JUDGMENT OF THE GENERAL COURT (Second Chamber)
23 November 2011 (*)
(Access to documents – Regulation (EC) No 1049/2001 – Documents relating to the affiliation of certain Members of the European Parliament to the additional pension scheme – Refusal to grant access – Exception relating to the protection of privacy and the integrity of the individual – Article 8(b) of Regulation (EC) No 45/2001 – Transfer of personal data)
In Case T‑82/09,
Gert-Jan Dennekamp, residing at Giethoorn (Netherlands), represented by O. Brouwer, A. Stoffer and T. Oeyen, lawyers,
applicant,
supported by
Kingdom of Denmark, represented by B. Weis Fogh, J. Bering Liisberg and S. Juul Jørgensen, acting as Agents,
and
Republic of Finland, represented by J. Heliskoski and H. Leppo, acting as Agents,
and
European Data Protection Supervisor (EDPS), represented initially by H. Hijmans and H. Kranenborg, and subsequently by H. Kranenborg and I. Chatelier, acting as Agents,
interveners,
v
European Parliament, represented initially by N. Lorenz, H. Krück and D. Moore, and subsequently by N. Lorenz and D. Moore, acting as Agents,
defendant,
APPLICATION for annulment of Decision A(2008) 22050 of the European Parliament of 17 December 2008 refusing to grant the applicant access to certain documents relating to the affiliation of certain Members of the European Parliament to the additional pension scheme,
THE GENERAL COURT (Second Chamber),
composed of N.J. Forwood, President, J. Schwarcz (Rapporteur) and A. Popescu, Judges,
Registrar: J. Palacio González, Principal Administrator,
having regard to the written procedure and further to the hearing on 28 June 2011,
gives the following
Judgment
Background to the dispute
1 On 25 November 2005, the applicant – Mr Gert-Jan Dennekamp – submitted an application to the European Parliament, on the basis of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43), for access to ‘all documents’ relating to the additional pension scheme for Members of the European Parliament (‘the additional pension scheme’). Access was granted to: (i) a note from the Secretary-General to the Bureau of the European Parliament; (ii) ‘Annual Reports and Accounts’, spanning several years; and (iii) the minutes of a Bureau meeting.
2 The applicant lodged a complaint with the European Ombudsman against the refusal to grant him access to the list of Members of the European Parliament (‘MEPs’) who were members of the additional pension scheme. Noting that, in taking the decision not to grant access to the requested document, the Parliament had acted as a political body, the Ombudsman closed the case – after observing, however, that the refusal to grant access seemed not to be legally justified.
3 By letter of 20 October 2008 to the President of the European Parliament, the applicant submitted an application for access to all the documents indicating which MEPs were then members of the additional pension scheme, to the list of MEPs who were members of the scheme on 1 September 2005 and to the list of the current members for whom the Parliament pays a monthly contribution (‘the initial application’).
4 By letter of 12 November 2008, the European Parliament refused access to the requested documents, finding that their disclosure would not be compatible with Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1).
5 On 25 November 2008, the applicant submitted a confirmatory application for access to the same documents (‘the confirmatory application’).
6 The European Parliament rejected the confirmatory application by Decision A(2008) 22050 of 17 December 2008 refusing to grant the applicant access to certain documents relating to the affiliation of certain MEPs to the additional pension scheme (‘the contested decision’).
7 In the contested decision, the European Parliament found that the documents requested by the applicant contained data relating to the private lives of the MEPs who are members of the scheme; that the disclosure of such data risked undermining the protection of their privacy and integrity, and would accordingly be contrary to Article 4(1)(b) of Regulation No 1049/2001 and to Regulation No 45/2001, applicable in the present case, and in particular to Article 8(b) thereof, under which the prospective recipient of data must establish the need for the personal data to be transferred; and that disclosure of the requested documents would be disproportionate in relation to the applicant’s aims.
Procedure and forms of order sought
8 By application lodged at the Registry of the General Court on 20 February 2009, the applicant brought the present action.
9 By separate document lodged at the Court Registry on the same day, the applicant applied to the Court, under Article 76a(1) of its Rules of Procedure, for adjudication under an expedited procedure. The Court refused that request.
10 By documents lodged on 19 May, 28 May and 17 June 2009 respectively, the European Data Protection Supervisor, the Kingdom of Denmark and the Republic of Finland applied for leave to intervene in support of the form of order sought by the applicant.
11 By two orders of the President of the Seventh Chamber of the Court of 4 September 2009, the European Data Protection Supervisor, on the one hand, and the Kingdom of Denmark and the Republic of Finland, on the other, were respectively granted leave to intervene.
