Made in accordance with Article 2(10) of the Statute of the European Ombudsman[1]

Background to the complaint

1. On 25 February 2023, the complainant asked Europol for public access to all documents pertaining to the following:

1. Exchanges between Europol and the US-based foundation Thorn covering the period 1 January 2021 - 24 February 2023.

2. Exchanges between Europol and the WeProtect Alliance covering the period 1 January 2021 - 24 February 2023.

3. Exchanges with the European Commission regarding online child sexual abuse/exploitation and/or the proposed CSAM Regulation covering the period 1 January 2022 - 24 February 2023.

4. Exchanges with US authorities and/or the US-based National Center for Missing and Exploited Children (NCMEC) concerning online child sexual abuse material covering the period 1 January 2022 - 24 February 2023.

2. Europol concluded that this request was complex and that its processing would entail a significant workload. It therefore contacted the complainant, on 28 February 2023, to find a ‘fair solution’. Specifically, it asked the complainant how he would prioritise the different parts of his request, and to break it down into individual requests that it could then deal with one by one.[2] It informed the complainant that the deadline for replying to his request would start to run only from the time when it “has this information”.

3. The complainant replied that Europol had not given him any information that would allow him to determine whether his request was indeed ‘complex’ or whether it concerned a large number of documents. He therefore could not accept Europol’s suggested approach. He offered, however, to shorten the time frame of his request. Europol did not reply. It subsequently informed him that it had begun processing his request.

4. On 27 March 2023, Europol informed the complainant that it was extending the 15 working-day deadline by another 15 working days. It stated that certain additional matters had made this necessary, including consultation with third party stakeholders.  

5. On 20 April 2023, Europol informed the complainant that it had identified six documents as falling within the scope of his request. It described these documents as follows: two records of meetings; one briefing note; one flowchart related to referrals in the context of child sexual abuse and exploitation; and two documents pertaining to the proposal for a child sexual abuse material regulation. Europol decided not to disclose any of these documents, on the following grounds:

“The disclosure of such information would undermine the protection of the public interest as regards public security, such as the proper fulfilment of Europol’s tasks, as it could jeopardize the trust and mutual cooperation between Europol and its partners, which is essential to Europol’s activities, consequently hindering Europol’s ability to effectively perform its tasks. The disclosure of the information, contained in the documents, could also undermine the decision-making in relation to the ongoing political, including parliamentary discourse on the legislative proposal for the proposed CSAM Regulation. No overriding public interest is identified.”[3]

6. On 2 May 2023, the complainant asked Europol to review its decision (by making a ‘confirmatory application’). The complainant argued that:

• Europol had not complied with its obligation to provide him with a proper list of the documents in question, including, at the very least, titles, dates and other information that would allow him understand the nature of the documents and their content.
• Europol had failed to consider partial disclosure of the documents.
• Europol had failed to apply the exceptions to public access by reference to each specific document and the contents thereof. Instead, it had made a blanket refusal of access to what appeared to be a purported category of documents that allegedly require systematic protection against public disclosure. It had in a much too broad manner applied, or purported to apply, the statutory exceptions.
• Europol had failed to take into account that the documents concerned related to a legislative proposal, and that Regulation 1049/2001 gives special weight to transparency in these circumstances.
• Europol had apparently not given any consideration to a possible ‘overriding public interest’. The complainant outlined in some detail why there are important public interest issues at stake.

7. The complainant also reminded Europol of its obligation to address each of his arguments individually.

8. In its confirmatory reply of 20 June 2023, Europol stated that it “finds no grounds to deviate from Europol's original assessment as expressed in the reply of 20 April 2023, which remains valid”. Europol did not provide any further reasoning or explanation of its position nor did it address the specific concerns the complainant raised in his confirmatory application.

9. The complainant then turned to the Ombudsman.

The inquiry

10. The Ombudsman opened an inquiry into Europol’s refusal to disclose the requested documents.

11. The Ombudsman inquiry team inspected copies of the documents that Europol had refused to disclose, and then met with Europol on 3 August 2023 to receive further information and explanations.

12. The Ombudsman sent the meeting report to the complainant for comments, which he provided on 28 August 2023.

The Ombudsman's assessment

Preliminary observations regarding the alleged non-existence of documents

13. In a parallel case[4] submitted by the same complainant, the Ombudsman asked Europol to re-assess a request for public access to documents that overlapped with part 2 of the four categories of documents sought in this case[5]. Also in that parallel case, Europol informed the complainant that it did not hold documents corresponding to his request. Following the Ombudsman’s opening of an inquiry into the issue, Europol carried out a new search and identified a number of documents that corresponded to that part of the request. It examined those documents and granted partial access. The matter has therefore been settled and requires no further attention in the framework of this inquiry.

14. In view of the initially insufficient search that Europol carried out in respect of part 2 of the request, the Ombudsman considers it appropriate to propose that Europol carries out a renewed and diligent search also for documents that fall within the scope of parts 1, 3 and 4 of the complainant’s request.

