Court of Justice of the European Communities (including Court of First Instance Decisions)

(Access to documents Regulation (EC) No 1049/2001 Documents relating to proceedings for failure to fulfil obligations Decision refusing access Protection of physical persons in relation to processing of personal data Regulation (EC) No 45/2001 Concept of private life)

In Case T-194/04,

The Bavarian Lager Co. Ltd, established in Clitheroe (United Kingdom), represented initially by J. Pearson and C. Bright, and subsequently by J. Webber and M. Readings, solicitors,

applicant,

supported by

European Data Protection Supervisor (EDPS), represented by H. Hijmans, acting as Agent,

intervener,

Commission of the European Communities, represented by C. Docksey and P. Aalto, acting as Agents,

defendant,

APPLICATION for annulment of the Commission's decision of 18 March 2004, rejecting an application by the applicant for access to the full minutes of a meeting held in the context of proceedings for failure to fulfil obligations and an application for a declaration that the Commission erroneously terminated the proceedings brought against the Government of the United Kingdom of Great Britain and Northern Ireland under Article 169 of the EC Treaty (now Article 226 EC),

composed of M. Jaeger, President, V. Tiili and O. Czúcz, Judges,

Registrar: C. Kristensen, Administrator,

having regard to the written procedure and further to the hearing on 13 September 2006,

gives the following

Legal background

1. According to Article 6 EU:

'1. The Union is founded on the principles of liberty, democracy, respect for human rights and fundamental freedoms, and the rule of law, principles which are common to the Member States.

2. The Union shall respect fundamental rights, as guaranteed by the European Convention for the Protection of Human Rights and Fundamental Freedoms signed in Rome on 4 November 1950 and as they result from the constitutional traditions common to the Member States, as general principles of Community law.

...'

2. According to Article 255 EC:

'1. Any citizen of the Union, and any natural or legal person residing or having its registered office in a Member State, shall have a right of access to European Parliament, Council and Commission documents, subject to the principles and the conditions to be defined in accordance with paragraphs 2 and 3.

2. General principles and limits on grounds of public or private interest governing this right of access to documents shall be determined by the Council, acting in accordance with the procedure referred to in Article 251 [EC] within two years of the entry into force of the Treaty of Amsterdam.

...'

3. Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission (OJ 2001 L 145, p. 43), defines the principles, conditions and limits for the right of access to documents of those institutions laid down by Article 255 EC. That regulation has applied since 3 December 2001.
4. Commission Decision 2001/937/EC, ECSC, Euratom of 5 December 2001 amending its rules of procedure (OJ 2001 L 345, p. 94), repealed Commission Decision 94/90/ECSC, EC, Euratom of 8 February 1994 on public access to Commission documents (OJ 2001 L 46, p. 58), which implemented, in relation to the Commission, the Code of conduct concerning public access to Council and Commission documents (OJ 1993 L 340, p. 41; 'the Code of Conduct').
5. Recitals 4 and 11 in the preamble to Regulation No 1049/2001 state:

'(4) The purpose of this Regulation is to give the fullest possible effect to the right of public access to documents and to lay down the general principles and limits on such access in accordance with Article 255(2) ... EC.

...

(11) In principle, all documents of the institutions should be accessible to the public. However, certain public and private interests should be protected by way of exceptions. The institutions should be entitled to protect their internal consultations and deliberations where necessary to safeguard their ability to carry out their tasks. In assessing the exceptions, the institutions should take account of the principles in Community legislation concerning the protection of personal data, in all areas of Union activities.'

6. According to Article 4 of Regulation No 1049/2001, concerning exceptions to the right of access:

'1. The institutions shall refuse access to a document where disclosure would undermine the protection of:

...

(b) privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection of personal data.

2. The institutions shall refuse access to a document where disclosure would undermine the protection of:

...

the purpose of inspections, investigations and audits,

unless there is an overriding public interest in disclosure.

3. Access to a document, drawn up by an institution for internal use or received by an institution, which relates to a matter where the decision has not been taken by the institution, shall be refused if disclosure of the document would seriously undermine the institution's decision-making process, unless there is an overriding public interest in disclosure.

Access to a document containing opinions for internal use as part of deliberations and preliminary consultations within the institution concerned shall be refused even after the decision has been taken if disclosure of the document would seriously undermine the institution's decision-making process, unless there is an overriding public interest in disclosure.

...

6. If only parts of the requested document are covered by any of the exceptions, the remaining parts of the document shall be released ...'

7. Article 6(1) of Regulation No 1049/2001 provides that '[t]he applicant is not obliged to state reasons for the application'.
8. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) requires Member States to ensure the protection of the fundamental rights and freedoms of natural persons, and in particular their privacy in relation to the handling of personal data, in order to ensure the free movement of personal data in the Community.
9. Article 286 EC provides that Community acts on the protection of individuals with regard to the processing of personal data and the free movement of such data are to apply to Community institutions and bodies.
10. Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1), was adopted on the basis of Article 286 EC.
11. According to recital 15 in the preamble to Regulation No 45/2001:

'... Access to documents, including conditions for access to documents containing personal data, is governed by the rules adopted on the basis of Article 255 ... EC the scope of which includes Titles V and VI of the [EU] Treaty.'

12. Regulation No 45/2001 provides:

'...

Article 1

Object of the Regulation

1. In accordance with this Regulation, the institutions and bodies set up by, or on the basis of, the Treaties establishing the European Communities, hereinafter referred to as 'Community institutions or bodies', shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data and shall neither restrict nor prohibit the free flow of personal data between themselves or to recipients subject to the national law of the Member States implementing Directive 95/46 ...

2. The independent supervisory authority established by this Regulation, hereinafter referred to as the European Data Protection Supervisor, shall monitor the application of the provisions of this Regulation to all processing operations carried out by a Community institution or body.

Article 2

Definitions

For the purposes of this Regulation:

(a) 'personal data' shall mean any information relating to an identified or identifiable natural person ...; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity;

(b) 'processing of personal data' ... shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

(c) 'personal data filing system' ... shall mean any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

...

Article 3

Scope

1. This Regulation shall apply to the processing of personal data by all Community institutions and bodies insofar as such processing is carried out in the exercise of activities all or part of which fall within the scope of Community law.

2. This Regulation shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.

...

Article 4

Data quality

1. Personal data must be:

(a) processed fairly and lawfully;

(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes ...;

...

Article 5

Lawfulness of processing

Personal data may be processed only if:

(a) processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties establishing the European Communities or other legal instruments adopted on the basis thereof or in the legitimate exercise of official authority vested in the Community institution or body or in a third party to whom the data are disclosed, or

(b) processing is necessary for compliance with a legal obligation to which the controller is subject, or

...

(d) the data subject has unambiguously given his or her consent ...

Article 8

Transfer of personal data to recipients, other than Community institutions and bodies, subject to Directive 95/46 ...

Without prejudice to Articles 4, 5, 6 and 10, personal data shall only be transferred to recipients subject to the national law adopted for the implementation of Directive 95/46 ...:

(a) if the recipient establishes that the data are necessary for the performance of a task carried out in the public interest or subject to the exercise of public authority, or

(b) if the recipient establishes the necessity of having the data transferred and if there is no reason to assume that the data subject's legitimate interests might be prejudiced.

...

Article 18

The data subject's right to object

The data subject shall have the right:

(a) to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her, except in the cases covered by Article 5(b), (c) and (d). Where there is a justified objection, the processing in question may no longer involve those data;

...'

13. Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (ECHR) provides:

'1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.'

14. The Charter of Fundamental Rights of the European Union, proclaimed in Nice on 7 December 2000 (OJ 2000 C 364, p. 1; 'the Charter') provides:
'Article 7 Respect for private and family life

Everyone has the right to respect for his or her private and family life, home and communications.

Article 8

Protection of personal data

1. Everyone has the right to the protection of personal data concerning him or her.

2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.