12 Owing to a change in the composition of the chambers of the Court, the Judge-Rapporteur was assigned to the Second Chamber, to which the present case was consequently allocated.
13 By document lodged at the Court Registry on 26 October 2010, the European Data Protection Supervisor applied, on the basis of Article 64 of the Rules of Procedure, for the adoption of measures of organisation of procedure so that the parties could be invited to submit written observations on the conclusions to be drawn from the judgment in Case C‑28/08 P Commission v Bavarian Lager [2010] ECR I‑0000.
14 The applicant claims that the Court should:
– annul the contested decision;
– order the European Parliament to pay the costs, including the costs incurred by any intervening parties and costs relating to the request for an expedited procedure.
15 The Kingdom of Denmark, the Republic of Finland and the European Data Protection Supervisor claim that the Court should uphold the applicant’s claims and accordingly annul the contested decision.
16 The European Parliament contends that the Court should:
– dismiss the action as unfounded;
– order the applicant to pay the costs.
Law
17 In support of his action, the applicant puts forward four pleas in law alleging respectively: (i) infringement of Article 2(1) of Regulation No 1049/2001 and misapplication of Article 4(1)(b) of that regulation; (ii) misapplication of Regulation No 45/2001; (iii) manifest error of assessment; and (iv) breach of the obligation to state reasons.
18 The second plea should be examined first.
Second plea: misapplication of Regulation No 45/2001
19 By his second plea, the applicant submits that Regulation No 45/2001 could not be applied to his request for access to documents, which is governed exclusively by Regulation No 1049/2001. In support of his plea, the applicant notes that the right of access to documents laid down in Regulation No 1049/2001 constitutes a legal obligation for the purposes of Article 5(b) of Regulation No 45/2001, to which the European Parliament was obliged to defer. Accordingly, Articles 6(1), 8(b) and 18(a) of Regulation No 45/2001 cannot be relied upon in order to oppose his request for access.
20 At the hearing, the applicant submitted for the first time that, in the initial and confirmatory applications, he had established, in accordance with Article 8(b) of Regulation No 45/2001, the need to have the personal data transferred by invoking the public interest in accountability, transparency and control over public expenditure.
21 First, it should be borne in mind that, as laid down in Article 1 of Regulation No 1049/2001, reflecting recital 4 of the preamble thereto, that regulation seeks to give the public a right of access to documents of the institutions which is as wide as possible (Joined Cases C‑39/05 P and C‑52/05 P Sweden and Turco v Council [2008] ECR I‑4723, paragraph 33).
22 Where an institution is asked to disclose a document, it must assess in each individual case whether that document falls within the exceptions, set out in Article 4 of Regulation No 1049/2001, to the right of public access to documents of the institutions (see, to that effect, Sweden and Turco v Council, paragraph 21 above, paragraph 35). In view of the objectives pursued by Regulation No 1049/2001, those exceptions must be interpreted and applied strictly (Sweden and Turco v Council, paragraph 36).
23 Secondly, it follows from the case-law that, when examining the relationship between Regulation No 1049/2001 and Regulation No 45/2001 for the purposes of applying the exception provided for under Article 4(1)(b) of Regulation No 1049/2001 – namely, the protection of privacy and the integrity of the individual – it must be borne in mind that those regulations have different objectives. Regulation No 1049/2001 is designed to ensure the greatest possible transparency of the decision-making process of the public authorities and the information on which they base their decisions. It is thus designed to facilitate as far as possible the exercise of the right of access to documents and to promote good administrative practices. Regulation No 45/2001 is designed to ensure the protection of the freedoms and fundamental rights of individuals, particularly their private life, in the handling of personal data (Commission v Bavarian Lager, paragraph 13 above, paragraph 49).
24 As Regulation No 1049/2001 and Regulation No 45/2001 do not contain any provisions granting one primacy over the other, the full application of both regulations should, in principle, be ensured (Commission v Bavarian Lager, paragraph 13 above, paragraph 56).
25 Article 4(1)(b) of Regulation No 1049/2001 establishes a specific and reinforced system of protection for a person whose personal data could, in certain cases, be communicated to the public (Commission v Bavarian Lager, paragraph 13 above, paragraph 60).
26 Where a request based on Regulation No 1049/2001 seeks access to documents including personal data, Regulation No 45/2001 becomes applicable in its entirety, including Article 8 thereof (Commission v Bavarian Lager, paragraph 13 above, paragraph 63).
