Made in accordance with Article 2(10) of the Statute of the European Ombudsman[1]

Background to the complaint

1. In 2017, the European Union Agency for Asylum (EUAA)^[2] started conducting social media monitoring (SMM). The purpose of these SMM activities was to draft reports on shifts in migration routes, offers made by smugglers and discourse on social media regarding key related issues such as the EU’s asylum system.^[3] In 2018, the European Data Protection Supervisor (EDPS) was formally consulted on these social media monitoring reports. The EDPS noted that SMM amounts to processing of personal data that can undermine individuals’ ability to exercise control over their personal data and thus requires strong safeguards.^[4] The EDPS concluded that the EUAA’s mandate did not include an explicit legal basis for such processing activities and imposed a temporary ban on the EUAA’s SMM activities in 2019.

2. Following this ban, in 2020, the Commission consulted the EDPS on the possibility that the European Border and Coast Guard Agency (Frontex) could develop a SMM capacity in accordance with its extended mandate.[5] It was suggested that Frontex would add SMM to its existing surveillance tools and establish a link with the European Union Agency for Law Enforcement Cooperation (Europol) which coordinates criminal investigations. Europol’s ‘EU Internet Referral Unit’ (EU IRU) has been investigating malicious content on the internet and in social media since 2015.[6] In 2019, Frontex and Europol also signed a Joint Action Plan[7] providing for a structured exchange of information between the two agencies.

3. In 2021, in its Communication on ‘a renewed EU action plan against migrant smuggling (2021-2025)’[8], the Commission noted that SMM is “necessary for the continuous development of a clear, real time picture of migrant smuggling dynamics”. It allows for the collection and analysis of information from social media on the activities of criminal networks and general developments in partner countries. [9] The Commission considered that “Frontex should deploy its monitoring capabilities in social media to improve risk analysis regarding future irregular migratory movements whilst taking into account data protection considerations”.[10] The Commission further considered that Europol’s IRU should provide support in disrupting these migrant smuggling networks.[11]

4. Frontex, like all European institutions, bodies, offices and agencies, has to comply with the EU rules on the processing of personal data.[12] To this end, Frontex adopted in December 2021 two Management Board (MB) Decisions (68/2021[13] and 69/2021[14]) on processing personal data. In June 2022, the EDPS, in its supervisory capacity, issued two negative opinions concerning these two MB Decisions.[15] It considered that these MB Decisions had several shortcomings, in particular concerning the legal basis for processing special categories of personal data.[16] The EDPS recalled that any activity by Frontex in relation to the “prevention, detection and investigation of criminal offences is [...] secondary and should be carried out primarily as a form of support to Europol, Eurojust and Member States’ competent authorities”.[17] In October 2022, the EDPS also conducted a data protection audit of Frontex.[18] To implement the EDPS’s findings in its opinions and audit, Frontex started redrafting MB Decisions 68/2021 and 69/2021 and in the meantime suspended the related SMM project.

5. In September 2022, the complainant asked for public access to documents[19] concerning SMM for the period from 1 January 2021 to 27 September 2022. In particular, the complainant requested access to (i) meeting minutes and correspondence between Frontex and Europol, and (ii) Frontex’s internal documents concerning SMM. In its initial reply, Frontex identified five documents concerning the first aspect of the complainant’s request but stated that it did not hold any documents concerning the second aspect. It refused access to the five documents it identified in their entirety, arguing that their disclosure would undermine the protection of the public interest as regards international relations[20] and public security[21], and would seriously undermine an ongoing decision-making process[22].

6. The complainant asked Frontex to review its decision (by making a ‘confirmatory application’), arguing that Frontex’s reliance on the exceptions set out in Article 4 of the EU legislation on access to documents (Regulation 1049/2001) was excessive, disproportionate and contrary to the spirit and the letter of the regulation and the applicable case-law. The complainant considered that Frontex failed to disclose even basic information about the documents. The complainant did not object to the redaction of personal data. However, the complainant deemed it “highly improbable” that there were no internal documents falling within the scope of the second element of the request and asked Frontex to conduct another search.

