Case T‑903/16

RE

v

European Commission

Judgment of the General Court (Ninth Chamber, Extended Composition), 14 February 2019

(Personal data — Protection of natural persons with respect to the processing of their data — Right of access to those data — Regulation (EC) No 45/2001 — Refusal to grant access — Actions for annulment — Email referring to an earlier partial refusal of access without carrying out a re-examination — Concept of a challengeable act within the meaning of Article 263 TFEU — Concept of a purely confirmatory act — Applicability to access to personal data — Substantial new facts — Interest in bringing proceedings — Admissibility — Obligation to state reasons)

1. EU institutions — Protection of individuals with regard to the processing of personal data — Regulation No 45/2001 — Right of access of an individual to data relating to him — New request for access to personal data to which access had previously been refused — Institution obliged to examine whether the earlier refusal of access remains justified — Act adopted after that fresh examination may be the subject of an action for annulment — Not purely confirmatory in character

   (Art. 263 TFEU; Charter of Fundamental Rights of the European Union, Arts 7 and 8(1); European Parliament and Council Regulation No 45/2001, Arts 13(c) and 20(1))

   (see paragraphs 45-52)

2. EU institutions — Protection of individuals with regard to the processing of personal data — Regulation No 45/2001 — Right of access of an individual to data relating to him — New request for access to personal data to which access had previously been refused — Institution obliged to examine whether the earlier refusal of access remains justified — Existence of substantial new facts justifying a new examination — No reference to those facts in the new request for access — Irrelevant

   (European Parliament and Council Regulation No 45/2001, Arts 13 and 20(1)(a) and (c))

   (see paragraphs 56-62)

3. Action for annulment — Natural or legal persons — Admissibility criteria — Interest in bringing proceedings — Action must be capable of procuring a benefit for the applicant

   (Art. 263 TFEU)

   (see paragraph 66)

4. EU institutions — Protection of individuals with regard to the processing of personal data — Regulation No 45/2001 — Right of access of an individual to data relating to him — Action for annulment challenging the refusal to grant the data subject access to the data relating to him — Interest in bringing proceedings — Person concerned having already had access to all or some of those data — Irrelevant

   (Art. 263 TFEU; European Parliament and Council Regulation No 45/2001, Art. 13)

   (see paragraphs 69-71)

5. EU institutions — Protection of individuals with regard to the processing of personal data — Regulation No 45/2001 — Right of access of an individual to data relating to him — Refusal to grant access — Obligation to state reasons — Scope — Reference to an earlier refusal to grant access without carrying out a fresh examination — Insufficient statement of reasons

   (Art. 296 TFEU; European Parliament and Council Regulation No 45/2001, Arts 13, 20(1)(a) and (c), and 20(3))

   (see paragraphs 75-82)

Résumé

In the judgment RE v Commission (T‑903/16) handed down on 14 February 2019, the General Court ruled on an application by a Commission employee seeking the annulment of a note rejecting a request for access to personal data. In the present case, the applicant was the subject of an administrative investigation carried out by the Security Directorate of the Commission. ( 1 ) That directorate, by the contested note, rejected the request by the applicant seeking, on the basis of Regulation No 45/2001, ( 2 ) access to his personal data. The Commission submitted inter alia, first, that that note was purely confirmatory of a previous refusal to grant access that had not been challenged by the applicant within the time limit for appeals and, second, that the applicant had no interest in bringing proceedings against that note since it related to personal data to which he had already had access.

As regards the admissibility of the claim for annulment, the General Court, in the first place held that, under Regulation No 45/2001, a person may, at any time, make a new request for access to personal data to which access has previously been refused. Such a request requires the institution concerned to examine whether the earlier refusal of access remains justified. Therefore, a fresh examination seeking to verify whether a previously adopted refusal to grant access to personal data remains justified leads to the adoption of an act which is not purely confirmatory of the earlier act, but constitutes an act that may be the subject of an action for annulment. First, it follows from Article 13(c) of Regulation No 45/2001, which allows the data subject to access his personal data ‘at any time’, that that person has a continuous and permanent right of access to those data. Second, the exemptions and restrictions laid down in Article 20(1) of Regulation No 45/2001 are applicable only in the period during which they remain necessary. Furthermore, in the context of the processing of personal data, the factual and legal situation of the data subject is, by its nature, liable to change over time, since the mere passage of time is capable of rendering the processing of data, which was initially lawful, unnecessary or even unlawful.

In the second place, the General Court observed that there was no provision in Regulation No 45/2001 that requires the data subject to set out the reasons for, or to justify, his request for access to his personal data. It follows that, as regards access to personal data an applicant may rely on the existence of substantial new facts justifying a new examination, even if he or she failed to refer to those facts in the request. In this case, since the reasons on which the earlier refusal to grant access were based were connected with the administrative investigation relating to the applicant, the General Court considered that the closure of the administrative investigation constituted a substantial new fact justifying the re-examination of the applicant’s right of access to his personal data. That examination was all the more justified since the applicant had allowed a reasonable time (more than 6 months) to elapse before presenting the Security Directorate with a fresh request for access to his personal data.

In the third place, the General Court considered that, in the context of Regulation No 45/2001, the data subject has a continuous and permanent right of access to his or her personal data; that right enables him or her, among other things, to make a request for access to personal data, including where the data subject has already been able to access all or part of those data. In those circumstances, the annulment of the contested note, including in so far as it relates to personal data to which the applicant has already had access, may have legal consequences for the applicant and procure a benefit for him.

Having regard to those considerations, the General Court held that the claim for annulment was admissible.

In the examination of the merits of the claim for annulment, the General Court upheld the plea alleging a breach of the obligation to state reasons. As regards a new refusal that was required to be taken after a re-examination, the reference to earlier decisions cannot constitute sufficient reasoning. Therefore, the General Court annulled the contested note, in so far as it rejected the applicant’s request to be granted access to some of his personal data.

( 1 ) The Security Directorate of the Directorate-General for Human Resources and Security of the Commission.

( 2 ) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1).