27 Thirdly, it should be noted that, in the present case, the applicant’s request for access was made with a view to obtaining the names of the MEPs who were members of the additional pension scheme at the time of the initial request or who had been members of that scheme on 1 September 2005, together with the names of the members of the scheme at the time of the initial request for whom the European Parliament paid a monthly contribution to the scheme. The names of MEPs constitute personal data within the meaning of Article 2(a) of Regulation No 45/2001 (see, to that effect, Commission v Bavarian Lager, paragraph 13 above, paragraph 68).
28 Moreover, as the European Parliament correctly found in the contested decision, the communication of personal data falls within the definition of ‘processing of personal data’ used in Regulation No 45/2001 (see, to that effect, Commission v Bavarian Lager, paragraph 13 above, paragraph 69).
29 Accordingly, Article 8(b) of Regulation No 45/2001 was applicable to the applicant’s request for access, which concerned documents containing personal data, and it is not possible for the applicant to raise against this the argument that the ‘processing’ requested by him was lawful on the basis of Article 5(b) of Regulation No 45/2001 and that this suffices since Article 8(b) of that regulation applies without prejudice to Article 5.
30 In order to obtain disclosure of the personal data contained in the documents which he was requesting, the applicant would have had to demonstrate, by providing express and legitimate justifications, the necessity for the requested personal data to be transferred, so that the European Parliament would then have been able to weigh up the various interests of the parties concerned and to determine, as required under Article 8(b) of Regulation No 45/2001, whether there was any reason to assume that the legitimate interests of MEPs might be prejudiced by the transfer of those data (see, to that effect, Commission v Bavarian Lager, paragraph 13 above, paragraph 78).
31 In the present case, it must be found that the applicant did not – either in the initial application or in the confirmatory application – discharge the obligation under Article 8(b) of Regulation No 45/2001 to demonstrate the necessity for the requested personal data to be transferred.
32 In order to justify his request for access to the documents in question, the applicant referred, in the initial application, to the facts that MEPs ‘must be aware that their personal data may be of public interest’; that those documents ‘are related to the mandate of a MEP, since … membership of the [additional] Pension Scheme is a consequence of being a MEP’; that the scheme had been ‘set up by Parliament and to a large extent financed by public funds’; that ‘MEPs can use their mandate to influence the future and financing of the [s]cheme’; and that ‘[i]n the past the Parliament has several times voted to make up for shortfalls in the [s]cheme’. The applicant inferred from this that ‘[i]t is relevant to know who has a personal interest in the [s]cheme’ in the interests of transparency and accountability, which lead the public to show a greater interest in the personal data of employees of a public administration than in the data of persons working in the private sector.
33 It should be noted that, in the confirmatory application, the applicant expressly asserted that there was no obligation in the circumstances to establish the necessity of transferring the requested personal data, as required under Article 8(b) of Regulation No 45/2001. Moreover, the applicant again referred to the fact that the personal data in question concerned a matter of public interest, since the European Parliament makes financial contributions to the scheme. He also referred to the public interests of transparency and accountability, which are secured by the right of access to documents. In reply to an argument raised by the Parliament that it would be disproportionate to transfer the personal data requested, the applicant stated that the right of citizens to have access to documents cannot be set aside simply because there are other means of scrutiny, such as supervision by the Budgetary Control Committee of the European Parliament or the Court of Auditors of the European Union. Lastly, the applicant emphasised the public’s right to know the names of the MEPs who are members of the additional pension scheme, so that it is possible to identify the MEPs with a personal interest in that scheme and the potential risks of conflicts of interest.
34 By the general considerations submitted in the initial and confirmatory applications, the applicant failed to establish that, in order to attain the objectives for the purposes of which he was requesting disclosure of those personal data, it was necessary to obtain disclosure of the names of the MEPs who were members of the additional pension scheme at the time of the initial application, or who had been members of that scheme on 1 September 2005, and of members of the scheme at the time of the initial application, for whom the European Parliament contributed to the scheme on a monthly basis. On that point, it should be noted that the applicant merely stated the reasons for which he believed that those personal data represent a public interest. By those arguments, however, he did not establish – by providing the Parliament with express arguments and justifications, as required by the case-law (see paragraph 30 above) – in what respect the ‘processing’ of the personal data or, in other words, the transfer of those data by the Parliament was necessary to satisfy the public interest which he invoked. More specifically, although the applicant criticised in the confirmatory application the Parliament’s view, set out in the decision of 12 November 2008 refusing access to the documents, that transfer of the MEPs’ names would be disproportionate, he did not establish that such a transfer would have been more appropriate than the measures mentioned by the Parliament; nor did he show that the transfer would have been proportionate to his aims.
