Executive Director EUROPOL

 

Dear Ms X ,

I am writing to seek a solution in the above case.[1]

The case concerns Europol’s refusal to give public access[2] to correspondence concerning the fight against online child sexual abuse. Specifically, the complainant requested access to “exchanges between Europol and the US-based foundation Thorn covering the period 25 February 2023 - 1 May 2024”.

Europol identified eleven documents as falling within the scope of the complainant’s request. It granted partial access to four documents, and refused disclosure of the seven remaining documents in their entirety.[3]

In refusing access, Europol invoked the exception for the protection of the public interest as regards public security.[4] It argued that the documents contain confidential information relating to “child safety ecosystem members” and “strategic information of operational relevance regarding Europol’s working methods in relation to the use of image classifiers”. Disclosure would undermine the proper fulfilment of Europol’s tasks, as it would jeopardise operational processes and activities of Europol. This, in turn, would negatively affect internal workflows, operational support activities and partners’ trust. In addition, for three of the seven documents, Europol invoked the exception for the protection of its decision-making process,[5] arguing that disclosure would reveal internal opinions that are part of its deliberations and preliminary consultations related to law enforcement investigative tools. Europol identified no overriding public interest in the disclosure of the three documents.

Following the complainant’s request for review, which concerned Europol’s decision to withhold seven documents in their entirety, Europol confirmed its position to refuse access.

The complainant then turned to my Office, arguing that Europol invoked the exceptions to public access too broadly. They also considered that Europol failed to consider their arguments for the existence of an overriding public interest. The complainant argued that Europol should have at least provided partial access to the seven documents.

My inquiry team asked Europol to share copies of the documents at issue.

Following the inspection of the documents, my view is that Europol should have at least granted partial access to the documents, for the reasons set out below.

While I acknowledge that Europol has a wide margin of discretion when determining whether disclosing a document would undermine the protection of the public interest as regards public security, it is still required to demonstrate a ‘specific and actual risk’ that is reasonably foreseeable and not purely hypothetical. It is not sufficient that the requested documents concern a protected interest.[6]

Based on the inspection of the documents and Europol’s explanations in the initial and confirmatory replies, it is not readily clear that all seven documents at issue include sensitive information throughout, which, if disclosed, could harm the public interest as regards public security. Thus, whilst, in principle, I accept that, in light of Europol’s wide discretion, the use of the exception for the protection of the public interest as regards public security was not manifestly wrong,^[7] I do not agree that all seven documents are covered by this exception in their entirety. 

I first note that, in reply to a previous public access request of the complainant,[8] Europol gave partial access to similar documents, that is, exchanges between Europol and Thorn, albeit concerning a different time period. It is difficult to see how all documents at stake in this case differ from those at stake in the above-mentioned previous access request.

In particular, I note that:

• Two documents (Documents 4 and 5) concern Europol’s possible attendance at an external event. The existence of the respective event and its target audience, that is, experts in the area of combating child sexual exploitation, is public information. It is thus unclear how revealing the fact that Europol considered attending the event would harm the public interest as regards public security.
• One document (Document 9) contains certain logistical information concerning a meeting between Thorn and Europol. The existence of similar meetings was disclosed by Europol in the past. It is unclear why, in this case, Europol decided that disclosure of such information would undermine the invoked interest.
• Another document (Document 11) was partially disclosed by Europol in the context of the previous access request mentioned above.

In refusing public access to three of the requested documents, Europol also invoked the need to protect an ongoing decision-making process. This exception seems to be relevant in relation to Documents 7 and 8 only, as these documents contain references to Europol’s consideration of specific tools. It is not evident how disclosure of Document 9, which, as explained above, contains logistical information concerning a meeting, would harm Europol’s ability to take a decision on the choice and use of certain law enforcement tools.

As for the existence of an overriding public interest in disclosure, as noted above, I consider that Europol’s decision to refuse access to Documents 7 and 8, based on public security grounds, was not manifestly wrong. The public interests protected under Article 4(1)(a) of Regulation 1049/2001 cannot be superseded by another public interest that is deemed more important. Given that the exception related to the protection of an ongoing decision-making process does not seem applicable to Document 9, there is no need to assess the possible existence of an overriding public interest in disclosure as regards that document either.

In view of the above, I have decided to propose that Europol should reconsider its position on the complainant’s request, with a view to granting the widest possible access to the documents. Personal data can be redacted.

I would be grateful to receive your reply to this proposal within three months, that is, by 23 May 2025.

At this stage, the solution proposal is confidential. My inquiry team has, however, informed the complainant of our intention to seek a solution in this case.[9] Please note that our usual practice is to send a copy of the solution proposal to the complainant for comments, together with a copy of the institution’s reply to it, once we have received that reply. We also intend to publish this solution proposal and your reply on our website at the end of the inquiry. I would therefore ask Europol to inform us if any information contained in these documents, remains confidential and should not be shared with the complainant or published online.[10]  

Yours sincerely,

Emily O'Reilly
European Ombudsman

Strasbourg, 21/02/2025

 

[1] In accordance with Article 2(10) of the Statute of the European Ombudsman (Regulation 2021/1163 of 24 June 2021 laying down the regulations and general conditions governing the performance of the Ombudsman’s duties) available at: https://www.ombudsman.europa.eu/en/legal-basis/statute/en.

[2] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32001R1049, applicable to Europol in accordance with its Management Board Decision of 13 December 2016: https://www.europol.europa.eu/sites/default/files/documents/decision_of_the_mb_rules_applying_reg_1049_2001.pdf.

[3] Document 4 - 1399138 and Document 5 - 1399137, both dated 5 September 2023; Document 7 - 1399132 and Document 8 - 1399133, both dated 16 May 2023; Document 9 - 1399140, dated 12 April 2023; Document 10 - 1399131, dated 4 April 2023; Document 11 - 1399130, dated 22 February 2023.

[4] Article 4(1)(a) of Regulation 1049/2001.

[5] Article 4(3) of Regulation 1049/2001.

[6] Judgment of 27 November 2019, Case T-31/18, Izuzquiza and Semsrott v Frontex, https://curia.europa.eu/juris/document/document.jsf?text=&docid=221083&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=4082546, paragraphs 61-62.  

[7] For example, for documents 7, 8 and 10 which contain information on specific tools that are considered by Europol.

[8] The complainant made a similar public access request for exchanges with Thorn covering the period 1 January 2022 - 24 February 2023. That request is subject to complaint 1372/2024/OAM.

[9] In line with Article 2(10) of the Statute of the European Ombudsman, Regulation 2021/1163 of 24 June 2021 laying down the regulations and general conditions governing the performance of the Ombudsman’s duties: https://www.ombudsman.europa.eu/en/legal-basis/statute/en.

[10] If you wish to submit documents or information that you consider to be confidential, and which should not be disclosed to the complainant or to the public, please mark them ‘Confidential’. Encrypted emails can be sent to our dedicated mailbox. Information and documents of this kind will be deleted from the European Ombudsman’s files shortly after the inquiry has ended.