Court of Justice of the European Communities (including Court of First Instance Decisions)

JUDGMENT OF THE GENERAL COURT (Fifth Chamber)

19 November 2014 (*)

(Access to documents — Regulation (EC) No 1049/2001 — Article 4(2), third indent — Final audit reports carried out on the ECDC by the Commission’s Internal Audit Service — Refusal of access — Obligation to state reasons — Obligation to undertake a concrete, individual examination — Overriding public interest)

In Case T‑223/12,

Ioannis Ntouvas, residing in Agios Stefanos (Attica, Greece), represented initially by E. Mylonas, and subsequently by V. Kolias, lawyers,

applicant,

v

European Centre for Disease Prevention and Control (ECDC), represented initially by R. Trott, and subsequently by J. Mannheim and A. Daume, acting as Agents, assisted by D. Waelbroeck and A. Duron, lawyers,

defendant,

APPLICATION for annulment of the decision of the ECDC of 27 March 2012 (DIR-12-0636-MSrukr) refusing the applicant access to the final audit reports carried out on the ECDC by the Internal Audit Service of the European Commission,

THE GENERAL COURT (Fifth Chamber),

composed of A. Dittrich, President, J. Schwarcz (Rapporteur) and V. Tomljenović, Judges,

Registrar: C. Kristensen, Administrator,

having regard to the written procedure and further to the hearing on 10 July 2014,

gives the following

Judgment

 Background to the dispute

1        By email of 3 February 2012 the applicant, Mr Ioannis Ntouvas, submitted the following request to the Head of the ‘Management and Coordination of Resources’ Unit of the European Centre for Disease Prevention and Control (ECDC):

‘Acting in my private capacity I hereby would like to request access to any, and all, final audit/investigation/inquiry reports as may be held by the ECDC and as resulting from respective audits/investigations/inquiries performed upon ECDC since its establishment in 2005 by the [Court of Auditors], the Internal Audit Service of the European Commission, the [European] Anti-Fraud Office (OLAF) … and the European Data Protection Supervisor [(EDPS)].’

2        By email of 24 February 2012 and letter of 29 February 2012, the ECDC first of all replied to the applicant stating that all final audit reports issued by the Court of Auditors of the European Union were available on the web site ‘eur lex.europa.eu’ and provided him with the links. The ECDC then stated that the reports from the Internal Audit Service of the European Commission (‘the IAS’) were confidential internal documents and that they could not be disclosed to the public. Finally, neither the European Anti-Fraud Office (OLAF) nor the European Data Protection Supervisor (EDPS) ever issued a report, or indeed a final report, concerning the ECDC.

3        By email of 7 March 2012, the applicant submitted a confirmatory application to the Director of the ECDC as follows:

‘I hereby kindly request that you reconsider your decision to refuse me access to IAS reports …’

4        By letter of 27 March 2012 (DIR-12-0636-MSrukr), with a postmark dated 29 March 2012, received, according to the applicant, on 30 March 2012, the Director of the ECDC confirmed the decision refusing access to those reports (‘the contested decision’). That letter read as follows:

‘Further to my letter of 24 February 2012 … and your email of 7 March 2012, I confirm that reports of the [IAS] are confidential internal documents and cannot be disclosed in accordance with the Internal Procedure on Public Access to Documents (4.2. Exceptions) and Article 4 of [Regulation No 1049/2001]. The disclosure of the reports would undermine the protection of the purpose of the audits. I therefore cannot grant you access to these reports.’

 Procedure and forms of order sought

5        The applicant brought this action by application lodged at the Registry of the General Court on 28 May 2012.

6        Upon hearing the Report of the Judge-Rapporteur, the Court decided to open the oral procedure.

7        The parties presented oral argument and replied to the questions put by the Court at the hearing on 10 July 2014.

8        The applicant claims that the Court should:

–        annul the contested decision;

–        order the ECDC to pay the costs.

9        The ECDC contends that the Court should:

–        dismiss the action;

–        order the applicant to pay the costs.