35 Nor is it possible to accept the interpretation that the applicant’s arguments mentioned in paragraph 33 above should have led the European Parliament to concede that the confirmatory application established the need for the personal data to be disclosed, since the Parliament would then be obliged, as a matter of principle, to infer from general considerations relating to the public interest in the disclosure of personal data that the necessity for the transfer of those data has, by implication, been established.
36 It follows from paragraphs 29 to 35 above that Regulation No 45/2001 was applicable in the present case and that, accordingly, the second plea must be rejected, without it being necessary to rule either on the admissibility of the claim submitted for the first time at the hearing (see paragraph 20 above) or on the applicant’s arguments relating to the application of Articles 6(1) and 18(a) of Regulation No 45/2001, given that the applicant has not in any event fulfilled the obligation laid down in Article 8(b) of that regulation.
First plea: infringement of Article 2(1) of Regulation No 1049/2001 and misapplication of Article 4(1)(b) of that regulation
37 The applicant submits that the European Parliament infringed Article 2(1) of Regulation No 1049/2001 by construing broadly the exception to the right of access, provided for in Article 4(1)(b) of that regulation, based on the risk of undermining the protection of privacy and by treating the concept of privacy in the same way as the protection of personal data. As it is, according to the applicant, the disclosure of personal data such as those contained in the requested documents is not capable of undermining the privacy of MEPs. Moreover, the requested documents concern a matter of public interest and if their disclosure were to undermine the protection of privacy, such interference would be justified and proportionate.
38 It should be borne in mind that, although Article 2 of Regulation No 1049/2001 seeks to give the public as wide as possible a right of access to documents of the institutions, the institution to which an application for access is submitted must, in each individual case, assess whether the requested document falls within the exceptions to the right of public access to documents of the institutions, set out in Article 4 of that regulation (Sweden and Turco v Council, paragraph 21 above, paragraphs 33 and 35).
39 The Court of Justice has also ruled that Article 4(1)(b) of Regulation No 1049/2001, which is an indivisible provision, requires that any undermining of privacy and the integrity of the individual must always be examined and assessed in conformity with the European Union (‘EU’) legislation concerning the protection of personal data, in particular with Regulation No 45/2001 (Commission v Bavarian Lager, paragraph 13 above, paragraph 59).
40 In the contested decision, the European Parliament found that Article 4(1)(b) of Regulation No 1049/2001 required the institutions to refuse access to a document where disclosure could undermine the privacy and the integrity of an individual, in the light, in particular, of the EU legislation on the protection of personal data, of which Regulation No 45/2001 forms part. Since the applicant’s request for access concerned personal data, as was noted in paragraph 27 above, the Parliament found that no provision of Regulation No 45/2001 should be left unapplied on the ground that it is incompatible with Regulation No 1049/2001. Thus, the Parliament correctly applied Article 4(1)(b) of Regulation No 1049/2001 – in accordance with Commission v Bavarian Lager, paragraph 13 above, paragraph 59 – without construing broadly the exception under that provision or treating the concept of privacy in the same way as that of data protection. Since the request for access was examined in accordance with Article 4(1)(b) of Regulation No 1049/2001, it follows that the Parliament did not in any way infringe Article 2(1) of that regulation (see paragraph 38 above).
41 The first plea must therefore be rejected.
Third plea: manifest error of assessment
42 The applicant submits that the contested decision is flawed by manifest error of assessment: (i) the European Parliament did not strike a fair balance between, on the one hand, the public interests served by disclosure of the requested documents and, on the other, the private interests allegedly affected; (ii) the Parliament did not establish to what extent disclosure of the requested documents would actually undermine the privacy of the MEPs; (iii) the Parliament did not carry out a separate assessment of the consequences of disclosure in relation to each of the three categories of document to which access was requested.
43 First of all, it should be borne in mind that, in order for the European Parliament to be able to weigh up the various interests of the parties concerned and to determine whether there was any reason to assume that the legitimate interests of the MEPs might be prejudiced, it was for the applicant to demonstrate, by providing express and legitimate justifications, the necessity for the requested personal data to be transferred, in accordance with Article 8(b) of Regulation No 45/2001 (see, to that effect, Commission v Bavarian Lager, paragraph 13 above, paragraph 78).
44 However, it has been found in paragraph 34 above that the applicant failed to fulfil the obligation laid down in Article 8(b) of Regulation No 45/2001, since he did not establish the necessity for the transfer of the personal data which he was requesting. Accordingly, the European Parliament was not required either to weigh the interests invoked by the applicant against those of the MEPs, or to determine whether there was any reason to assume that the legitimate interests of those MEPs might be prejudiced by such a transfer. Consequently, no manifest error that the Parliament might have made in weighing up the interests of the parties concerned has any bearing, in the present case, on the lawfulness of the contested decision.
