonetheless, the Ombudsman does not exclude that, in other cases, concerns about fundamental rights conditions in reception centres might give indeed rise to an overriding public interest in transparency.[24] The Ombudsman will continue monitoring this issue in the context of future complaints.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

The Ombudsman was not convinced that further access to some parts of the documents could not be granted. However, given the limited scope of these redactions, and the overall wide partial access granted, the Ombudsman considered that no further inquiries into this complaint are justified.

The Ombudsman trusts that, in the future, the EUAA will apply the exceptions to public access in relation to similar documents restrictively and consistently. She will continue to monitor this issue in the context of future complaints.

Suggestion for improvement

The EUAA should, in future public access requests, consider granting wider access to generic and non-sensitive comments made by its deployed staff in relation to the national reception facilities in which they work.

The complainant and the EUAA will be informed of this decision.

Teresa Anjinho
European Ombudsman

Strasbourg, 25/06/2026

 

[1] Convention relating to the Status of Refugees, available at: https://www.ohchr.org/en/instruments-mechanisms/instruments/convention-relating-status-refugees

[2] See for instance the 2021 report of the Greek National Commission for Human Rights, available at: https://ennhri.org/wp-content/uploads/2021/07/Greek-National-Report.pdf

[3] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: http://data.europa.eu/eli/reg/2001/1049/oj

[4] Article 4(1)(b) of Regulation 1049/2001.

[5] Article 4(3) of Regulation 1049/2001.

[6] Article 4(1)(a), first indent of Regulation 1049/2001.

[7] Judgement of 1 July 2018, Sweden and Turco v Council, Joined Cases C-39/05 and C-52/05 P, paragraph 33, available at: https://curia.europa.eu/juris/liste.jsf?num=C-39/05&language=en

[8] Judgement of 1 February 2007, Sison v Council, Case C-266/05 P, paragraph 63, available at: https://curia.europa.eu/juris/liste.jsf?language=en&num=C-266/05%20P

[9] Sweden and Turco v Council, Joined Cases C-39/05 and C-52/05 P, cited above, paragraphs 33 and 38.

[10] Judgment of 7 February 2018, Access Info Europe v European Commission, Case T-851/16, paragraph 37, available at: https://juris.curia.europa.eu/juris/document/document.jsf?text=&docid=199184&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=5324184.

[11] Proposal for a solution on the European Union Agency for Asylum’s (EUAA) refusal to give public access to documents related to reception conditions in several Cypriot migration management facilities (case 724/2024/AML), available at: https://www.ombudsman.europa.eu/en/solution/en/199728; Proposal for a solution on how the European Union Agency for Asylum dealt with a request for public access to documents related to reception conditions in several Greek migration management facilities (case 687/2024/AML), available at: https://www.ombudsman.europa.eu/en/solution/en/195012.

[12] Article 3(1) of Regulation 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (…), OJ L 295/39, https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng. .

[13] See Judgment of the Court of 7 March 2024, OC v Commission, C-479/22 P, paragraphs 46f.: https://curia.europa.eu/juris/document/document.jsf?text=&docid=283526&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=26709.

[14] Ibid, paragraph 60.

[15] Cited above.

[16] Article 9(1)(b) of Regulation 2018/1725.

[17] Judgment of 1 February 2007, Sison v Council, C‑266/05 P, paragraph 64, available at: https://curia.europa.eu/juris/liste.jsf?language=en&num=C-266/05.

[18] See, for example, Recommendation on the refusal by the European Border and Coast Guard Agency (Frontex) to give public access to two opinions by its Fundamental Rights Officer (case 1497/2024/ACB), paragraphs 32-33: https://www.ombudsman.europa.eu/en/recommendation/en/199964.

[19] The EU Treaties establish this duty of sincere cooperation between the EU institutions and the Member States in Article 4(3) TEU.

[20] Judgment of 14 September 2022, Pollinis France v Commission, T‑371/20 and T‑554/20, paragraphs 111-112, available at: https://curia.europa.eu/juris/liste.jsf?num=T-371/20&language=en.

[21] See for instance daily updated statistics about occupation and capacity of island migration management facilities or monthly updated data about unaccompanied minors here: https://migration.gov.gr/en/statistika/

[22] See Judgment of 22 March 2018, De Capitani v Parliament, T-540/15, para. 64, available at: https://curia.europa.eu/juris/liste.jsf?num=T-540/15; Judgement of 21 July 2011, Sweden v MyTravel and Commission, C-506/08 P, paras 80-82, available at: https://curia.europa.eu/juris/liste.jsf?language=en&num=C-506/08%20P 

[23] Article 4(3) second subparagraph of Regulation 1049/2001.

[24] See in this regard, Proposal for a solution in Case 724/2024/AML, available here: https://www.ombudsman.europa.eu/en/solution/en/199728, paragraphs 37-42.