3. Compliance with these rules shall be subject to control by an independent authority.

...

Article 42

Right of access to documents

Any citizen of the Union, and any natural or legal person residing or having its registered office in a Member State, has a right of access to European Parliament, Council and Commission documents.

...'

Background to the dispute

15. The applicant was established on 28 May 1992 for the importation of German beer for public houses and bars in the United Kingdom, situated primarily in the North of England.
16. However, the applicant was not able to sell its product, since a large number of publicans in the United Kingdom were tied by exclusive purchasing contracts obliging them to obtain their supplies of beer from certain breweries.
17. Under the Supply of Beer (Tied Estate) Order 1989 SI 1989/2390, British breweries holding rights in more than 2 000 pubs are required to allow the managers of those establishments the possibility of buying a beer from another brewery, on condition, according to Article 7(2)(a) of the order, that it is conditioned in a cask and has an alcohol content exceeding 1.2 % by volume. That provision is commonly known as the 'Guest Beer Provision' ('the GBP').
18. However, most beers produced outside the United Kingdom cannot be regarded as 'cask-conditioned beers', within the meaning of the GBP, and thus do not fall within its scope.
19. Considering that the GBP constituted a measure having equivalent effect to a quantitative restriction on imports, and was thus incompatible with Article 30 of the EC Treaty (now, after amendment, Article 28 EC), the applicant lodged a complaint with the Commission by letter of 3 April 1993, registered under reference P/93/4490/UK.
20. Following its investigation, the Commission decided, on 12 April 1995, to institute proceedings against the United Kingdom of Great Britain and Northern Ireland under Article 169 of the EC Treaty (now Article 226 EC). It notified the applicant on 28 September 1995 of that investigation and of the fact that it had sent a letter of formal notice to the United Kingdom on 15 September 1995. On 26 June 1996, the Commission decided to send a reasoned opinion to the United Kingdom and, on 5 August 1996, issued a press release announcing that decision.
21. On 11 October 1996, a meeting was held (the 'meeting of 11 October 1996' or the 'meeting'), which was attended by officers of the Directorate-General (DG) for the Internal Market and Financial Services, officials of the United Kingdom Government Department of Trade and Industry and representatives of the Confederation des Brasseurs du Marche Commun ('CBMC'). The applicant had requested the right to attend the meeting in a letter dated 27 August 1996 but the Commission refused to grant permission to attend.
22. On 15 March 1997 the Department of Trade and Industry in the United Kingdom announced a proposal to amend the GBP under which a bottle-conditioned beer could be sold as a guest beer, as well as cask-conditioned beer. After the Commission had, on two occasions, namely 19 March 1997 and 26 June 1997, suspended its decision to issue a reasoned opinion to the United Kingdom, the head of Unit 2 'Application of Articles 30 to 36 of the EC Treaty (notification, complaints, infringements etc.) and removal of trade barriers' of Directorate B 'Free movement of goods and public procurement' of DG 'Internal Market and Financial Services', in a letter of 21 April 1997, informed the applicant that, in view of the proposed amendment of the GBP, the Article 169 procedure had been suspended and the reasoned opinion had not been served on the United Kingdom Government. He indicated that the procedure would be discontinued entirely as soon as the amended GBP came into force. The new version of the GBP became applicable on 22 August 1997. Consequently, the reasoned opinion was never sent to the United Kingdom and the Commission finally decided on 10 December 1997 to take no further action in the infringement procedure.
23. By fax of 21 March 1997, the applicant asked the Director-General of DG 'Internal Market and Financial Services' for a copy of the 'reasoned opinion', in accordance with the Code of Conduct. That request, despite being repeated, was refused.
24. By letter of 18 September 1997 ('the decision of 18 September 1997'), the Secretary-General of the Commission confirmed the refusal of the application sent to DG 'Internal Market and Financial Services'.
25. The applicant brought an action, registered as Case T-309/97, before the Court of First Instance against the decision of 18 September 1997. In its judgment of 14 October 1999 in Case T-309/97 Bavarian Lager v Commission [1999] ECR II-3217, the Court of First Instance dismissed the action, stating that the preservation of the aim in question, namely allowing a Member State to comply voluntarily with the requirements of the Treaty, or, where necessary, to give it the opportunity to justify its position, justified, for the protection of the public interest, the refusal of access to a preparatory document relating to the investigation stage of the procedure under Article 169 of the Treaty.
26. On 4 May 1998, the applicant addressed a request to the Commission under the Code of Conduct for access to all of the submissions made under file reference P/93/4490/UK by 11 named companies and organisations and by three defined categories of person or company. The Commission refused the initial application on the ground that the Code of Conduct applies only to documents of which the Commission is the author. The confirmatory application was rejected on the grounds that the Commission was not the author of the document in question and that any application had to be sent to the author.
27. On 8 July 1998, the applicant complained to the European Ombudsman under reference 713/98/IJH, stating, by letter dated 2 February 1999, that it wished to obtain the names of the delegates of the CBMC who had attended the meeting on 11 October 1996 and the names of the companies and any persons who fell into one of the 14 categories identified in the original request for access to documents containing the communications to the Commission under file reference P/93/4490/UK.
28. Following an exchange of letters between the Ombudsman and the Commission, the latter indicated to the Ombudsman in October and November 1999 that, of the 45 letters that it had written to the persons concerned requesting approval to disclose their identities to the applicant, 20 replies had been received, of which 14 were positive and 6 were negative. The Commission supplied the names and addresses of those that had responded positively. The applicant stated to the Ombudsman that the information provided by the Commission was still incomplete.
29. In his draft recommendation addressed to the Commission in Complaint 713/98/IJH of 17 May 2000, the Ombudsman proposed that the Commission should inform the applicant of the names of the delegates of the CBMC who had attended the meeting of 11 October 1996 and of the companies and persons in the 14 categories identified in the applicant's original request for access to documents containing submissions made to the Commission under file reference P/93/4490/UK.
30. On 3 July 2000, the Commission sent a detailed opinion to the Ombudsman, in which it maintained that the consent of the persons concerned was still necessary, but indicated that it would be able to provide the names of those persons from whom it had received no reply to its request for their consent because, in the absence of a reply, the interests and fundamental rights and freedoms of the persons concerned did not prevail. The Commission thus included the names of 25 further persons.
31. On 23 November 2000, the Ombudsman made his special report known to the Parliament, following up the recommendation project addressed to the Commission in Complaint 713/98/IJH ('the special report') in which he concluded that there was no fundamental right to supply information to an administrative authority in secret and that Directive 95/46 did not require the Commission to keep secret the names of persons who submit views or information to it concerning the exercise of their functions.
32. On 30 September 2002, the Ombudsman wrote a letter to the Commission President, Mr Prodi, in which he expressed his concern that:

'data protection rules are being misinterpreted as implying the existence of a general right to participate anonymously in public activities. This misinterpretation risks subverting the principle of openness and the public's right of access to documents, both at the level of the Union and in those Member States where openness and public access are enshrined in national constitutional rules.'

33. According to a press release No 23/2001 issued by the Ombudsman on 12 December 2001, the Parliament had adopted a resolution on the special report by requesting the Commission to provide the information required by the applicant.
34. By e-mail of 5 December 2003, the applicant sent a request to the Commission for access to the documents referred to in paragraph 26 above, based on Regulation No 1049/2001.
35. The Commission replied to that request by letter of 27 January 2004 stating that certain documents relating to the meeting could be disclosed, but drawing the applicant's attention to the fact that five names had been blanked out from the minutes of the meeting of 11 October 1996, following two express refusals by persons to consent to the disclosure of their identity and the Commission's failure to contact the remaining three attendees.
36. By e-mail of 9 February 2004, the applicant made a confirmatory application within the meaning of Article 7(2) of Regulation No 1049/2001, in which it requested the full minutes of the meeting of 11 October 1996, including all of the names.
37. By letter of 18 March 2004 ('the contested decision'), the Commission rejected the confirmatory application of the applicant. It confirmed that Regulation No 45/2001 applied to the request for disclosure of the names of the other participants. As the applicant had not established an express and legitimate purpose or need for such a disclosure, the conditions set out by Article 8 of that regulation had not been met and the exception provided for in Article 4(1)(b) of Regulation No 1049/2001 applied. It added that, even if the rules on the protection of personal data did not apply, it would nevertheless have had to refuse to disclose the other names under Article 4(2), third indent, of Regulation No 1049/2001 so as not to compromise its ability to conduct inquiries.