45 Next, as regards the error allegedly made in assessing precisely how the MEPs’ privacy would be undermined, it must be found that, as is clear from paragraph 40 above, the European Parliament assessed – in accordance with the EU legislation on the protection of personal data and, in particular, with Regulation No 45/2001 – whether the privacy and the integrity of the individual actually would be undermined, and found, rightly, that there was a risk that the privacy and integrity of MEPs might indeed be undermined as a result of the disclosure of the names of the MEPs who are or have been members of the additional pension scheme, as necessitated by the request for access in the present case (see, to that effect, Commission v Bavarian Lager, paragraph 13 above, paragraph 59).
46 Lastly, as regards the fact that no separate assessment was made, in relation to each of the three categories of document requested, of the consequences of disclosure for the privacy of MEPs, it should be borne in mind that the applicant is requesting, in essence, access to the names of the MEPs who were members of the additional pension scheme at the time of the initial application, to the names of those who were members of that scheme on 1 September 2005 and to the names of members of the scheme at the time of the initial application for whom the European Parliament pays a monthly contribution to the scheme. Although both the initial and confirmatory applications mention that those names appear in three categories of document, the fact remains that, as the Parliament contends, the data are of the same nature. Yet the applicant’s arguments do not reveal the reasons why, notwithstanding that fact, the Parliament should have assessed the risk of MEPs’ privacy being undermined by reference to the particular category of document requested. Accordingly, the applicant’s argument cannot succeed.
47 The third plea must therefore be rejected.
Fourth plea: breach of the obligation to state reasons
48 The applicant submits that the contested decision does not contain a proper statement of reasons in that, first, the European Parliament has not given valid reasons to show that disclosure of the requested documents would specifically and effectively undermine the privacy of MEPs and, second, it is not apparent from that decision that an assessment of that nature has been carried out in relation to each of the requested documents.
49 It should be borne in mind that, according to case-law, the reasons for any decision of an institution in respect of the exceptions set out in Article 4 of Regulation No 1049/2001 must be stated. If an institution decides to refuse access to a document which it has been asked to disclose, it must explain how access to that document could specifically and effectively undermine the interest protected by the exception, provided for in Article 4 of Regulation No 1049/2001, relied on by that institution (see judgment of 11 March 2009 in Case T‑121/05 Borax Europe v Commission, not published in the ECR, paragraph 37 and the case-law cited).
50 By his first claim, the applicant is not, strictly speaking, alleging breach of the obligation to state reasons, but rather a manifest error in the assessment made as to how the privacy of MEPs would be undermined. Accordingly, such an argument is intended to call the grounds of the contested decision into question and relates to the third plea, which has been rejected (see paragraphs 44 to 47 above). It cannot therefore succeed.
51 As regards the applicant’s second claim, relating to the fact that the assessment as to whether the privacy of MEPs would be effectively and specifically undermined was not carried out in relation to each document requested, it should be borne in mind – as has been stated in paragraph 46 above – that the applicant is requesting, in essence, access to names of MEPs which appear in three categories of document and that those names are data of the same nature. It has also been held in the same paragraph that the applicant has failed to show why, notwithstanding that fact, the European Parliament should have assessed the risk of the MEPs’ privacy being undermined by reference to the particular category of document requested. That conclusion holds true for each of the documents requested. Accordingly, the Parliament was not required, in the circumstances of the present case, to give further reasons on that point as regards each of the requested documents.
52 The fourth plea must therefore be rejected and, in consequence, the action must be dismissed in its entirety.
Costs
53 Under Article 87(2) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the applicant has been unsuccessful, and the European Parliament has applied for costs, the applicant must be ordered to pay those costs in their entirety.
54 Under the first subparagraph of Article 87(4) of the Rules of Procedure, the institutions and Member States which intervened in the proceedings are to bear their own costs. In the present case, the Kingdom of Denmark, the Republic of Finland and the European Data Protection Supervisor must be ordered to bear their own costs.
On those grounds,
THE GENERAL COURT (Second Chamber)
hereby:
1. Dismisses the action;
2. Orders Mr Gert-Jan Dennekamp to bear his own costs and to pay the costs incurred by the European Parliament;
3. Orders the Kingdom of Denmark, the Republic of Finland and the European Data Protection Supervisor (EDPS) to bear their own costs.
Delivered in open court in Luxembourg on 23 November 2011.
[Signatures]