 Law

10      The applicant submits two pleas in law. The first alleges infringement of the duty to give reasons. In the second plea, the applicant claims, in essence, that by failing to give adequate reasons for its refusal to disclose the documents requested, the ECDC was also in breach of its obligation under Article 2(1) and Article 8(1) of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43) and Article 15(3) TFEU to grant him access to the documents requested within 15 working days of registration of his confirmatory application.

11      As regards the first plea in law, referring in particular to the judgment of the Court of Justice in Case C‑139/07 P Commission v Technische Glaswerke Ilmenau [2010] ECR I‑5885, paragraph 53, and the judgment of the General Court in Joined Cases T‑355/04 and T‑446/04 Co Frutta v Commission [2010] ECR II‑1, paragraph 123, the applicant considers that institutions and bodies of the European Union, such as the ECDC, are required to examine specifically and individually the documents which they hold and to which access has been requested, to explain to the applicant, where access is denied, whether and how an exception applies and to describe specifically and effectively any interest prevailing over the applicant’s right of access. In the event of a refusal to disclose, the institutions and bodies of the European Union are also required to examine and explain to the applicant that there is no overriding public interest justifying disclosure of the documents referred to.

12      The applicant claims that, in accordance with Case T‑29/08 LPN v Commission [2011] ECR II‑6021, paragraph 112, that examination must be apparent from the reasons for the decision of the EU institution or body as regards all the exceptions mentioned in Article 4(1) to (3) of Regulation No 1049/2001 on which that decision is based.

13      The applicant submits, in essence, that the manner in which the ECDC carried out those examinations is not apparent from the contested decision. In order to refuse access to the final reports of the audits carried out on the ECDC by the IAS, the ECDC relied on the exception in the third indent of Article 4(2) of Regulation No 1049/2001 in an abstract and general way.

14      Thus by failing to give adequate reasons in the contested decision, the ECDC infringed an essential procedural requirement laid down in Article 8(1) of Regulation No 1049/2001 and in Article 41(2)(c) of the Charter of Fundamental Rights of the European Union.

15      The ECDC claims, first of all, that even though the applicant’s initial request for access to ‘any and all’ documents in the four categories referred to in that provision (paragraph 1 above) may be construed, in itself, as abstract and general, and even though it is permissible for an EU institution or body to base its decision to deny access to specific categories of documents on general criteria, it nevertheless examined each document requested individually and did not refuse access to the documents requested as a specific category. In particular the ECDC identified all the documents requested by the applicant and granted access to them wherever possible.

16      However, the ECDC contends that no provision obliges it to explain to the applicant whether it has carried out an examination of that type.

17      Next, in order to determine that the final audit reports drawn up by the IAS concerning the ECDC could not be disclosed, the ECDC first relied on the fact that each of the reports in question bore either the comment ‘[t]his IAS Audit Report is covered by a Marking provided for by [Decision 2001/844], which imposes a constraint on its use and distribution’, together with the comment ‘[i]t is destined exclusively for the Services to which it has been expressly addressed and should not be communicated to other Services or third parties’, or the comment ‘reports are marked as limited distribution in accordance with Decision [2001/844]’.

18      Finally, the ECDC considers that, because of his functions as a legal assistant and later as a legal officer within the ECDC, and the tasks which he performed, the applicant cannot claim to be unaware of the purpose of audit reports produced by the IAS or why disclosure of those reports would undermine their purpose. It states, in that regard, that the applicant took part in the production of training materials on ‘Ethics and Integrity’ which he presented on 14 occasions in 2010 and 2011. In that context, he specifically examined the role of the IAS.

19      In that regard, it must be stated that it is clear from Article 8(1) of Regulation No 1049/2001 that ‘within 15 working days from registration of such a [confirmatory] application, the institution shall either grant access to the document requested … or, in a written reply, state the reasons for the total or partial refusal’. That provision thus establishes a particular expression of the general obligation to state reasons laid down in Article 296 TFEU.