Procedure and forms of order sought

38. The applicant brought the present action by an application lodged at the Registry of the Court of First Instance on 27 May 2004.
39. By order of 6 December 2004, the President of the Third Chamber of the Court granted the Republic of Finland leave to intervene in support of the form of order sought by the applicant. Following the withdrawal of the Republic of Finland, the President of the Third Chamber of the Court, by order of 27 April 2005, struck out that intervention.
40. By a document lodged at the Registry of the Court on 28 February 2006, the European Data Protection Supervisor ('the EDPS') requested leave to intervene in the dispute in support of the form of order sought by the applicant. By order of 6 June 2006, the President of the Third Chamber of the Court granted the EDPS leave to intervene in support of the applicant.
41. By way of measures of organisation of procedure, the applicant and the Commission were requested to produce certain documents. They complied with those requests within the specified time-limits.
42. By order of 16 May 2006, in accordance with Article 65(b), Article 66(1) and Article 67(3), third subparagraph, of the Rules of Procedure of the Court of First Instance, the latter ordered the Commission to produce the complete minutes of the meeting of 11 October 1996, including the names of all the participants, whilst providing that that document would not be communicated to the applicant in the context of the current proceedings. That order was complied with.
43. The parties presented oral argument and replied to the oral questions of the Court of First Instance at the hearing on 13 September 2006.
44. The applicant claims that the Court should:

declare that the Commission's acceptance of the amendment to the GBP by the United Kingdom Government is contrary to Article 30 of the EC Treaty (now Article 28 EC);

declare that the Commission should not have accepted the abovementioned amendment and that it therefore breached Article 30 of the EC Treaty;

annul the contested decision;

order the Commission to produce the full set of names of persons who attended the meeting;

order the Commission to pay the costs.

45. At the hearing, the EDPS, supporting the applicant's application for access to the documents, contended that the Court should annul the contested decision.
46. The Commission contends that the Court should:

dismiss the claims concerning the infringement procedure as inadmissible;

dismiss the application for annulment of the contested decision;

dismiss the request that the Commission be ordered to disclose the names of the other persons who participated in the meeting as inadmissible;

order the applicant to pay the costs.

Admissibility of the request that the Court should order the Commission to disclose the names of all persons who participated in the meeting

47. It is settled case-law that the Court of First Instance is not entitled, when exercising judicial review of legality, to issue directions to the institutions or to assume the role assigned to them. That limitation of the scope of judicial review applies to all types of contentious matters that might be brought before it, including those concerning access to documents (Case T-204/99 Mattila v Council and Commission [2001] ECR II-2265, paragraph 26, confirmed by the Court of Justice in Case C-353/01 P Mattila v Council and Commission [2004] ECR I-1073, paragraph 15).
48. Therefore, an application by the applicant, requesting the Court of First Instance to order the Commission to send it the names of all the persons who attended the meeting of 11 October 1996, is inadmissible.

The unlawful closure of the procedure for failure to fulfil obligations under Article 169 of the EC Treaty

Arguments of the parties

49. The applicant argues that the Commission agreed to close a procedure for failure to fulfil its obligations, in breach of Article 30 of the EC Treaty, or, alternatively, of Article 6 of the EC Treaty (now, after amendment, Article 12 EC), of which the meeting of 11 October 1996 was a crucial component.
50. Given that the Commission refused the applicant's request to attend the meeting, that it wrongly settled the proceedings for failure to fulfil obligations, that the amended GBP continued to discriminate against beers from Member States other than the United Kingdom, and that the Commission showed extreme reluctance to reveal the names of those present at the meeting, that meeting must, the applicant argues, have been used as an opportunity for the United Kingdom Government and large United Kingdom beer producing companies to persuade the Commission to adopt an amendment that served to prevent beer importers such as the applicant from being able to sell their products to a sizeable portion of the United Kingdom market. That agreement, seeking to obtain unlawful closure of the procedure for failure to fulfil obligations, caused the applicant to suffer loss of opportunity and as a result, substantial financial loss. Therefore, it argues, there was a breach of Article 30 of the EC Treaty.
51. The applicant argues that the amended GBP is also contrary to Article 6 of the EC Treaty in that its effect is to establish discrimination based on nationality against beers produced in Member States other than the United Kingdom.
52. The Commission considers, essentially, that the applicant's claims for a declaration that the Commission's acceptance of the amendment made by the United Kingdom Government to the GBP was contrary to Article 30 of the EC Treaty, that it should not have accepted that amendment, and that it thus infringed Article 30 of the EC Treaty, are manifestly inadmissible.

Findings of the Court

53. The applicant is requesting the Court to declare that the Commission's acceptance of the amendment made by the United Kingdom Government to the GBP is contrary to Articles 30 and 6 of the EC Treaty. That request should be interpreted, in reality, as an argument by the applicant that the Commission acted wrongly in deciding to take no further action on its complaint against measures of the United Kingdom allegedly contrary to Community law.
54. In that regard, it should be noted that private individuals are not entitled to bring proceedings against a refusal by the Commission to institute proceedings against a Member State for failure to fulfil its obligations (order of 12 June 1992 in Case C-29/92 Asia Motor France v Commission [1992] ECR I-3935, paragraph 21; order of 15 March 2004 in Case T-139/02 Institouto N. Avgerinopoulou and Others v Commission [2004] ECR II-875, paragraph 76; and order of 19 September 2005 in Case T-247/04 Aseprofar and Edifa v Commission [2005] ECR II-3449, paragraph 40).
55. Under Article 169 of the EC Treaty, the Commission is not bound to bring proceedings for failure to fulfil obligations, but has a discretionary power precluding the right of individuals to require it to adopt a particular position or to bring an action for annulment against its refusal to take action (order of 16 February 1998 in Case T-182/97 Smanor and Others v Commission [1998] ECR II-271, paragraph 27, and Institouto N. Avgerinopoulou and Others v Commission, paragraph 77).
56. In this case, therefore, the applicant has no standing to request the annulment of the Commission's refusal to bring an action for failure to fulfil obligations against the United Kingdom on the ground that the amended GBP infringed Articles 6 and 30 of the EC Treaty. In those circumstances, the Commission cannot be accused of itself infringing those articles by taking no further action on the proceedings in question.
57. In any event, even if the applicant's request were interpreted as seeking annulment not of that refusal but of the decision to take no further action on its complaint of 10 December 1997, it should be noted that a decision whereby the Commission decides to take no further action on a complaint informing it of conduct by a State capable of giving rise to proceedings for failure to fulfil obligations does not have binding force and is not therefore a measure that is open to challenge (order in Aseprofar and Edifa v Commission, paragraph 48). Moreover, the action would be clearly out of time, having regard to the date of that decision.
58. In those circumstances, the applicant's claims concerning the decision to take no further action on its complaint are inadmissible.
59. Moreover, concerning the applicant's claim that unlawful closure of the proceedings for failure to fulfil obligations caused it loss of opportunity and significant financial loss, it is sufficient to note that the applicant has not made a claim for compensation as part of its action. Therefore, there is no need to rule in that respect.