7. In its confirmatory decision, Frontex identified 50 additional documents as falling within the scope of the complainant’s request. It granted partial access to 32 of these documents and refused access to the remaining 23 documents (including the five documents it had identified at the initial stage) in their entirety. In doing so, Frontex argued that full or wider disclosure would undermine the protection of the public interest as regards public security and international relations, the protection of legal advice[23], the purpose of an ongoing investigation[24] and an ongoing decision-making process.

8. Dissatisfied with how Frontex handled their request, the complainant turned to the Ombudsman on 17 February 2023.

The inquiry

9. The Ombudsman opened an inquiry into how Frontex handled the complainant’s request for public access to documents.

10. In the course of the inquiry, the Ombudsman inquiry team inspected the documents at issue and reviewed the additional views[25] that Frontex had provided. The Ombudsman inquiry team also met with the relevant representatives of Frontex with a view to obtaining clarifications on how Frontex had handled the complainant’s public access request. The Ombudsman then shared with the complainant Frontex’s additional views, the report on the meeting[26] and Frontex’s written reply[27] to the questions the Ombudsman had set out in her meeting request. The complainant provided comments.

11. Based on the information provided by the complainant and Frontex throughout the inquiry, the Ombudsman makes the below proposal for a solution.

Arguments presented to the Ombudsman

By Frontex

12. Frontex argued that (full) disclosure of the requested documents was prevented by the need to protect the public interest as regards public security and international relations, an ongoing decision-making process, the purpose of investigations and legal advice. Frontex considered that there was no overriding public interest in disclosure and contended that granting partial access to the 23 documents that were not disclosed in their entirety was not possible due to the heavy administrative burden that the redactions would entail.

13. In the meeting with the Ombudsman inquiry team, Frontex provided further confidential explanations on how these exceptions apply specifically to some of the documents at issue.

Public security and international relations (Article 4(1)(a) Regulation 1049/2001)

14. Frontex said that disclosure of some of the documents or parts of those documents would undermine the public interest as regards public security. It stated that, in accordance with EU case-law[28], it enjoys wide discretion for the purpose of determining whether disclosure would undermine the protected interest. The relevant documents or parts thereof contain information on the number and profiles of officers deployed, on the operational areas and on the reporting tools and methods used by law enforcement officials. Disclosing such information would be tantamount to revealing the weaknesses and strengths of Frontex’s operations and risking their effectiveness thereby hampering ongoing and similar future operations. Furthermore, it would provide criminal networks with intelligence enabling them to change their modus operandi and thus ultimately defeating the operations’ purpose, which is to counter and prevent cross-border crime.

15. Frontex further contended that disclosure of certain documents or parts thereof would also undermine the public interest as regards international relations. It said that cooperation with third countries on a variety of levels is crucial for the security of the EU’s external borders. While the documents at issue are exchanges between Frontex and Europol, they refer to positions of the EU concerning certain third countries. Disclosure would affect the cooperation between Frontex, other EU entities, Member States and these third countries. Frontex added that international relations are of a delicate nature and it is difficult to restore trust once it has been jeopardised.

Decision-making process (Article 4(3) Regulation 1049/2001)

16. Frontex further argued that disclosure of certain documents or parts thereof would undermine the internal decision-making process regarding an ongoing investigation. It would deprive Frontex and other stakeholders of their ‘space to think’ thereby jeopardising the negotiations between Frontex and Europol. Disclosure would also have a bearing on negotiations with other entities and on the outcome of the ongoing EDPS investigation.

17. In this regard, Frontex clarified that the two MB Decisions establish the legal framework for its personal data processing activities. As such, they would determine what form the SMM activities would take. Frontex said that, following the EDPS’s negative opinions and its audit of Frontex’s collection and processing of personal data, it redrafted the two MB Decisions. Due to this redrafting, the related SMM project was put on hold. However, the decision-making process is still ongoing. Frontex said that disclosure could significantly undermine the redrafting as it would seriously interfere with its ‘space to think’. Frontex explained that this particular decision-making process was very sensitive and subject to intense interest. Frontex was concerned that disclosure would lead to undue influence on the various actors involved in the drafting of the new MB Decisions.