20      According to settled case-law, the statement of reasons required under Article 296 TFEU must be appropriate to the measure in question and must disclose in a clear and unequivocal fashion the reasoning followed by the institution or body which adopted that measure, in such a way as to enable the persons concerned to ascertain the reasons for the measure and to enable the EU judicature to carry out its review. The requirements to be satisfied by the statement of reasons depend on the circumstances of each case, in particular the content of the measure in question, the nature of the reasons given and the interest which the addressees of the measure, or other parties to whom it is of direct and individual concern, may have in obtaining explanations. It is not necessary for the reasoning to go into all the relevant facts and points of law since the question whether the statement of reasons meets the requirements of Article 296 TFEU must be assessed with regard not only to its wording but also to its context and to all the legal rules governing the matter in question (see Case T‑300/10 Internationaler Hilfsfonds v Commission [2012] ECR, paragraph 181 and the case-law cited).

21      Thus, it should be noted that, in accordance with recital 1 of Regulation No 1049/2001, that regulation reflects the intention expressed in the second paragraph of Article 1 TEU — inserted by the Treaty of Amsterdam — of marking a new stage in the process of creating an ever closer union among the peoples of Europe, in which decisions are taken as openly as possible and as closely as possible to the citizen. As stated in recital 2 of that regulation, right of public access to documents of the institutions reflects the democratic nature of those institutions (see Case C‑506/08 P Sweden v MyTravel and Commission [2011] ECR I‑6237, paragraph 72 and the case-law cited).

22      To that end, Regulation No 1049/2001 is intended, as is apparent from recital 4 and Article 1, to give the fullest possible effect to the right of public access to documents of the institutions (see Sweden v MyTravel and Commission, referred to in paragraph 21 above, paragraph 73 and the case-law cited).

23      However, that right is none the less subject to certain limitations based on grounds of public or private interest. More specifically, in reflection of recital 11 in the preamble, Article 4 of Regulation No 1049/2001 provides for a number of exceptions enabling the institutions to refuse access to a document where its disclosure would undermine the protection of one of the interests covered by that provision (see Sweden v MyTravel and Commission, referred to in paragraph 21 above, paragraph 74 and the case-law cited).

24      The system of exceptions laid down in Article 4 of Regulation No 1049/2001, particularly in paragraph 2 of that article, is based on a balancing of the opposing interests in a given situation, that is to say, first, the interests which would be favoured by the disclosure of the documents in question and, secondly, those which would be jeopardised by such disclosure. The decision taken on a request for access to documents depends on which interest must prevail in the particular case (Joined Cases C‑514/11 P and C‑605/11 P LPN and Finland v Commission [2013] ECR, paragraph 42).

25      However, since they derogate from the principle of the widest possible public access to documents, those exceptions must be interpreted and applied strictly (see Sweden v MyTravel and Commission, referred to in paragraph 21 above, paragraph 75 and the case-law cited).

26      According to the ECDC, since all the documents for which access was denied are audit reports they come within the exception laid down in the third indent of Article 4(2) of Regulation No 1049/2001.

27      However, it is clear from the case-law that the fact that a document is related to an audit, within the meaning of the third indent of Article 4(2) of Regulation No 1049/2001, in principle cannot, by itself, be sufficient ground for the applicability of the exception provided for by that provision, taking into consideration the need to interpret and apply strictly the exceptions mentioned in Article 4(2). The risk of the protected interest being undermined must be reasonably foreseeable and not purely hypothetical. The institution concerned must also provide explanations relating to the issue of whether access to the requested documents could specifically and effectively undermine the interest protected by the exception among those provided for in that article (see Joined Cases C‑39/05 P and C‑52/05 P Sweden and Turco v Council [2008] ECR I‑4723, paragraphs 43 and 63, and LPN and Finland v Commission, referred to in paragraph 24 above, paragraph 44 and the case-law cited).

28      Moreover, as is clear from its wording, that exception is not designed to protect audits as such, but their purpose (see, to that effect, Case T‑471/08 Toland v Parliament [2011] ECR II‑2717, paragraph 43).