Access to documents

Arguments of the parties

60. The applicant submits that, in accordance with the conclusions drawn by the Ombudsman's Special Report, the exception contained in Article 4(1)(b) of Regulation No 1049/2001 does not apply to this case, since Directive 95/46 does not oblige the Commission to withhold the names of persons who submit views or information to it. The applicant refers in that respect to the letter from the Ombudsman to the President of the Commission on 30 September 2002, to complain about misuse of Directive 95/46.
61. Nor, the applicant argues, does Article 4(3) of Regulation No 1049/2001 apply. Given that the meeting took place in 1996, any potential undermining of the Commission's decision-making process would be at best minimal, given that over seven years have passed since the holding of that meeting and the bringing of the action. Even if that provision did apply, the Commission could not rely on it to support its refusal to disclose the information requested, because of the overwhelming public interest in disclosure in this case. For example, the Ombudsman and the Parliament have taken a particular interest, in this case, in the high level of secrecy surrounding the way in which powerful third parties can make their views known to the Commission, which is contrary to the principles of open government.
62. In its reply, the applicant argues that there is a new element in the defence, namely that the persons whose names the applicant requested were employees of the CBMC and had acted in accordance with the instructions of the body which they represented. The applicant argues that, since the Commission has revealed that those persons were representatives of the CBMC, that statement is now in the public domain, so that no further compromising of the Commission's reputation for confidentiality would occur by disclosing their names.
63. The applicant points out that trade associations, such as the CBMC, usually represent all or most of the participants in a market, and thus tend to expound views on behalf of an industry as a whole. The Commission's reputation could be damaged only if it were to transpire that, at the meeting on 11 October 1996, the CBMC representatives represented a specific group of brewers with an interest in maintaining foreclosure in the United Kingdom market for beer sold in pubs and bars. The applicant argues that, where the information providers are employees of such a trade association, there is no risk emanating from the loss of that confidentiality, unless the trade association is not accurately reflecting the views of all of its members.
64. The applicant concludes that Article 2 of Regulation No 1049/2001 obliges the Commission to make full disclosure of the attendees of the meeting and the submissions made with respect to the procedure for failure to fulfil obligations, and that none of the exceptions contained in Article 4 of Regulation No 1049/2001 apply to this case.
65. The EDPS argued at the hearing that the Commission has infringed Article 4(1)(b) of Regulation No 1049/2001. He refers in that regard to a document entitled 'Public access to documents and data protection' (Reference documents, July 2005 No 1, EDPS European Data Protection Supervisor), which can be found on the EDPS internet site.
66. The EDPS stresses the need to establish an optimal balance between, on the one hand, the protection of data of a private nature, and, on the other, the fundamental right of the European citizen to have access to documents of the institutions. The Commission's reasoning did not correctly take account of that balance, which is explicitly governed by Article 4(1)(b) of Regulation No 1049/2001. Since a request for access to documents is based on democratic principles, it is not necessary to state the reasons why the documents are requested, so that Article 8 of Regulation No 45/2001 does not apply in this case. Similarly, the EDPS considers that data protection rules do not allow the inference of a general right to participate, anonymously, in public activities.
67. According to the EDPS, the interest protected in Article 4(1)(b) of Regulation No 1049/2001 is private life and not the protection of personal data, which is a much broader concept. Whilst the name of a participant, mentioned in the minutes of a meeting, falls within the scope of personal data, since the identity of that person would be revealed and the concept of the protection of personal data applies to those data, whether or not they fall within the scope of private life, the EDPS points out that, in the area of professional activities, the disclosure of a name does not normally have any link to private life. The EDPS concludes that the Commission cannot rely on Article 4(1)(b) of Regulation No 1049/2001 in order to refuse to disclose the names of the persons concerned.
68. The EDPS concludes that, in any case, on a proper interpretation of Article 4(1)(b) of Regulation No 1049/2001, the right to refuse disclosure is not an absolute right, but implies that private life must be affected to an important or considerable extent, which must be assessed having regard to the rules and principles on the protection of personal data. No general right is conferred on the person concerned to oppose disclosure. A person concerned who opposes disclosure must put forward a plausible reason, explaining why disclosure might be harmful to him.
69. The Commission argues that the application for annulment of the contested decision is unfounded. It notes that, in this case, what is at issue is the interaction of two rights, namely the right of the public to have access to documents and the right to the protection of private life and data.
70. On the one hand, the right of public access to documents under Regulation No 1049/2001 is generally unrestricted and automatic and is not dependent on the demonstration of any special interest peculiar to the person requesting access. The person making the request is not normally obliged to state reasons justifying it.
71. On the other hand, personal data may only be disclosed lawfully and legitimately according to the basic principles governing the right to privacy and the specific provisions governing the processing of personal data. The Commission refers to Article 8 of the ECHR, Article 286 EC and Articles 7 and 8 of the Charter. The provisions of Regulation No 45/2001 require that the person making a request for personal data must establish the necessity for disclosure of such data and the Commission must be satisfied that the data subject's interests will not be prejudiced.
72. The Commission notes that the applicant does not present any legal arguments in support of its contention that the exception of Article 4(1)(b) of Regulation 1049/2001, and subsequently Regulation No 45/2001, does not apply, but has merely relied on the Ombudsman's draft recommendation and the resolution of the European Parliament supporting it. However the Ombudsman's conclusion was based on an interpretation of Directive 95/46, and of the Code of Conduct, which was subsequently disproved by the Court (Case C-41/00 P Interporc v Commission [2003] ECR I-2125; Case T-92/98 Interporc v Commission [1999] ECR II-3521, paragraph 70; and Case T-47/01 Co-Frutta v Commission [2003] ECR II-4441, paragraphs 63 and 64). Since the applicant's latest request for access was made after Regulations Nos 45/2001 and 1049/2001 came into force, the Commission's decision to withhold the names should be examined under those rules. In any event, the conclusive interpretation of the law is not within the remit of either the Ombudsman or the Parliament.
73. The Commission argues that the Court has confirmed the position taken by the Commission with regard to the scope of the data protection rules. The Court has ruled that the data protection rules, and in particular the principle of proportionality, apply to the publication of individuals' names even when the individuals are public employees and the processing is for a public purpose (Joined Cases C-465/00, C-138/01 and C-139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989, paragraph 64). That approach, in relation to Directive 95/46, was subsequently confirmed by the Court in Case C-101/01 Lindqvist [2003] ECR I-12971, paragraph 24, according to which the term 'personal data' undoubtedly covers the name of a person in conjunction with his telephone number or information about his working conditions or hobbies.
74. The Commission argues that the specific means to reconcile the rights of public access and of privacy and data protection is enshrined in Article 4(1)(b) of Regulation No 1049/2001, which should be read in the light of recital 11 of that regulation, which explains that '[i]n assessing the exceptions, the institutions should take account of the principles in Community legislation concerning the protection of personal data, in all areas of Union activities'. That exception does not have to be balanced with any overriding public interest in disclosure, but specifically requires the Community institutions to refuse access to a document where disclosure would undermine the protection of privacy and the protection of personal data.
75. Regulation No 45/2001 does not preclude disclosure or other processing of personal data by the Commission, but provides the means of assessing on a case'by'case basis whether it is lawful and legitimate for an institution to process personal data, and hence whether such processing would not undermine data protection.
76. The Commission argues that, where processing is lawful and legitimate under Regulation No 45/2001 in a particular case, the exception to the right of public access in Article 4(1)(b) of Regulation No 1049/2001 does not apply and a document containing personal data must be disclosed. Where, however, the processing requested is not lawful and legitimate and the applicant has been unable to demonstrate why disclosure is necessary, the Commission is not required to disclose those data.
77. Since, the Commission argues, both rights are of the same nature, importance and degree, they have to be applied together, and, where a request is made for access to a public document containing personal data, a balance must be sought on a case'by'case basis.
78. The Commission refers in that regard to a report on the situation of Fundamental Rights in the European Union and its Member States, drawn up in 2002 by the EU Network of Independent Experts on Fundamental Rights, according to which 'while taking into account the possibility of granting only partial access to certain documents, it is essential that the Community institution does not grant right of access to documents when the interests of the applicant do not have any reasonable relationship of proportionality with the resulting violation of the right of the person concerned to protect his privacy regarding the processing of personal data'.
79. The need for such a balanced approach has also been highlighted by the Data Protection Working Party established under Article 29 of Directive 95/46, in its Opinion 5/2001 of 17 May 2001 on the European Ombudsman Special Report. According to that Opinion:

'It should be noted ... that the obligation to public disclosure imposed by the legislation on public access to administrative documents does not establish an absolute obligation of openness. It rather makes the obligation to grant access to documents subject to due regard being made of the right to privacy. Therefore, it does not justify unlimited or unfettered disclosure of personal data. On the contrary, a joint reading of legislation on public access and on data protection normally imposes that an analysis of the circumstances surrounding each situation is made on a case'by'case basis, in order to strike a balance between those two rights. In particular, as a result of such assessment, legislation on public access may provide for different rules to apply to different categories of data or different kinds of data subjects.'