Purpose of investigations (Article 4(2), third indent, Regulation 1049/2001)

18. Frontex said that it refused access to certain documents or parts thereof based on the need to protect the purpose of an ongoing investigation in conjunction with the need to protect public security and its ongoing internal decision-making process. Frontex explained that the EDPS procedures and other investigations, that is, the EDPS’s supervisory opinions and the EDPS audit, were still ongoing. Frontex said that it has to implement the EDPS’s recommendations as part of its ongoing decision-making process.

Legal advice (Article 4(2), second indent, Regulation 1049/2001)

19. Frontex said that the disclosure of one document and a part of one other document would undermine its ability to receive frank, objective and comprehensive legal advice, as the “sphere of trust”, in which this advice is provided, would be severely impaired. Disclosure would thus affect the future work of its ‘Legal and Procurement Unit’ and of other entities engaged in the drafting. Frontex said that it built on the “wide notion” of legal advice as established by the Court of Justice of the EU. It considered that even if much of the information that is contained in the requested documents is publicly available, compiling all of this information can be considered legal advice as it is the product of an intellectual endeavour.

Overriding public interest

20. In its additional views, Frontex stated that where an absolute exception applies, the examination of a relative exception can “take the back seat”, as an overriding public interest cannot exist. That said, Frontex considered the arguments put forward by the complainant to be too general. It also noted that the process at issue was not a legislative one and that the supervision and scrutiny of Frontex’s work is entrusted to EU institutions, such as the Commission and the EDPS.

Partial access

21. Frontex said that it always assesses each document individually. The decisive factor, in determining whether partial access is possible, is the number of elements that have to be redacted in each document and the information that is then left. Frontex argued that, for some of the documents, all of the exceptions applied to all parts of the documents. Frontex said that it balanced all interests and concluded that the administrative burden of redacting the parts that may not be disclosed was particularly heavy and exceeded the limits of what may reasonably be expected. Given the special circumstances of the case and the sensitivity of the requested material, Frontex considered that disclosure of highly fragmented parts of the requested documents would not be in line with the principle of partial access.

By the complainant

22. The complainant found it regrettable that Frontex provided more detailed explanations for the refused public access only during the Ombudsman’s inquiry.

23. The complainant argued that Frontex applied the exceptions set out in Regulation 1049/2001 too broadly, in particular given that the documents concern Frontex’s plans for developing social media monitoring rather than its ongoing operational activities. The complainant also argued that Frontex did not substantiate how disclosure of the documents would undermine the protection of the public interest as regards public security and international relations. Based on the additional explanations, the complainant maintained that the cited EU case-law[29] cannot readily be applied to the documents at issue. Furthermore, detailed information pertaining to Frontex’s operational activities is available in the EDPS’s audit report, which is public to a large extent. The complainant also argued that Frontex wrongly applied the international relations exception to its exchanges with Europol, as this exception applies to exchanges with third countries only.

24. The complainant further argued that the mere fact that the SMM concept note is a draft document is not sufficient to invoke the exception for the protection of an ongoing decision-making process. Given that a new concept note will have to comply with the redrafted MB Decisions, disclosure was even less likely to seriously undermine Frontex’s decision-making process.

25. As regards the protection of the purpose of the investigations, the complainant noted that the EDPS disclosed its audit findings almost completely despite the fact that the investigation was still ongoing.

26. The complainant also claimed that Frontex failed to respond to their arguments that there is an overriding public interest in disclosure and to their concerns in relation to the possible non-compliance of its SMM plans with EU data protection law. They considered that they raised specific and credible concerns about the potential unlawfulness of Frontex’s SMM plans. Frontex incorrectly implied that the question of lawfulness of Frontex’s SMM activities is merely of individual concern. Granting public access to the documents concerned would allow public scrutiny by experts, civil society, journalists and Members of the European Parliament. In particular, the complainant noted that the contested MB Decisions were adopted following a highly irregular process: “it is precisely this putative ‘space to think’ that allowed senior Frontex management to script MB Decisions that were subsequently found to be in violation of EU law and are now having to be redrafted”. Public scrutiny of such an irregular process cannot constitute ‘undue influence’.