29      As concerns the purpose of the IAS audits, it is clear from Article 85(1) of Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities (OJ 2002 L 248, p. 1) (now Article 98(1) of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council of 25 October 2012 on the financial rules applicable to the general budget of the European Union and repealing Council Regulation No 1605/2002 (OJ 2012 L 298, p. 1)) that the internal auditor appointed by the institution, that is to say the IAS, in the case of the Commission (Commission Decision SEC(2000) 560 of 11 April 2000), ‘shall be answerable to the latter for verifying the proper operation of budgetary implementation systems and procedures’.

30      Article 86(1) of Regulation No 1605/2002 (now Article 99(1) of Regulation No 966/2012) provides that ‘[t]he internal auditor shall advise his/her institution on dealing with risks, by issuing independent opinions on the quality of management and control systems and by issuing recommendations for improving the conditions of implementation of operations and promoting sound financial management’.

31      When access to a document is refused, it is in principle for the institution or body in question to ascertain whether there is any overriding public interest justifying disclosure despite the resulting adverse effect on the interest protected by the exception concerned (Sweden and Turco v Council, referred to in paragraph 27 above, paragraphs 44 and 45).

32      The entire examination, in principle, must be not only complete and individual and concern the content of each document, but it must also be apparent from the reasons for the decision refusing access to the documents requested as regards all the exceptions referred to in Article 4(1) to (3) of Regulation No 1049/2001 on which that decision is based (see, to that effect, Case T‑2/03 Verein für Konsumenteninformation v Commission [2005] ECR II‑1121, paragraphs 69 to 74).

33      There are however exceptions to the obligation of the institution or body in question to examine specifically and individually the documents to which access has been requested.

34      The Court of Justice has held that it is open to the institution or body concerned to base its decisions in that regard on general presumptions which apply to certain categories of documents, as considerations of a generally similar kind are likely to apply to requests for disclosure relating to documents of the same nature, particularly where the request for access in question is ‘global’ in that it refers not to a single document, but to a range of documents (see Case C‑365/12 P Commission v EnBW Energie Baden-Württemberg [2014] ECR, paragraphs 65, 67 and 68 and the case-law cited).

35      However, it has also been held that the institution or body concerned is not required to base its decisions denying access to the documents on one of the general presumptions. In such a situation, it is still possible to carry out a specific examination of the documents covered by the request for access and to provide such reasons (LPN and Finland v Commission, referred to in paragraph 24 above, paragraph 67, and judgment of 20 March 2014 in Case T‑181/10 Reagens v Commission, not published in the ECR, paragraph 65).

36      In the present case, although the request for access must be regarded as ‘global’ for the purposes of the case-law cited in paragraph 34 above, the ECDC claims, in essence, that in order to refuse access to the final audit reports of the IAS relating to it, it did not rely on any presumption, but carried out a specific and individual examination of each document requested. It was therefore up to the ECDC to justify its decision accordingly.

37      It is, however, clear from the wording of the contested decision that no such examination was carried out. After referring to Article 4(2) of Regulation No 1049/2001, the contested decision merely states that disclosure of the reports at issue would undermine the purpose of the audits.

38      In particular, first, the contested decision does not indicate which documents were examined, the type of documents involved, their number and how access to those documents could specifically and effectively undermine the interest protected, having particular regard to the objectives pursued by the IAS audits (see, to that effect, Reagens v Commission, referred to in paragraph 35 above, paragraph 74).

39      Secondly, the contested decision does not contain an assessment of the possible existence of an overriding public interest justifying disclosure of the documents in question despite the resulting adverse effect on the interest protected by the exception in question.

40      At the hearing, the ECDC confirmed that it did not carry out such an examination, since the applicant never suggested which overriding public interest might have been involved. The applicant stated in that regard that his request had been made in the interests of EU citizens and taxpayers and involved a verification of the sound financial management of the ECDC and the lawfulness of the bidding processes within that body. However, according to the ECDC, such an interest cannot, in any event, be satisfied by the disclosure of the audit reports of the IAS. The sound financial management of the ECDC and the lawfulness of the bidding processes within that body are not covered by the audit reports of the IAS, but by those of the Court of Auditors which are available on the internet (paragraph 2 above).