15. In this regard, the Ombudsman emphasises, first, that parts 1 and 4 of the complainant’s request contain several elements: The request covers not only copies of correspondence, but also copies of all documents ‘pertaining to’ such correspondence (which for instance includes preparatory or follow-up documents). Second, part 4 covers exchanges with two separate actors, namely US authorities and the organisation NCMEC.

16. As regards the scope of part 3, the Ombudsman considers that a renewed search and assessment should cover that whole part of the request, that is not only exchanges with the European Commission about the CSAM Regulation, but “all documents (...) pertaining to Europol exchanges with the European Commission regarding online child sexual abuse/exploitation...” for the stated period.

17. The Ombudsman notes that Europol is currently improving its rules, procedures and internal training for the handling of requests for public access to documents. Based on the meeting that took place in this inquiry, the Ombudsman has reason to believe that this work is already bearing fruit and can have a positive impact on ongoing cases. This case could thus be an opportunity for Europol to implement the improvements that have already been introduced, or will be introduced in the near future. To assist Europol in its efforts in that regard, the Ombudsman sets out below the issues she noted in Europol’s handling of the request at issue in this inquiry.  

The lack of a list of identified documents

18. Europol initially took the view that the complainant’s request was complex and covered a large number of documents. It therefore attempted to find a ‘fair solution’, proposing to split the complainant’s request into four separate requests and deal with them consecutively. The complainant took the view that Europol had not given him any information that would allow him to form a view on whether its proposal was appropriate.

19. When an EU body engages in an attempt to find a ‘fair solution’, it is good administration to provide the requester with a list of the documents identified as potentially falling within the scope of the request.[6] This helps the requester to narrow down the scope of the request. It also puts the requester in a position to form an opinion on whether the attempt to find a ‘fair solution’ is justified. Similarly, the production of a list of documents is a useful exercise for the institution itself, allowing it to properly identify the documents that fall within the scope of a request and to determine whether a ‘fair solution’ is necessary.

20. More generally, the Ombudsman has repeatedly stated[7] that it is a matter of good administration to provide applicants with a list of the documents identified as falling within the scope of a public access request, unless the very disclosure of the list undermines the interest(s) to be protected. In those instances where a list of identified documents cannot be provided, the institution concerned should ensure that the documents are described in such a way as to enable the applicant to understand the number and nature of the documents at stake.

21. In this case, in its initial decision Europol gave references to the identified documents in a manner that was not informative for the complainant. It referred to the documents in a very generic manner (“2 records of meetings, 1 briefing note,...”). The Ombudsman considers that documents should, at least, be listed with a title, a date and - when available - a record keeping reference number. If an institution has good ‘transparency by design’ practices, the document titles generally do not reveal confidential information and can then be rapidly produced in a list. This should have been done in this case.

The delay in activating the deadline

22. When Europol initially contacted the complainant in order to find a ‘fair solution’, it informed him that the statutory deadline in Regulation 1049/2001 would start to run only once the complainant had provided his feedback on how to proceed.[8]

23. It is not in line with Regulation 1049/2001 to postpone the activation of the deadline.[9] Only in case of requests that are not sufficiently precise may the institution concerned postpone registration of the request for the period until the requester has adequately clarified the request. The request shall then be registered, and the statutory deadline start running. From that point on, the institution may consider seeking a ‘fair solution’ to a wide or voluminous public access request.[10]

The extension of the deadline

24. Regulation 1049/2001 grants 15 working days to process a request for documents.

It provides that, in exceptional cases, for example in the event of an application relating to a very long document or to a very large number of documents, that time-limit may be extended by another 15 working days, provided that the applicant is notified in advance and that detailed reasons are given.

25. In this case, Europol informed the complainant that, “[w]hile processing your public access request, additional aspects such as ongoing consultations with stakeholders prolonged the process. Therefore, and in line with Article 3(2) of the Management Board Rules on Public Access to Europol Documents, of which you were provided a copy, an extension for up to 15 working days is necessary.”

26. However, as noted above, Europol itself concluded that it held no documents for three out of the four parts of the complainant’s request. The documents that it ultimately identified for part 3 comprised six short documents. Europol moreover consulted one third party only (the European Commission[11]), and did so through a single online meeting (there was no complicated written process).

27. These circumstances would suggest that the extension of the deadline in this case was not justified. The Ombudsman trusts that Europol’s current measure to improve its handling of public access requests will provide better guidance internally.

The application of the exceptions in Regulation 1049/2001

28. The six documents that Europol identified under part 3 of the complainant’s request relate to information and advice that Europol gave to the Commission in the preparation of its legislative proposal.

29. Europol concluded that the disclosure of such information and advice, and related internal documents, would harm Europol’s relations with the Commission and other stakeholders. It considered that this, in turn, would jeopardise its ability to perform its tasks, and that this is a matter of public security.[12]

30. Europol moreover concluded that disclosure could undermine the decision making in relation to the ongoing political (including parliamentary) discussions[13] on the legislative proposal concerned. Europol did not identify a public interest that would override the application of this exception.