27. In their confirmatory application, the complainant also took issue with Frontex’s argument that redacting parts of five documents would constitute a disproportionate administrative burden.

The Ombudsman’s assessment

28. The Ombudsman’s observations on the application of the exceptions under Regulation 1049/2001 as invoked by Frontex for the documents in question are set out below.[30]

Public security and international relations (Article 4(1)(a) Regulation 1049/2001)

29. While Frontex enjoys a wide margin of discretion when determining whether disclosing a document would undermine the protection of the public interest as regards public security and international relations, it is still required to demonstrate a ‘specific and actual risk’ that is reasonably foreseeable and not purely hypothetical.[31]

30. Frontex argued that full disclosure of the documents or parts thereof, combined with other publicly available information, would undermine the protection of the public interest as regards public security by enabling criminal organisations to change their modus operandi, thereby interfering with Frontex’s border management activities.

31. The Ombudsman notes that, while the General Court accepted this argument in Izuzquiza and Semsrott vs Frontex, this was in relation to the position of patrol vessels. The inspection of the documents at issue in this case showed, however, that some of the information contained therein is of a general nature and in some cases already publicly available[32]. It is thus not readily clear how disclosure of parts of the documents could actually and specifically undermine that protected interest. The SMM concept note[33], for instance, also contains information on legal requirements to be taken into account and organisational considerations in broad terms.

32. The Ombudsman does not take issue with Frontex’s application of the public security exception in relation to four documents (security alerts)[34].

33. However for these four documents, Frontex also argued that disclosure would undermine the public interest as regards international relations. It contended that the relevant documents contain the position of the EU concerning certain third countries. The inspection of the documents showed that, while third countries are mentioned in them, in particular in the context of illegal border crossings, it is not clear how disclosure would undermine international relations. The same applies in relation to a fifth document[35] that Frontex invoked the international relations exception for. The Ombudsman thus considers that Frontex applied this exception too broadly.

Decision-making process (Article 4(3) Regulation 1049/2001)

34. To refuse public access, Frontex has to show that disclosure would seriously undermine its decision-making process. The mere fact that the decision-making is still ongoing[36], or the fact that the deliberations are of a preliminary nature[37] are not sufficient. Rather, Frontex must show, with tangible evidence, that access is likely to concretely and effectively bring serious harm to the decision-making process in a reasonably foreseeable and non-hypothetical way.[38]

35. Frontex argued that the decision-making process at issue (namely, the redrafting of the two MB Decisions and the SMM project) was very sensitive and that it was the subject of intense media interest and attempts to unduly influence the procedure.

36. While targeted external pressure may constitute a legitimate ground for refusing access to a document, the reality of such external pressure must be established with certainty and it must be demonstrated that the decision to be taken would be substantially affected owing to that external pressure.[39] The existence of media coverage alone cannot be sufficient to constitute targeted external pressure capable of seriously undermining a decision-making process.[40] The Ombudsman is also not convinced by the additional explanations that Frontex provided during the meeting. In this context, she recalls that the legitimacy of the decision-making process is enhanced by ensuring greater openness in that process so that citizens can understand how and for what reasons the administration takes its decisions, even in circumstances where options are discussed internally and subsequently rejected. Furthermore, such “openness also creates incentives to prepare decisions particularly carefully and thoroughly in order to avoid subsequent criticism”.[41] EU institutions and agencies should, in general, be aware that their work can at any point be subject to public scrutiny and should think of transparency as the default approach.[42]

37. In sum, the Ombudsman takes the view that Frontex has not put forward any tangible elements that would show that disclosure of the requested documents or parts thereof[43] would seriously undermine its decision-making process in relation to either the SMM project, or the redrafting of the MB Decisions.