80. The Commission points out that Regulation No 1049/2001 does not impose an automatic, unrestricted obligation to disclose documents or parts of documents containing personal data, but that that obligation exists only so far as it does not undermine the data protection rules.
81. In this case, the Commission took all the relevant circumstances into account. In the case of the representatives of UK authorities and of the CBMC, the applicant was fully informed of the interests and of the bodies represented at the meeting. As representatives, the persons present there were acting on instructions of the represented bodies in their capacity as employees of those bodies and not in a personal capacity. The effects of the decisions taken there applied to the represented bodies and not to the representatives in their personal capacity. It is therefore the information concerning the represented bodies that is relevant for the public scrutiny pursued by the principle of transparency, and the Commission's refusal to disclose the names of the individuals representing those interests is, the Commission submits, not to be considered as a breach of the rights of the applicant. The Commission also took account of the need to protect its ability to carry out investigations and its sources of information.
82. The Commission further argues that the applicant has never fulfilled the obligation to prove the need for a transfer of data, imposed by Article 8(b) of Regulation No 45/2001. Disclosure of the names of the participants would not shed any additional light on the Commission's decision to close the proceedings for failure to fulfil obligations. Since the minutes were disclosed, the public is fully aware of the facts and arguments on the basis of which the Commission took its decision. Thus, in the absence of a specific and valid reason demonstrating the need to disclose personal data to third parties, the Commission was therefore obliged to refuse to make such a disclosure.
83. According to the Commission, contrary to what the applicant argues in its reply, the fact that the names of the staff of the CBMC are in the public domain does not mean that the identity of the staff who attended the meeting with the Commission must also be in the public domain. It does not follow that the names of the particular employees of a trade association who represented that association at a meeting can necessarily be deduced from the publication of the identities of all its staff. If that were the case, the applicant would have no reason to ask for these names to be revealed to it. Moreover, the applicant has not suggested that the representatives of the CBMC did not represent the views of the association at the meeting, or demonstrated how knowing the identities of the persons concerned would provide more necessary information than was concerned in the meeting report and the other documents which were disclosed.
84. Concerning the applicant's arguments as to the alleged application of Article 4(3) of Regulation No 1049/2001, the Commission stresses that it based its refusal to disclose the names not on the exception under that paragraph, but on that laid down by the third indent of Article 4(2) of that regulation.
85. The applicant was informed that, even if the rules on data protection did not apply to the request, the Commission would have reasons to refuse to disclose the names of five persons against their will, in order to protect its ability to carry out investigations into possible infringements of Community law. The meeting of 11 October 1996 took place in the context of such an investigation. If the names of persons who provided information to the Commission could be disclosed against their will, the Commission could be deprived of a valuable source of information, putting at risk its ability to carry out such investigations.
86. The Commission argues that, under complaint and infringement procedures, complainants are given the possibility to choose between a 'confidential' and a 'non confidential' handling of their complaint, and that there are no good reasons why other parties interested in the infringement procedure should not enjoy the same right.
87. Thus, the exception mentioned in the third indent of Article 4(2) of Regulation No 1049/2001 required the Commission not to disclose the five names to the applicant.
88. Finally, the Commission argues that the applicant has not demonstrated any 'overriding public interest in disclosure' of those remaining names so as to preclude the Commission from applying that exception.
89. In this case, the disclosure of the names of the other persons, against their will and contrary to their expectation of confidentiality when contributing to the investigation into the alleged infringement, would undermine the protection of all investigations. Therefore, the Commission argues, there is a manifest public interest in favour of preserving confidentiality in investigations rather than endangering it.

Findings of the Court

Preliminary observations

90. The applicant's request for access to the full document, and its application, are based on Regulation No 1049/2001.
91. In the contested decision, the Commission held that Regulation No 45/2001 applied to the request that the names of the participants at the meeting of 11 October 1996 be revealed. The Commission took the view that, since the applicant had not established either an express and legitimate purpose or the need for such disclosure, the conditions set out by Article 8 of that regulation had not been met and the exception provided for in Article 4(1)(b) of Regulation No 1049/2001 applied. It added that, even if the rules on the protection of personal data did not apply, it would nevertheless have had to refuse to disclose the other names under Article 4(2), third indent, of Regulation No 1049/2001 so as not to compromise its ability to conduct inquiries.
92. In that regard, it should be noted that, according to Article 6(1) of Regulation No 1049/2001, a person requesting access is not required to justify his request and therefore he does not have to demonstrate any interest in having access to the documents requested (Joined Cases T-391/03 and T-70/04 Franchet and Byk v Commission [2006] ECR II-2023, paragraph 82, and case-law cited).
93. It should also be noted that access to documents of the institutions constitutes the principle and that a decision to refuse access is valid only if it is based on one of the exceptions laid down in Article 4 of Regulation No 1049/2001.
94. According to settled case-law, those exceptions must be construed and applied restrictively so as not to defeat the general principle enshrined in that regulation (Joined Cases C-174/98 P and C-189/98 P Netherlands and van der Wal v Commission [2000] ECR I-1, paragraph 27; Case T-211/00 Kuijer v Council [2002] ECR II-485, paragraph 55; and Franchet and Byk, paragraph 84).
95. It is in the light of that case-law that the Court must examine how the Commission applied the exceptions under Article 4(1)(b) and Article 4(2), third indent, of Regulation No 1049/2001.

The exception concerning the protection of privacy and the integrity of the individual, under Article 4(1)(b) of Regulation No 1049/2001

Preliminary observations concerning the interaction between Regulations Nos 1049/2001 and 45/2001