41      The ECDC’s arguments cannot be accepted since, when access to the requested documents is denied and the general presumptions referred to in paragraph 34 above do not apply, it is for the ECDC to verify that there was no overriding public interest justifying that disclosure despite the resulting adverse effect on the interest protected by the exception concerned (Sweden and Turco v Council, referred to in paragraph 27 above, paragraphs 44 and 45). In addition, the interests pursued by the applicant in his request are not manifestly inappropriate with regard to the objectives pursued by the IAS (paragraphs 29 and 30 above), which include verifying the proper operation of budgetary implementation systems and procedures, dealing with risks, verifying the quality of management systems, monitoring and improving the conditions of implementation of operations and promoting sound financial management of the bodies being audited.

42      Thirdly, as regards the ECDC’s arguments concerning the ‘notices to recipients’ accompanying the audit reports produced by the ECDC in Annex B6 to the defence, those notices state that the content of the reports ‘should not be communicated to other Services or third parties without the express written consent of the [IAS]’. However, it is not apparent from the contested decision that the ECDC questioned the IAS in that regard, or, as the case may be, what the IAS’s response was. At the hearing, the ECDC confirmed that it did not seek the IAS’s opinion or indeed its authorisation in relation to the disclosure of the documents requested.

43      Fourthly, the contested decision does not specify whether the refusal of access was justified at the time of its adoption in relation to all the documents requested. It is, however, clear from the first sentence of Article 4(7) of Regulation No 1049/2001 that the exceptions referred to in paragraphs 1, 2 and 3 of that article apply only during the period in which the protection is justified having regard to the content of the documents. When questioned about this issue at the hearing, the ECDC did not define its position and left it to the Court to make an assessment.

44      Fifthly, contrary to what is laid down in Article 4(6) of Regulation No 1049/2001, it is not clear from the contested decision that the ECDC examined the possibility of partial disclosure of the final reports of the IAS concerning that body. At the hearing, the ECDC confirmed that it did not carry out such an examination since the applicant did not expressly request partial disclosure and the ECDC thus assumed that the applicant was interested only in full disclosure of the documents requested.

45      In that regard, according to Article 4(6) of Regulation No 1049/2001, if only parts of the requested document are covered by any of the exceptions, the remaining parts of the document are to be released. It is clear from the very wording of that provision that an institution or body is required to consider whether it is appropriate to grant partial access to requested documents and to limit any refusal to information covered by the relevant exceptions referred to. The institution or body must grant partial access if the aim pursued by that institution or body in refusing access to a document may be achieved where all that is required of them is to blank out the passages which might harm the public interest to be protected (judgment of 12 September 2013 in Case T‑331/11 Besselink v Council, not published in the ECR, paragraphs 82 and 84). Thus, as the applicant essentially claimed at the hearing, it must be assumed that the request for partial access to the documents in question was already implicitly, but necessarily, contained in his request. Therefore, the ECDC cannot raise against the applicant the fact that he did not expressly make such a request.

46      As regards the observation made by the ECDC that the applicant’s request was vague, suffice it to state that it is clear from Article 6(2) of Regulation No 1049/2001 that, if a request is not sufficiently precise, the institution or body concerned must ask the applicant to clarify the request and assist the applicant in doing so. As the applicant submits, since he was not invited by the ECDC to clarify his request, the ECDC cannot seek to rely on the allegedly vague nature of the applicant’s request.

47      In any event, the arguments put forward by the ECDC on these matters before the Court cannot be upheld, since they cannot even be implicitly inferred from the contested decision (see, to that effect, Verein für Konsumenteninformation v Commission, referred to in paragraph 32 above, paragraphs 69 to 74).

48      However, the ECDC claims that, because of his functions as a legal assistant and later as a legal officer within the ECDC, and the tasks which he performed, the applicant knew the reasons for the refusal to disclose the documents requested and therefore that the contested decision was sufficiently reasoned.