38. Frontex has, in the meantime, redrafted and adopted the two MB Decisions.[44] Undue influence on their redrafting can no longer be considered a risk. Even though the decision-making process regarding the SMM project is still ongoing, as Frontex said itself during the meeting, the concrete content of the SMM concept note would probably not be as relevant any more as it will have to be redrafted to comply with the finalised MB Decisions. The Ombudsman considers that Frontex should take these changed circumstances into account when replying to this solution proposal.

Purpose of investigations (Article 4(2), third indent, Regulation 1049/2001)

39. Frontex argued that disclosure of some of the documents or parts thereof was prevented by the ongoing EDPS procedures, that is, the EDPS’s supervisory opinions on the MB Decisions and the EDPS’s data protection audit of Frontex.

40. The Ombudsman notes that the documents at issue were not themselves subject to the EDPS’s supervisory opinions or audit. It is not readily clear how their disclosure[45] would have undermined the purpose of the EDPS’s investigation. The Ombudsman thus considers that Frontex had not put forward convincing arguments that disclosure, at the time of the confirmatory decision, would have endangered the EDPS’s supervisory opinions or audit.

41. In any case, the EDPS’s investigations are now completed. Frontex should take these circumstances into account.

Legal advice (Article 4(2), second indent, Regulation 1049/2001)

42. Frontex refused to grant access to (parts of) two documents[46] because their disclosure would undermine the protection of legal advice. Frontex added that it relied on the “wide notion” of legal advice as established by the case law.

43. The assessment to determine whether public access to a document can be refused to protect legal advice has to be carried out in three stages.[47] First, it must be determined that the document does indeed relate to legal advice and, if so, which parts of the documents are actually concerned. Then, it must be examined whether disclosure would undermine Frontex’s interest in seeking and receiving frank, objective and comprehensive legal advice. The risk of that interest being undermined must be reasonably foreseeable and not purely hypothetical. As a last step, it must be assessed whether there is an overriding interest that would justify disclosure. Thus, to qualify as legal advice, it is not sufficient that the advice is the result of ‘intellectual endeavours’.

44. The inspection revealed that one of the two documents in question contains two answers, a long version and a short version, to a written question from a Member of European Parliament. In accordance with the Rules of Procedure of the European Parliament[48], such answers will always be published and, indeed, the short version of the answer contained in the non-disclosed document is publicly available in its entirety. In this context, the Ombudsman notes that, if information is already in the public domain[49], access to the document must be granted.[50] Furthermore, comparing the two versions of the answer, the Ombudsman notes that there are only minimal additions in the long version that are not already public. It is not readily clear how the disclosure of these minimal additions would undermine Frontex’s interest in seeking and receiving frank, objective and comprehensive legal advice. The additional confidential explanations that Frontex provided during the meeting have not provided any further clarity.

45. Concerning the second document for which Frontex invoked this exception, the one sentence in question is a factual statement. Again, it is not clear how its disclosure would risk undermining Frontex’s interest in seeking and receiving frank, objective and comprehensive legal advice.

Overriding public interest

46. The inspection of the documents at issue showed that not all documents are covered in their entirety by an absolute exception. Frontex therefore must examine ex officio if the remaining parts of the documents are covered by a relative exception and, if this is the case, whether there is an overriding public interest that would justify their disclosure.

47. As noted in paragraphs 37, 40, 44 and 45 above, the Ombudsman considers that Frontex has not sufficiently substantiated that all documents at issue or parts thereof are covered by the relative exceptions invoked. Thus, strictly speaking, while it is not necessary to assess whether there is an overriding public interest in disclosure, the Ombudsman does not agree with Frontex’s view that the complainant’s arguments are too general and cannot constitute a public interest. Concerns as to whether an EU body complies with EU law are not a purely private concern but a public one. Furthermore, the Ombudsman is not convinced that the information contained in the documents at issue continues to be so sensitive that the interest in its protection would outweigh the specific public interest put forward by the complainant. On the contrary, the level of public scrutiny, in addition to the EDPS’s concerns in relation to the lawfulness of Frontex’s personal data processing activities, shows the importance of transparency on the topic of SMM by Frontex.[51] This is particularly the case given that the concerns relate to the protection of personal data, which is a fundamental right.[52]

Partial access

48. When an EU agency is asked to disclose a document under Regulation 1049/2001, it is required to satisfy itself that the requested document is indeed covered by the exception to public access it invokes.[53] If so, the EU agency must decide which parts of the document are actually concerned and may, therefore, be covered by that exception. Under Article 4(6) of Regulation 1049/2001, partial access should be granted to the parts of a document that are not covered by any of the exceptions under the Regulation.