96. Under Article 4(1)(b) of Regulation No 1049/2001, the institutions are to refuse access to a document where disclosure would undermine the protection of privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection of personal data.
97. Although the applicant refers in its application only to Directive 95/46 and not to Regulation No 45/2001, its action must be understood as referring to that regulation, since the contested decision is, in part, based upon it. At the hearing, moreover, the applicant correctly referred to that regulation.
98. It is necessary at the outset to examine the relationship between Regulations Nos 1049/2001 and 45/2001 for the purpose of applying the exception under Article 4(1)(b) of Regulation No 1049/2001 to this case. For that purpose, it should be borne in mind that they have different objectives. The first is designed to ensure the greatest possible transparency of the decision-making process of the public authorities and the information on which they base their decisions. It is thus designed to facilitate as far as possible the exercise of the right of access to documents, and to promote good administrative practices. The second is designed to ensure the protection of the freedoms and fundamental rights of individuals, particularly their private life, in the handling of personal data.
99. Recital 15 of Regulation No 45/2001 indicates that access to documents, including conditions for access to documents containing personal data, is governed by the rules adopted on the basis of Article 255 EC.
100. Therefore, access to documents containing personal data falls under Regulation No 1049/2001, according to which, in principle, all documents of the institutions should be accessible to the public. It also provides that certain public and private interests must be protected by a regime of exceptions.
101. Thus, for example, that regulation lays down an exception, referred to above, concerning cases where disclosure would adversely affect the protection of privacy and the integrity of the individual, particularly in accordance with Community legislation on the protection of personal data, such as Regulation No 45/2001.
102. In addition, according to recital 11 of Regulation No 1049/2001, in assessing the need for an exception, the institutions should take account of the principles in Community legislation concerning the protection of personal data in all areas of activity of the Union, thus including principles laid down in Regulation No 45/2001.
103. In that regard, it is necessary to recall the most relevant provisions of Regulation No 45/2001.
104. Pursuant to Article 2(a) of Regulation No 45/2001, 'personal data' means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity. Personal data would therefore include, for example, surname and forenames, postal address, e-mail address, bank account number, credit card numbers, social security number, telephone number or driving licence number.
105. In addition, under Article 2(b) of Regulation No 45/2001, 'processing of personal data' means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction. Therefore, communication of data, by transmission, dissemination or otherwise making available, falls within the definition of 'processing', and thus this regulation itself provides, independently of Regulation No 1049/2001, for the possibility of making certain personal data public.
106. The processing must, in addition, be lawful under Article 5(a) or (b) of Regulation No 45/2001, according to which the processing must be necessary for the performance of a task carried out in the public interest or for compliance with a legal obligation to which the controller is subject. The right of access to documents of the institutions recognised to citizens of the European Union and to any natural or legal person residing in or having its registered office in a Member State, laid down by Article 2 of Regulation No 1049/2001, constitutes a legal obligation for the purposes of Article 5(b) of Regulation No 45/2001. Therefore, if Regulation No 1049/2001 requires the communication of data, which constitutes 'processing' within the meaning of Article 2(b) of Regulation No 45/2001, Article 5 of that same regulation makes such communication lawful in that respect.
107. As regards the obligation to prove the need to transfer, laid down by Article 8(b) of Regulation No 45/2001, it should be remembered that access to documents containing personal data falls within the application of Regulation No 1049/2001, and that, according to Article 6(1) of the latter, a person requesting access is not required to justify his request and therefore does not have to demonstrate any interest in having access to the documents requested (see paragraph 92 above). Therefore, where personal data are transferred in order to give effect to Article 2 of Regulation No 1049/2001, laying down the right of access to documents for all citizens of the Union, the situation falls within the application of that regulation and, therefore, the applicant does not need to prove the necessity of disclosure for the purposes of Article 8(b) of Regulation No 45/2001. If one were to require the applicant to demonstrate the necessity of having the data transferred, as an additional condition imposed in Regulation No 45/2001, that requirement would be contrary to the objective of Regulation No 1049/2001, namely the widest possible public access to documents held by the institutions.
108. Moreover, given that access to a document will be refused under Article 4(1)(b) of Regulation No 1049/2001 where disclosure would undermine protection of the privacy and the integrity of the individual, a transfer that does not fall under that exception cannot, in principle, prejudice the legitimate interests of the person concerned within the meaning of Article 8(b) of Regulation No 45/2001.
109. As regards the data subject's right to object, Article 18 of Regulation No 45/2001 provides that that person has the right to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her, except in cases covered by, in particular, Article 5(b) of that regulation. Therefore, given that the processing envisaged by Regulation No 1049/2001 constitutes a legal obligation for the purposes of Article 5(b) of Regulation No 45/2001, the data subject does not, in principle, have a right to object. However, since Article 4(1)(b) of Regulation No 1049/2001 lays down an exception to that legal obligation, it is necessary to take into account, on that basis, the impact of the disclosure of data concerning the data subject.
110. In that regard, this Court considers that, if communication of those data would not undermine protection of the privacy and the integrity of the individual concerned, as required by Article 4(1)(b) of Regulation No 1049/2001, that person's objection cannot prevent such communication.
111. Moreover, it should be recalled that the provisions of Regulation No 45/2001, in so far as they govern the processing of personal data capable of affecting fundamental freedoms, and the right to privacy in particular, must necessarily be interpreted in the light of fundamental rights which, according to consistent case-law, form an integral part of the general principles of law with which the Court of Justice and the Court of First Instance ensure compliance (see, by analogy, as regards Directive 95/46, Österreichischer Rundfunk, paragraph 68).
112. Those principles have been expressly included in Article 6(2) EU, according to which the Union shall respect fundamental rights, as guaranteed by the ECHR and as they result from the constitutional traditions common to the Member States, as general principles of Community law.
113. It should be noted in that respect that Article 8 of the ECHR, whilst laying down in paragraph 1 the principle that public authorities shall not interfere with the exercise of the right to private life, does acknowledge, in paragraph 2, that such interference is possible in so far as it 'is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others'.
114. It should also be noted that, in accordance with the case-law of the European Court of Human Rights, 'private life' is a broad concept that does not lend itself to an exhaustive definition. Article 8 of the ECHR also protects the right to identity and personal development and also the right of any individual to establish and develop relationships with other human beings and with the outside world. There is no reason in principle to exclude professional or business activities from the concept of 'private life' (see ECHR judgments in Niemietz v Germany of 16 December 1992, Series A No 251'B, § 29; Amann v Switzerland of 16 February 2000, ECHR 2000'II, § 65; and Rotaru v Romania of 4 May 2000, ECHR 2000'V, § 43). There is thus an area of interaction between the individual and others which, even in a public context, may fall within the concept of 'private life' (see ECHR judgment in Peck v United Kingdom of 28 January 2003, ECHR 2003'I, § 57, and case-law cited).
115. In order to determine whether there has been a breach of Article 8 of the ECHR, it needs to be determined, first, whether there has been an interference in the private life of the person concerned and, secondly, if so, whether that interference is justified. In order to be justified, it must be in accordance with the law, pursue a legitimate aim and be necessary in a democratic society. Concerning that latter condition, in order to determine whether a disclosure is 'necessary in a democratic society', it needs to be examined whether the grounds relied on in justification are 'relevant and sufficient', and whether the measures adopted are proportionate to the legitimate aims pursued. In cases concerning the disclosure of personal data, the European Court of Human Rights has recognised that the competent authorities have to be granted a certain discretion in order to establish a fair balance between competing public and private interests. That margin of discretion is, however, accompanied by judicial review, and its breadth is to be determined by reference to factors such as the nature and importance of the interests at stake and the seriousness of the interference (see Peck v United Kingdom, especially § 76 and 77; see also the Opinion of Advocate General Léger in Joined Cases C-317/04 and C-318/04 Parliament v Council and Commission [2006] ECR I-4721, I'4724, points 226 to 228).
116. Any decision taken pursuant to Regulation No 1049/2001 must comply with Article 8 of the ECHR, in accordance with Article 6(2) EU. In that regard it should be noted that Regulation No 1049/2001 determines the general principles and the limits which, for reasons of public or private interest, govern the exercise of the right of access to documents, in accordance with Article 255(2) EC. Therefore, Article 4(1)(b) of that regulation provides an exception designed to ensure protection of the privacy and integrity of the individual.
117. Moreover, exceptions to the principle of access to documents must be interpreted restrictively. The exception under Article 4(1)(b) of Regulation No 1049/2001 concerns only personal data that are capable of actually and specifically undermining the protection of privacy and the integrity of the individual.
118. It should also be emphasised that the fact that the concept of 'private life' is a broad one, in accordance with the case-law of the European Court of Human Rights, and that the right to the protection of personal data may constitute one of the aspects of the right to respect for private life (see, to that effect, the Opinion of Advocate General Leger in Parliament v Council and Commission, point 209), does not mean that all personal data necessarily fall within the concept of 'private life'.
119. A fortiori, not all personal data are by their nature capable of undermining the private life of the person concerned. In recital 33 of Directive 95/46, reference is made to data which are capable by their nature of infringing fundamental freedoms or privacy and which should not be processed unless the data subject gives his explicit consent, which implies that not all data are of that nature. Such sensitive data may be included in those referred to by Article 10 of Regulation No 45/2001, concerning processing relating to particular categories of data, such as those revealing racial or ethnic origin, religious or philosophical beliefs, or data concerning health or sex life.
120. It follows from the whole of the above that, in order to be able to determine whether the exception under Article 4(1)(b) of Regulation No 1049/2001 applies, it is necessary to examine whether public access to the names of the participants at the meeting of 11 October 1996 is capable of actually and specifically undermining the protection of the privacy and the integrity of the persons concerned.