31. The Ombudsman considers that Europol’s reliance on the two above-mentioned exceptions was not well-reasoned.

32. Europol’s application of the exceptions was in the form of short propositions that seem to have been based on assumptions. It did not explain why and in what way the disclosure of the specific documents concerned would actually and specifically harm its relations with third parties, nor did it in any way explain what decision-making processes could be seriously undermined, and how.

33. Specifically, as regards the Commission, the Ombudsman found that the Commission itself had already granted public access to some of its own records of meetings that it had with Europol in relation to its preparation of the legislative proposal in question.[14] This would suggest that there is little reason for concern about possible harm to relations with institutional stakeholders or the decision making related to the legislation in question.

34. In addition, Europol failed to address the arguments set out in the complainant’s confirmatory application concerning the existence of an overriding public interest in disclosure, when it comes to its reliance on the exception in Article 4(3) of Regulation 1049/2001. In particular, the complainant referred to the higher standards of transparency that apply to legislative decision-making, established by Regulation 1049/2001 and the related case-law. In its confirmatory decision, Europol should have expressly addressed these arguments - by weighing the different interests at stake - in light of the fact that the documents in question relate to a legislative process.

The proposal for a solution

The Ombudsman proposes that Europol reconsider its position on the request for public access to those documents falling within the scope of parts 1, 3 and 4 of the complainant’s request, including those that result from a new search for documents within scope, with a view to granting the widest possible access. In reconsidering its position, Europol should draw on the Ombudsman’s assessment set out above and should, in any case, provide the complainant with a list of the documents including, for each document, the date, the title and, if applicable, the record keeping reference number.

Europol is invited to inform the Ombudsman by 15 January 2024 of its follow-up on this solution proposal.

Emily O'Reilly
European Ombudsman

Strasbourg, 29/11/2023

 

[1] Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2021.253.01.0001.01.ENG&toc=OJ%3AL%3A2021%3A253%3ATOC

[2] “Considering the administrative workload required for the processing of your complex application, we would kindly ask you to indicate how you would prioritise the points in the request and break down your application in individual requests, which will be handled on a consecutive basis.” 

[3] Europol referred to a decision of its Management Board as the relevant legal basis (DECISION OF THE MANAGEMENT BOARD OF EUROPOL laying down the rules for applying Regulation 1049/2001 with regard to Europol documents - https://www.europol.europa.eu/sites/default/files/documents/decision_of_the_mb_rules_applying_reg_1049_2001.pdf).

[4] 1168/2023/PB.

[5] I.e. “[2] - all documents (including but not limited to email exchanges, minutes of meetings, powerpoint presentations, etc.) pertaining to exchanges between Europol and the WeProtect [Global] Alliance covering the period 1 January 2021-24 February 2023”)”

[6] Recommendation on the time the European Commission takes to deal with requests for public access to documents (strategic inquiry OI/2/2022/OAM), paragraph 50, available at: https://www.ombudsman.europa.eu/en/recommendation/en/167661. The Ombudsman noted that “[t]here are many benefits in engaging with requesters in an open and constructive manner as soon as a request is received. This can enable requesters to provide necessary clarifications or narrow down the scope of their request, if appropriate. Speaking directly with requesters can help determine what information they are actually interested in. Providing requesters with a list of documents at an early stage when seeking a ‘fair solution’ can also clearly improve the process for both sides.”

[7] Decision on the European Securities and Markets Authority's refusal to give public access to exchanges with the European Commission on the preparation of 'equivalence decisions' in relation to the United Kingdom (Case 1278/2022/JK), available at: https://www.ombudsman.europa.eu/en/decision/en/171366

[8] “Please note that the deadline for Europol to reply to your request shall run only from the time when Europol has this information in accordance with the abovementioned Management Board Rules.”

[9] Cf. the Ombudsman’s analysis in OI/4/2022: https://www.ombudsman.europa.eu/en/recommendation/en/170366

[10] Note in this regard judgment of the Court of Justice of 2 October 2014, Strack vs Commission, C‑127/13 P, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62013CJ012, para 26:”In the case of an application relating to a very long document or to a very large number of documents an extension of 15 working days of the time-limit laid down in Article 8(1) of that regulation is authorised in exceptional cases. Although, in such a case, Article 6(3) allows the institution concerned to find a fair solution with the applicant seeking access to documents in its possession, that solution can concern only the content or the number of documents applied for.”

[11] ‘Stakeholders’ cannot mean colleagues within the organisation, and the Ombudsman understands that Europol did not intend to refer to such internal discussions.

[12] Cf. exception in Article 4(1)(a) of Regulation 1049/2001.

[13] Cf. exception in Article 4(3) of Regulation 1049/2001.

[14]https://www.asktheeu.org/en/request/11608/response/39128/attach/3/5%20Note%20of%20DG%20HOME%20Europol%20meeting%20of%204%20March%202022.pdf?cookie_passthrough=1

and: https://www.asktheeu.org/en/request/11608/response/39128/attach/4/6%20Meeting%20with%20Europol%206%20April%202022%20REDACTED%20Final.pdf?cookie_passthrough=1

https://www.asktheeu.org/en/request/input_provided_by_dg_justice_and

The EO’s representatives sent Europol these links during the meeting.