49. Frontex considered that the administrative burden of redacting the parts that may not be disclosed was particularly heavy and that disclosure of highly fragmented parts of the requested documents would not be in line with the principle of partial access.

50. According to EU case-law, EU institutions and agencies can, in exceptional cases, refuse to grant partial access if the administrative burden of blanking out the parts covered by the exceptions would be excessive^[54] or if the remaining parts of the documents would be meaningless^[55]. Where an institution seeks to rely on a claim of proportionality to limit the exercise of a fundamental right^[56], this must be clearly demonstrated. In terms of meaningful partial access, EU case-law also clarifies that it is not for the institution or agency to determine what is or is not useful for the applicant.^[57]

51. The inspection of the documents showed that they are not covered in their entirety by one (or more) of the exceptions set out under Article 4 of Regulation 1049/2001. Partial access is therefore possible and should be the rule. The Ombudsman considers that Frontex has not substantiated why this case is exceptional and how the administrative burden of redacting those parts of the documents that are not covered by any exception would be excessive. The Ombudsman does not agree with Frontex’s view that access to limited parts would be meaningless. The complainant has clearly stated that they would like at least partial access to the requested documents.

52. In light of the above assessment, the Ombudsman considers that the documents identified under the access request at issue are, to a large extent, not covered by one of the exceptions invoked by Frontex in its confirmatory decision. Therefore, the Ombudsman proposes that Frontex review its position on the request with a view to granting wider partial access to the documents concerned.

53. In line with her recent recommendation in case 1129/2023/OAM[58], the Ombudsman also proposes that, when reviewing its position, Frontex should provide a list of documents it identified as falling within the scope of the complainant’s request, unless the very disclosure of the list undermines the interest(s) to be protected in this case.

The proposal for a solution

Based on the above findings and, given the passage of time, the Ombudsman proposes that (a) Frontex review its position on the request with a view to granting wider partial access to the documents at issue and (b) provides a list of documents it identified as falling within the scope of the complainant’s request.

Frontex is invited to inform the Ombudsman by 1 July 2024 of any action it has taken in relation to the above solution proposal.

Emily O'Reilly

European Ombudsman

Strasbourg, 30/04/2024

 

[1] Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2021.253.01.0001.01.ENG&toc=OJ%3AL%3A2021%3A253%3ATOC

[2] At that time, the EUAA was called the European Asylum Support Office (EASO).

[3] See: https://edps.europa.eu/sites/default/files/publication/19-11-12_reply_easo_ssm_final_reply_en.pdf.

[4] Ibid.

[5] See: https://edps.europa.eu/system/files_en?file=2023-01/2022-0977_002_redacted.pdf.

[6] See: https://www.europol.europa.eu/about-europol/european-counter-terrorism-centre-ectc/eu-internet-referal-unit-eu-iru.

[7] Available at: https://prd.frontex.europa.eu/wp-content/themes/template/templates/cards/1/dialog.php?card-post-id=2722&document-post-id=9828; https://www.europarl.europa.eu/cmsdata/186840/1-Joint-Europol-Frontex-Action-Plan-2019-original.pdf.

[8] Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52021DC0591.

[9] Ibid.

[10] Ibid.

[11] Ibid.

[12] See Article 86 of Regulation 2019/1896 on the European Border and Coast Guard and repealing Regulations 1052/2013 and 2016/1624; available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019R1896

[13] Available at: https://prd.frontex.europa.eu/document/management-board-decision-68-2021-adopting-the-rules-on-processing-personal-data-by-the-agency/.