Application to this case of the exception concerning the undermining of the protection of the privacy and integrity of the persons concerned, laid down in Article 4(1)(b) of Regulation No 1049/2001

121. In this case, the request for access at issue concerns the minutes of a Commission meeting, attended by officers of the DG for the Internal Market and Financial Services, officials of the United Kingdom Government Department of Trade and Industry and representatives of the CBMC. Those minutes contain a list of the participants at the meeting, classified by reference to the bodies in the name of which and on behalf of which those persons attended, described by their title, the initial of their forename, their surname and, where relevant, the service, department or association to which they belong within those bodies. The text of the minutes refers not to physical persons but to the bodies in question, such as the CBMC, the DG for the Internal Market and Financial Services, or the United Kingdom Department of Trade and Industry.
122. The list of meeting participants appearing in the minutes in question thus contains personal data for the purposes of Article 2(a) of Regulation No 45/2001, since the persons who participated in that meeting can be identified in them.
123. However, the mere fact that a document contains personal data does not necessarily mean that the privacy or integrity of the persons concerned is affected, even though professional activities are not, in principle, excluded from the concept of 'private life' within the meaning of Article 8 of the ECHR (see paragraph 114 above, and the case-law of the European Court of Human Rights cited there).
124. As the Commission itself has indicated, the persons present at the meeting of 11 October 1996, whose names have not been disclosed, were present as representatives of the CBMC and not in their personal capacity. The Commission has also indicated that the consequences of the decisions taken at the meeting concerned the bodies represented and not their representatives in their personal capacity.
125. In those circumstances, this Court finds that the fact that the minutes contain the names of those representatives does not affect the private life of the persons in question, given that they participated in the meeting as representatives of the bodies to which they belonged. Moreover, as noted above, the minutes do not contain any individual opinions attributable to those persons, but positions attributable to the bodies which those persons represented.
126. In any event, disclosure of the names of the CBMC representatives is not capable of actually and specifically affecting the protection of the privacy and integrity of the persons concerned. The mere presence of the name of the person concerned in a list of participants at a meeting, on behalf of the body which that person represented, does not constitute such an interference, and the protection of the privacy and integrity of the persons concerned is not compromised.
127. That approach is not contradicted by the judgment in ÖsterreichischerRundfunk, relied on by the Commission. In that judgment, the Court held that the gathering of data with names concerning the income of an individual, with a view to communicating those data to third parties, fell within the scope of Article 8 of the ECHR. It held that, whilst the mere recording by an employer of data by name relating to the remuneration paid to his employees could not as such constitute an interference with private life, the communication of that data to third parties, in that case a public authority, infringed the right of the persons concerned to respect for private life, whatever the subsequent use of the information thus communicated, and constituted an interference within the meaning of Article 8 of the ECHR (ÖsterreichischerRundfunk, paragraph 74). The Court added that, to establish the existence of such an interference, it did not matter whether the information communicated was of a sensitive character or whether the persons concerned had been inconvenienced in any way. It was sufficient to find that data relating to the remuneration received by an employee or pensioner had been communicated by the employer to a third party (ÖsterreichischerRundfunk, paragraph 75).
128. This Court finds that the circumstances of that case are different from those at issue here. This case falls within the application of Regulation No 1049/2001, and the exception laid down by Article 4(1)(b) of that regulation concerns only the disclosure of personal data which would undermine the protection of the privacy and integrity of the individual. As established in paragraph 119 above, not all personal data are capable by their nature of undermining the private life of the person concerned. In the circumstances of this case, the mere disclosure of the participation of a physical person, acting in a professional capacity, as the representative of a collective body, at a meeting held with a Community institution, where the personal opinion expressed by that person on that occasion cannot be identified, cannot be regarded as an interference with that person's private life. A distinction must thus be drawn from the situation which obtained in ÖsterreichischerRundfunk, where the matter at issue was the gathering and communication by an employer to a public authority of a specific combination of personal data, namely the names of employees and the income received by them.
129. In its judgment in Lindqvist, also relied upon by the Commission, the Court held that an operation consisting of referring to various persons on an internet page and identifying them either by name or by other means, such as their telephone number or information on their working conditions and pastimes, constituted 'the processing of personal data wholly or partly by automatic means' within the meaning of Directive 95/46 (Lindqvist, paragraph 27). That judgment is not decisive for the present case. As stated in the previous paragraph, this case falls under Regulation No 1049/2001, and the matter at issue is therefore, in addition to whether a processing of personal data is involved, to determine whether the disclosure of the data in question would undermine the privacy and integrity of the individual.
130. Nor does the approach of the Court of First Instance contradict the case-law of the European Court of Human Rights, according to which the right to respect for private life includes the right of the individual to establish and develop relations with others and may extend to professional or business activities (Niemietz v Germany, § 29; Amann v Switzerland, § 65; Rotaru v Romania, § 43, and Peck v UnitedKingdom, § 57).
131. Even if one cannot, a priori, exclude the possibility that the concept of private life may cover certain aspects of the professional activity of an individual, that does not mean that any professional activity is wholly and necessarily covered by protection of the right to respect for private life. In this case, the Court takes the view that the mere participation of a representative of a collective body in a meeting held with a Community institution does not fall within the sphere of that person's private life, so that the disclosure of minutes revealing his presence at that meeting cannot constitute an interference with his private life.
132. Thus, the disclosure of the names in question does not lead to an interference with the private life of the persons who participated in the meeting and would not undermine the protection of their private life and the integrity of their person.
133. The Commission is therefore wrong in its view that the exception under Article 4(1)(b) of Regulation No 1049/2001 had to be applied in this case.
134. Moreover, the Commission does not claim that, in this case, at the time of the gathering of the data, namely at the meeting of 11 October 1996, it undertook to keep the names of the participants secret, or that the participants requested at that meeting that the Commission not reveal their identity. It was not until 1999, when the Commission requested authorisation to reveal their identity, that certain participants refused to allow their name to be disclosed.
135. Since in this case the condition under Article 4(1)(b) of Regulation No 1049/2001 that protection of the relevant person's privacy and integrity must be affected has not been fulfilled, refusal by that person cannot prevent disclosure. Moreover, the Commission has not even attempted to establish that the persons who refused, after the meeting, to allow disclosure of their name had demonstrated that protection of their privacy and integrity would be affected by disclosure.
136. It should also be noted in that respect that, in the end, the Commission received refusals from only two of the persons in question, and that it was not able to contact the three other persons in question, whose names it had also not disclosed (see paragraph 35 above).
137. The persons who participated in that meeting had no grounds for believing that the opinions expressed in the name of and on behalf of the bodies they represented enjoyed confidential treatment. This was a meeting held in the context of proceedings for failure to fulfil obligations. Although, under such proceedings, the applicant may, pursuant to internal Commission rules, choose confidential treatment, there is no provision for such treatment in respect of the other persons participating in the investigations. Moreover, since the Commission disclosed the minutes, albeit with certain names removed, it clearly took the view that this was not information covered by business secrecy. Regulation No 45/2001 does not require the Commission to keep secret the names of persons who communicate opinions or information to it concerning the exercise of its functions.
138. As for the Commission's argument that the applicant has never satisfied the obligation to prove the necessity for transfer, as provided under Article 8(b) of Regulation No 45/2001, it is sufficient to note that, as held in paragraphs 107 and 108 above, where the disclosure gives effect to Article 2 of Regulation No 1049/2001 and does not fall under the exception laid down by Article 4(1)(b) of that regulation, the applicant has no need to prove necessity for the purposes of Article 8(b) of Regulation No 45/2001. Therefore, the Commission's argument that communication of the identity of the participants would not have thrown any additional light on the decision to close the proceedings for failure to fulfil obligations cannot succeed.
139. The Commission therefore erred in law by holding, in the contested decision, that the applicant had not established either an express and legitimate purpose or any need to obtain the names of the five persons who participated in the meeting and who, after that meeting, objected to communication of their identity to the applicant.
140. It is also necessary to examine the application of the exception under the third indent of Article 4(2) of Regulation No 1049/2001.

