Decision in case 799/2019/FP on the Educational, Audiovisual and Culture Executive Agency’s refusal to disclose the names of staff members carrying out a monitoring mission in Macedonia in the context of Creative Europe MEDIA Sub-programme

Background to the complaint

1. The complainant is the managing director of company in the UK.

2. In June 2018, the complainant contacted the Education, Audiovisual and Culture Executive Agency (EACEA) to request information on a project funded by EACEA in a non-EU country. Specifically he asked for the names of the EACEA staff members who supervised that project.

3. In October 2018, the EACEA refused to give him the information, arguing that the disclosure of this information would breach the relevant EU data protection rules.^[1] These rules require that a person asking for the disclosure of personal data, such as the names of persons, must show that there is a need to disclose such personal data to him or her. The EACEA argued that the complainant did not say why he needed the personal data.

4. On 13 November 2018, the complainant turned to the Ombudsman, who found that it was correct to say that the complainant had not explained why it was necessary for him to have access to the names. The Ombudsman thus decided that the EACEA was justified in refusing to disclose them.^[2]

5. On 10 April 2019, the complainant made a new request to EACEA for access to the names of the EACEA staff members who supervised the project. In doing so, he indicated several reasons as to why he needed to have access to their names.

6. On 3 May 2019, the EACEA refused access once again based on the provisions of Article 9(1)(b) of the Data Protection Regulation (Regulation 2018/1725).^[3] The EACEA argued that the complainant had not complied with the Regulation’s requirements.

7. Dissatisfied with the reply of the EACEA, the complainant turned to the Ombudsman on 6 May 2019.

The inquiry

8. The Ombudsman opened an inquiry into the complaint that the EACEA had wrongly refused to grant access to the names of their staff members who supervised a particular project funded by the EACEA.

Arguments presented to the Ombudsman

Supporting arguments by the complainant

9. The complainant argues that there were, in his view, irregularities concerning a project funded by the EACEA and that the EACEA might have not overseen the project in a proper manner.

10. The complainant indicates that he wants to share the names of the EACEA staff members with the European Anti-Fraud Office (OLAF), thus facilitating an investigation of potential misconduct. He also wants to send the information to other ‘competent authorities’ and to an NGO, Transparency International.^[4]

Supporting arguments by the institution

11. In its response to the complainant, the EACEA states that; in accordance with the EU privacy rules^[5], personal data may be transferred to recipients only if three conditions are met. These conditions are: (1) the recipient demonstrates the need for the transfer for a specific purpose in the public interest; (2) there is no reason to believe that such transfer might undermine the legitimate interests of the data subject; and (3) the controller establishes that it is proportionate to transmit the personal data for that specific purpose after having weighed the various competing interests.^[6] EACEA argues that it cannot transfer the personal data, as the request does not meet the three  conditions set forth in the applicable legislation.

12. First, the EACEA claims that the complainant did not substantiate the need for the transmission of the data “for a specific purpose in the public interest”, as required by data protection law. The EACEA argues that in line with the case law of the Court of Justice of the European Union, the applicant needs to establish that the transfer of personal data is the most appropriate of the possible measures that exist for attaining his/her objective. EACEA argues that the complainant had not shown why the transfer the names to him is the most appropriate means of achieving his aims. Therefore, in its view, the complainant failed to demonstrate the existence of “the need for a specific purpose in the public interest”.

13. Second, the EACEA argues that data protection law requires the EU institution or body to refuse the transfer of data if there is any reason to assume that the data subjects’ legitimate interests would be prejudiced. The EACEA is of the opinion that the disclosure of the names of these staff members would undermine their legitimate interests. Furthermore, the EACEA notes that all its staff who monitored, at several stages, the project in question, have acted within a procedural framework well defined by the EACEA and under the necessary supervision.

14. Third, the EACEA argues that data protection law requires it to check that it is proportionate, in light of the various competing interests, to disclose the personal data. The EACEA argues that the complainant did not provide any concrete evidence to support the accusations he made. Therefore disclosing the personal data of the EACEA staff members to him would not be proportionate.

The Ombudsman's assessment

15. Personal data includes any information related to an identified or identifiable person. Therefore, the names of staff members are personal data.

16. The Ombudsman notes that the complainant not only wishes to transfer the data to OLAF, but also wishes to transfer it on to other third parties, including an NGO. Thus, the transfer to the personal data at issue is, in effect, a request to make the data public.

17. Under EU privacy law, the EACEA must follow a three-stage analysis before it can grant a request to make personal data public, as described by EACEA when explaining its reasons for refusal. First, the recipient needs to demonstrate the need for their transfer for a specific purpose in the public interest. Second, there must be no reason to believe that such transfer might undermine the legitimate interests of the data subject. Third, the controller (EACEA) needs to establish that it is proportionate to transmit the personal data for that specific purpose, after having weighed up the various competing interests.

18. The Ombudsman notes that the complainant failed to demonstrate that the purpose of having the data transferred to him is in the public interest and that the transfer of personal data is the most appropriate of the possible measures for attaining his objective.

19. As regards the complainant’s need to have access to the names, the complainant has stated that that the EACEA might have not overseen the project in a proper manner and therefore access to the personal data is necessary so to allow him to provide the names to OLAF, so that it can carry out an investigation.

20. The Ombudsman first notes that the complainant’s position is based on mere assertions that the project was not carried out properly. He did not bring forward any evidence to substantiate his allegations. Secondly, if OLAF did consider it appropriate to carry out an investigation into the supervision of the project, it has all the necessary powers to obtain, from the EACEA, all the information it would need. This would include the power to obtain the names of the relevant EACEA staff members. OLAF would not need to obtain this information from the complainant. Consequently, there is no apparent need for the EACEA to transfer the personal data to the complainant, based on the reasons he has given.

21. The complainant could easily submit his concerns to OLAF, without having the names of the relevant EACEA staff members. OLAF could then examine the merits of the complainant’s allegations, using the full range of its investigatory powers, as it saw fit.

22. While it is sufficient to note that the complainant has not demonstrated a need to have the personal data transferred to him, the Ombudsman notes that the EACEA has also taken the view that it cannot be excluded that disclosure of the personal data could negatively affect the legitimate interests of the staff members in question. The Ombudsman agrees with this view given that the complainant is making serious, yet unsubstantiated, allegations about the staff members concerned.

23. It follows that the conditions for the transfer of the personal data to the complainant are not met in this case. The Ombudsman thus considers that the EACEA was justified in refusing the complainant’s request.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

There was no maladministration by the Education, Audiovisual and Culture Executive Agency.

The complainant and the Education, Audiovisual and Culture Executive Agency will be informed of this decision.

 

Emily O'Reilly

European Ombudsman

Strasbourg, 30/07/2019

 

[1] At the time in question, the applicable legislation was Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, available at: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32001R0045. 

[2] Decision in case 1936/2018/FP on how the Education, Audiovisual and Culture Executive Agency dealt with a request for access to personal data, available at: https://www.ombudsman.europa.eu/en/decision/en/111885.

[3] At the time of this request the new rules on data protection had already come into force: Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725

[4] A global civil society organisation the mandate of which is to fight against corruption.

[5] Regulation 2018/1725 Article 9(1)(b) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725.

[6] Article 9(1)(b) of Regulation (EU) 2018/1725.