[14] Available at: https://prd.frontex.europa.eu/document/management-board-decision-69-2021-adopting-the-rules-on-processing-operational-personal-data-by-the-agency/.

[15] Available at: https://edps.europa.eu/system/files/2022-06/2022-06-07-supervisory-opinion_on_the_rules_on_processing_personal_data_by_frontex_en.pdf; and at: https://edps.europa.eu/system/files/2022-06/2022-06-07-supervisory-opinion-on_the_rules_of_processing_operational_personal_data_by_frontex_en.pdf.

[16] See: Point 6 of https://edps.europa.eu/system/files/2022-06/2022-06-07-supervisory-opinion_on_the_rules_on_processing_personal_data_by_frontex_en.pdf.

[17] See hearing at the Committee on Civil Liberties, Justice and Home Affairs (LIBE) of 8 November 2022; available at: https://edps.europa.eu/system/files/2022-11/22-11-08_libe-frontex-pedra_en.pdf.

[18] Available at: https://edps.europa.eu/system/files/2023-05/edps_-_23-05-24_audit_report_frontex_executive_summary_en.pdf.

[19] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32001R1049.

[20] Article 4(1)(a), third indent Regulation 1049/2001.

[21] Article 4(1)(a), first indent Regulation 1049/2001.

[22] Article 4(3) Regulation 1049/2001.

[23] Article 4(2), second indent Regulation 1049/2001.

[24] Article 4(2), third indent Regulation 1049/2001.

[25] Available at: https://www.ombudsman.europa.eu/doc/correspondence/184405.

[26] Available at: https://www.ombudsman.europa.eu/doc/inspection-report/184407.

[27] Available at: https://www.ombudsman.europa.eu/doc/correspondence/184406.

[28] Judgment of the General Court of 27 November 2019, Izuzquiza and Semsrott vs Frontex, T-31/18: https://curia.europa.eu/juris/liste.jsf?num=T-31/18.

[29] See footnote 28.

[30] The use of examples is not exhaustive and it is for Frontex to take account of the Ombudsman’s assessment as regards all of the documents at issue or parts thereof.

[31] Izuzquiza and Semsrott vs Frontex, paragraphs 65-66.

[32] Such as information on Europol’s IRU as published by Europol itself, in the consultation of the EDPS, and in the Commission’s Communication on a renewed EU action plan against migrant smuggling. See, for instance, document 1 identified at confirmatory stage - partially disclosed.

[33] Documents 4 and 18 identified at confirmatory stage - not disclosed.

[34] See: documents 2, 3, 4 and 5 identified at the initial stage - not disclosed.

[35] Document 6 identified at confirmatory stage - not disclosed.

[36] Judgment of the Court of Justice of 13 July 2017, Saint-Gobain Glass Deutschland v Commission, C-60/15 P, paragraph 82: https://curia.europa.eu/juris/liste.jsf?num=C-60/15&language=EN. 

[37] Judgment of the General Court of 9 September 2014, MasterCard and Others v Commission, T-516/11, paragraph 67: https://curia.europa.eu/juris/liste.jsf?num=T-516/11&language=EN.

[38] Judgment of the General Court of 7 June 2011, Toland v Parliament, T-471/08, paragraphs 71 and 78: https://curia.europa.eu/juris/liste.jsf?language=en&num=T-471/08.

[39] MasterCard and Others v Commission, paragraph 71.

[40] Toland v Parliament, T-471/08, paragraph 80.

[41] Opinion of Advocate General Kokott of 3 March 2011, Sweden v MyTravel and Commission, C‑506/08 P, paragraph 51: https://curia.europa.eu/juris/document/document.jsf?text=&docid=84222&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=2304636. 

[42] See paragraph 19 of the Ombudsman Decision in case 1995/2022/OAM on the European Data Protection Supervisor's (EDPS) refusal to give full public access to documents concerning the drafting of its implementing provisions on promotion; available at: https://www.ombudsman.europa.eu/en/decision/en/164214.