The exception concerning protection of the purpose of inspections, investigations and audits

141. Under the third indent of Article 4(2) of Regulation No 1049/2001, the institutions must refuse access to a document where disclosure would undermine the protection of the purpose of inspections, investigations and audits, unless there is an overriding public interest in disclosure.
142. Although, by confusion, the applicant cites in its application Article 4(3) of Regulation No 1049/2001, its application should be interpreted as relying on the third indent of Article 4(2) of that regulation, since it is on that provision that the Commission based, in the alternative, its refusal to grant access to the full minutes. In any event, at the hearing, the applicant referred to the third indent of Article 4(2) of Regulation No 1049/2001.
143. It is for the institution to assess in each individual case whether the documents disclosure of which has been requested actually fall within the exceptions set out in the regulation concerning access to documents.
144. The document at issue in this case is the minutes of a meeting which took place in the context of proceedings for failure to fulfil obligations.
145. However, the fact that the document at issue is linked to proceedings for failure to fulfil obligations, and thus concerns investigations, cannot in itself justify applicant of the exception pleaded (see, to that effect, Bavarian Lager v Commission, paragraph 41). As stated above, any exception to the right of access to documents under Regulation No 1049/2001 must be interpreted and applied strictly (Case T-20/99 Denkavit Nederland v Commission [2000] ECR II-3011, paragraph 45).
146. In that respect, it should be remembered that the Commission's investigations were already over at the time the contested decision was adopted, on 18 March 2004. Indeed, it had already closed the infringement proceedings against the United Kingdom without taking any further action on 10 December 1997.
147. It thus needs to be examined in this case whether the document concerning investigations was covered by the exception under the third indent of Article 4(2) of Regulation No 1049/2001, whereas the investigation was complete and infringement proceedings closed for more than six years.
148. The Court of First Instance has already had occasion to hold that the third indent of Article 4(2) of Regulation No 1049/2001, which is designed to protect 'the purpose of inspections, investigations and audits', applies only where disclosure of the documents in question risks jeopardising the completion of the inspections, investigations or audits (Franchet and Byk, paragraph 109).
149. It should be noted that that exception, from the way in which it is formulated, is designed not to protect investigations as such but the purpose of those investigations, which, as is shown in the judgment in BavarianLager v Commission (paragraph 46), consists, in the case of proceedings for failure to fulfil obligations, in causing the Member State concerned to comply with Community law. In this case, the Commission had already closed the infringement proceedings against the United Kingdom on 10 December 1997, since the latter had amended the legislation at issue and the purpose of the investigations had thus been achieved. Thus, at the time the contested decision was adopted, no investigation whose purpose could have been jeopardised by disclosure of the minutes containing the names of certain representatives of bodies which participated in the meeting of 11 October 1996 was in progress, with the result that the exception under the third indent of Article 4(2) of Regulation No 1049/2001 cannot be applied in this case.
150. In order to justify its refusal to disclose the whole of the minutes in question, the Commission further argues that, if the names of persons who have supplied information to the Commission could be disclosed against their wishes, the Commission could be deprived of a precious source of information, which could compromise its ability to conduct investigations into presumed infringements of Community legislation.
151. In that regard it should be noted that, according to consistent case-law, the assessment required for processing an application for access to documents must be of a concrete nature. First, the mere fact that a document concerns an interest protected by an exception is not sufficient to justify that exception being applied (see, to that effect, Denkavit Nederland, paragraph 45). Secondly, the risk of a protected interest being affected must be reasonably foreseeable and not merely hypothetical. Therefore, the assessment which the institution must undertake in order to apply an exception must be carried out in a concrete way and be apparent from the grounds of the decision (Case T-188/98 Kuijer v Council [2000] ECR II-1959, paragraph 38; Case T-2/03 Verein für Konsumenteninformation v Commission [2005] ECR II-1121, paragraphs 69 and 72; and Franchet and Byk, paragraph 115).
152. Thus, whilst it must be acknowledged that the need to preserve the anonymity of persons providing the Commission with information on possible infringements of Community law constitutes a legitimate objective capable of justifying the Commission in not granting complete, or even partial, access to certain documents, the fact remains that, in this case, the Commission ruled in the abstract on the effect which disclosure of the document concerned with names might have on its investigative activity, without demonstrating to a sufficient legal standard that disclosure of that document would actually and specifically undermine protection of the purposes of investigations. Thus it has not been shown in this case that the purpose of investigations was actually and specifically jeopardised by the disclosure of data requested six years after the closure of those investigations.
153. Moreover, as stated above, the procedure for failure to fulfil obligations does not provide for confidential treatment for persons who participated in the investigations, save for the complainant. It appears that, if the Commission disclosed the minutes in question without the names of persons who had not given authorisation for their names to be disclosed, that is because it considered, in principle, that disclosure of that document did not fall within the exception under the third indent of Article 4(2) of Regulation No 1049/2001.
154. In that respect, the Commission's reference during the hearing to Case 145/83 Adams v Commission [1985] ECR 3539 concerning the confidentiality of information covered by business secrecy is not relevant. That case concerned an informer who had denounced anti-competitive practices of his employer and whose identity the Commission had to keep secret. That informer had specifically asked it not to reveal his identity from the beginning of the proceedings. In this case, however, as stated above, the Commission has not shown that, at the time they participated in the meeting in question, the persons concerned had reasonable grounds for believing that they enjoyed confidential treatment of any kind, or that they had asked the Commission not to reveal their identity. Moreover, as stated in paragraph 137 above, given that the Commission disclosed the minutes, albeit with certain names removed, it must have taken the view that this was not information covered by business secrecy. Finally, the Commission has not put forward any argument to demonstrate in what way disclosure of the names of the persons who refused their consent could have harmed any investigations involved in this case.
155. In those circumstances, the arguments based on protection of the purposes of inspections and investigations cannot succeed.
156. There is therefore no need to examine the possible existence of a higher public interest justifying disclosure of the document concerned.
157. It follows from the whole of the above that the full minutes of the meeting of 11 October 1996, containing all the names, does not fall within the exceptions under Article 4(1)(b) or the third indent of Article 4(2) of Regulation No 1049/2001.
158. The contested decision must therefore be annulled.

Costs

159. Under Article 87(2) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party's pleadings. Since the Commission has been unsuccessful, it must be ordered to pay the applicant's costs, as the applicant has pleaded.
160. Under the third subparagraph of Article 87(4) of the Rules of Procedure, the Court of First Instance may order an intervener to bear his own costs. In this case, the intervener in support of the applicant is ordered to bear his own costs.

On those grounds,

THE COURT OF FIRST INSTANCE (Third Chamber)

hereby:

1. Annuls the Commission's decision of 18 March 2004, rejecting an application for access to the full minutes of the meeting of 11 October 1996, containing all the names;

2. Orders the Commission to pay the costs incurred by The Bavarian Lager Co. Ltd;

3. Orders the European Data Protection Supervisor (EDPS) to bear his own costs.

Jaeger

Tiili

Czúcz

Delivered in open court in Luxembourg on 8 November 2007.

E. Coulon

M. Jaeger

Registrar

President

---

* Language of the case: English.