49      While, in accordance with the case-law cited in paragraph 19 above, it cannot be excluded that an EU institution or body is to take into account, in the statement of reasons of a given act, the relevant information which the addressees are or should reasonably be aware of, something the institution or body must demonstrate where appropriate, that cannot justify a total or almost total absence of reasons.

50      First, as is clear from the settled case-law set out in paragraph 20 above, the statement of reasons required must enable not only the persons concerned to ascertain the reasons for the adopted measure, but also the EU judicature to exercise its review. However, the wording of the contested decision contains only a peremptory statement, which amounts to no more than a reference to the relevant EU legislation, and does not contain any explanatory element of such a kind as to enlighten the Court as to the exact reasons which led the ECDC to deny access to the documents requested (see, by analogy, Case C‑76/00 P Petrotub and Republica v Council [2003] ECR I‑79). That fact alone is sufficient to establish a breach of the duty to state reasons.

51      Secondly, it could be considered that the applicant, because of his functions as a legal assistant and as a legal officer who took part in the production of training materials on ‘Ethics and Integrity’, which he himself presented on a number of occasions, and because of the drafting of opinions on how to handle requests under Regulation No 1049/2001, should have a certain degree of knowledge of the purpose of the reports of the IAS in general and of the applicable rules concerning access to documents. However, as the applicant essentially claims, it cannot be maintained that he also necessarily knew the exact reasons for refusing to disclose each document requested.

52      The applicant could not have been aware of the possible existence of final audit reports, the identity of their authors or their specific subject matter. Therefore, he could not have been aware of the ECDC’s reasoning concerning, in particular, the adverse effect which publication of each of the documents requested could specifically and individually have on the interest protected by the third indent of Article 4(2) of Regulation No 1049/2001 (paragraph 38 above), the possible existence of an overriding public interest justifying disclosure of the documents in question despite the adverse effect which disclosure of those documents could have on the protected interest (paragraph 39 above), the justification for the continued protection of each of the documents in question at the time when the contested decision was adopted (paragraph 43 above), any position adopted by the IAS with regard to disclosure of those documents (paragraph 42 above) and the possibility of partial disclosure of the documents (paragraph 44 above).

53      Furthermore, it must be pointed out, first, that the ECDC does not contest the applicant’s assertion that he never handled requests for access to audit reports under Regulation No 1049/2001.

54      Secondly, contrary to what the ECDC maintains, it does not appear from the documents which it submitted that the training provided by the applicant focused specifically on the role of supervising the IAS so that it enabled him to become a specialist in that field. Rather, it is clear from those documents that the aim of the training in question was much more general and broader, covering all the topics coming under professional ethics. For example, it included rules on good administrative practice, such as non-discrimination, proportionality, impartiality, the statutory rights and obligations of staff, the EU’s Financial Regulations, internal and external controls of the ECDC, access to documents and media relations. The relatively short duration of the training, having regard to the number of topics dealt with, that is to say half a working day or around four hours, reinforces the finding that the fact that he provided the training does not mean that the applicant is as specialised in that field as the ECDC alleges.

55      The statement of reasons in the contested decision is therefore not of the requisite legal standard.

56      It follows that the first plea in law must be upheld.

57      Consequently, the contested decision must be annulled and there is no need to give a ruling on the second plea.

 Costs

58      Under Article 87(2) of the Rules of Procedure of the General Court, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the ECDC has been unsuccessful, it must be ordered to pay the costs, as applied for by the applicant.

On those grounds,

THE GENERAL COURT (Fifth Chamber)

hereby:

1.      Annuls the decision of the European Centre for Disease Prevention and Control (ECDC) of 27 March 2012 (DIR-12-0636-MSrukr) refusing Mr Ioannis Ntouvas access to the final audit reports carried out on the ECDC by the Internal Audit Service of the European Commission;

2.      Orders the ECDC to pay the costs.

Delivered in open court in Luxembourg on 19 November 2014.

[Signatures]

* Language of the case: English.

© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.