[43] By way of example, see: document 1 identified at the initial stage - not disclosed; documents 3, 16, 20, and 21 identified at the confirmatory stage - partially disclosed and documents 4, 5, 7, 11 and 18 identified at the confirmatory stage - not disclosed.

[44] Management Board Decision 4/2024 adopting the general rules on the application of the data protection regulation by the Agency, available at: https://prd.frontex.europa.eu/document/management-board-decision-4-2024-adopting-the-general-rules-on-the-application-of-the-data-protection-regulation-by-the-agency/ and Management Board Decision 5/2024 on adopting the rules on processing operational personal data by the Agency, available at: https://prd.frontex.europa.eu/document/management-board-decision-5-2024-on-adopting-the-rules-on-processing-operational-personal-data-by-the-agency/. 

[45] By way of example, see: documents 2, 4, 5, 7, 8 and 18 identified at the confirmatory stage - not disclosed.

[46] Document 8 identified at the confirmatory stage - not disclosed and document 14 identified at the confirmatory stage - not disclosed.

[47] Judgment of the Court of Justice of 1 July 2008, Sweden & Turco v Council, C-39/05 P and C-52/05 P, paragraphs 37-45: https://curia.europa.eu/juris/liste.jsf?num=C-39/05&language=en.

[48] See Rule 138; available here: https://www.europarl.europa.eu/doceo/document/lastrules/RULE-138_EN.html.

[49] Available at https://www.europarl.europa.eu/doceo/document/E-9-2022-002825_EN.html.

[50] Judgment of the Court of First Instance of 30 January 2008, Terezakis v Commission, T-380/04, paragraphs 100-101: https://curia.europa.eu/juris/liste.jsf?language=en&num=T-380/04; Judgment of the Court of Justice of 3 July 2014, Council v in 't Veld, C-350/12 P, paragraph 60: https://curia.europa.eu/juris/liste.jsf?num=C-350/12.

[51] In ClientEarth and PAN Europe v EFSA, the Court of Justice held that the transfer of personal data was necessary to verify doubts about the impartiality of a group of experts. These doubts were not considered to be general and abstract as they were substantiated with a study conducted by an NGO. By analogy, such an overriding public interest a fortiori exists based on the EDPS’s concerns regarding the data protection compliance of Frontex. See: Judgment of the Court of 16 July 2015, ClientEarth and PAN Europe v EFSA, C‑615/13 P, paragraphs 57-60: https://curia.europa.eu/juris/liste.jsf?language=en&num=C-615/13%20P.  

[52] Judgment of the General Court of 4 May 2012, In’t Veld v Council, T-529/09, paragraphs 90-93: https://curia.europa.eu/juris/liste.jsf?num=T-529/09&language=EN.

[53] Sweden & Turco v Council, paragraph 38. 

[54] Judgment of the Court of First Instance of 7 February 2002, Kuijer v Council, T-211/00, paragraph 57: https://curia.europa.eu/juris/liste.jsf?language=en&num=T-211/00.

[55] Judgment of the General Court of 20 March 2014, Reagens v Commission, T-181/10, paragraphs 161, 162 and 172: https://curia.europa.eu/juris/liste.jsf?num=T-181/10&language=EN.

[56] Judgment of the Court of First Instance of 19 July 1999, Hautala v Council, T-14/98, paragraph 85: https://curia.europa.eu/juris/liste.jsf?language=en&num=T-14/98. 

[57] Judgment of the General Court of 6 December 2012, Evropaïki Dynamiki v Commission, T-167/10, paragraph 78: https://curia.europa.eu/juris/liste.jsf?num=T-167/10&language=EN; Judgment of the General Court of 5 December 2018, Falcon Technologies v Commission, T-875/16, paragraph 102: https://curia.europa.eu/juris/liste.jsf?num=T-875/16&language=EN.

[58] See the Ombudsman Recommendation in case 1129/2023/OAM on the refusal by the European Border and Coast Guard Agency (Frontex) to provide lists of documents it identifies as falling within the scope of requests for public access to documents; available at: https://www.ombudsman.europa.eu/en/recommendation/en/182124.