1

The European Border and Coast Guard Agency (Frontex) (‘the Agency’) was created in 2004 and is currently governed by Regulation (EU) 2016/1624 of the European Parliament and of the Council of 14 September 2016 on the European Border and Coast Guard and amending Regulation (EU) 2016/399 of the European Parliament and of the Council and repealing Regulation (EC) No 863/2007 of the European Parliament and of the Council, Council Regulation (EC) No 2007/2004 and Council Decision 2005/267/EC (OJ 2016 L 251 p. 1).

2

In accordance with Article 1 of Regulation 2016/1624, the European Border and Coast Guard, consisting of, according to Article 3 of that regulation, Frontex and the national authorities of Member States responsible for border management, aims to ensure European integrated border management at the external borders, which ‘includes addressing migratory challenges and potential future threats at those borders, thereby contributing to addressing serious crime with a cross-border dimension, to ensure a high level of internal security within the Union in full respect for fundamental rights, while safeguarding the free movement of persons within it’.

3

Frontex assists the border management and coast guard agencies of the Member States, notably by coordinating the latter through ‘joint operations’ conducted with a host Member State and other Member States. The rules of engagement, resources, personnel, equipment and infrastructure used by participants are set out in the operation plan specific to each operation.

4

Frontex launched Operation Triton at the beginning of November 2014, after receiving an additional budget allocation from the European Commission.

5

Operation Triton was aimed at improving border surveillance and control through joint patrols and using the assets provided by the Member States. Its operational area covered the territorial waters of Italy and Malta, as well the search and rescue zones of both those Member States, up to 138 nautical miles south of Sicily.

6

Operation Triton 2017 started on 1 January 2017 and ended on 31 January 2018.

7

Under Article 74(1) of Regulation 2016/1624, ‘[Frontex] shall be subject to Regulation (EC) No 1049/2001 [of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43)] when handling applications for access to documents held by it’.

8

Article 8(3) of Regulation 2016/1624 provides the following:

‘The Agency shall engage in communication activities on its own initiative on matters falling within its mandate. It shall provide the public with accurate and comprehensive information about its activities.

Communication activities shall not be detrimental to the tasks referred to in paragraph 1, in particular by revealing operational information which, if made public, would jeopardise attainment of the objective of operations. Communication activities shall be carried out without prejudice to Article 50 and in accordance with relevant communication and dissemination plans adopted by the management board.’

9

Article 74(2) of Regulation 2016/1624 lays down the following:

‘[Frontex] shall communicate on matters falling within the scope of its tasks on its own initiative. It shall make public relevant information including [an] annual activity report … and ensure … in particular that the public and any interested party are rapidly given objective, comprehensive, reliable and easily understandable information with regard to its work. It shall do so without revealing operational information which, if made public, would jeopardise attainment of the objective of operations.’

10

By email of 1 September 2017, the applicants, Ms Luisa Izuzquiza and Mr Arne Semsrott, under Article 6(1) of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p.43), submitted a request to Frontex for access to documents containing information on the name, type and flag of every vessel which it had deployed between 1 June and 30 August 2017 in the central Mediterranean under Joint Operation Triton.

11

By letter of 8 September 2017, sent to the applicants on the same day, Frontex refused access to the requested documents on the basis of the exception provided for in the first indent of Article 4(1)(a) of Regulation No 1049/2001 relating to the protection of the public interest in the field of public security.

12

In that letter, Frontex stated:

‘The information contained in the requested document would [make it possible], combining it with information publicly available such as on www.marinetraffic.com, to become aware of the current position of the patrolling vessels.

In possession of this information, criminal networks involved in migrant smuggling and trafficking of human beings would be aware of patrolling areas and patrolling schedules of the law enforcement vessels. This will allow these criminal networks to adapt their modus operandi accordingly in order to circumvent border surveillance and consequently cross the external border and access, irregularly, the territory of an EU Member State.

Border surveillance [is aimed] at combating illegal immigration and trafficking in human beings, and [preventing] any threat to the Member States’ internal and public security.’

13

By email of 29 September 2017, the applicants made a confirmatory application under Article 7(2) of Regulation No 1049/2001.

14

In their confirmatory application, the applicants claimed, first, that the name, flag and type of each vessel involved in Operation Sophia of the EEAS (European External Action Service) were proactively published online and actively publicised, secondly, that the name, flag and type of each vessel involved in Operation Triton 2016 were then available online and, thirdly, that on 12 September 2017 Frontex had proactively published on Twitter part of the information requested.

15

By email of 17 October 2017, Frontex requested a deadline extension of 15 working days on the basis of Article 8(2) of Regulation No 1049/2001.

16

By Decision CGO/LAU/18911c/2017 of 10 November 2017 (‘the contested decision’), Frontex confirmed the refusal to divulge the documents requested on the ground that the disclosure of ‘details related to technical equipment deployed in the current and ongoing operations would undermine public security’.

17

In the contested decision, Frontex restated the following:

18

By application lodged at the Registry of the General Court on 20 January 2018, the applicants brought the present action.

19

On 27 March 2018, Frontex lodged the defence.

20

On 30 May 2018, the applicants lodged the reply.

21

On 20 July 2018 the Frontex lodged the rejoinder.

22

On 1 October 2018, Frontex lodged an application for the case to be heard in camera in accordance with Article 109(2) of the Rules of Procedure of the General Court. On 24 October 2018, the applicants lodged their observations on the application for the case to be heard in camera.

23

By decision of 30 April 2019, the Court dismissed the application for the case to be heard in camera.

24

On a proposal from the Judge-Rapporteur, the Court decided to open the oral procedure and, by way of measures of organisation of procedure pursuant to Article 89 of the Rules of Procedure, requested the parties to reply to certain written questions. They replied to the questions within the period prescribed.

25

By way of a measure of inquiry under Article 91(c) of the Rules of Procedure, the Court ordered Frontex to produce ‘any documents that would contain information regarding the name(s), flag(s) and vessel type(s) of any vessels deployed under Triton from 1 June 2017 to 30 August 2017’, stipulating that, in accordance with Article 104 of the Rules of Procedure, those documents were not to be communicated to the applicants. In response to that measure of enquiry, Frontex provided one single document containing all the required information within the prescribed time limit.

26

The parties presented oral argument and answered the questions put to them by the Court at the hearing on 2 July 2019.

27

The applicants claim that the Court should:

28

Frontex claims that the Court should:

29

Frontex submits that the action is inadmissible on the ground that the request for access to the documents at issue was preceded and followed by a series of requests lodged separately by the applicants (paragraph 33 of the defence), which at least in part covered the same information. By the present action, the applicants are in fact seeking to circumvent the time limits applicable to actions, since the decisions to refuse the other requests became final due to the fact that they had not been challenged before the Court.

30

According to established case-law, only measures the legal effects of which are binding on, and capable of affecting the interests of, the applicant by bringing about a distinct change in his or her legal position are acts or decisions which may be the subject of an action for annulment (judgment of 11 November 1981, IBM v Commission, 60/81, EU:C:1981:264, paragraph 9, and order of 2 September 2009, E.ON Ruhrgas and E.ON Földgáz Trade v Commission, T‑57/07, not published, EU:T:2009:297, paragraph 30).

31

On the other hand, an action for the annulment of a decision which merely confirms a previous decision not contested within the time limit for bringing the proceedings is inadmissible (see judgment of 11 January 1996, Zunis Holding and Others v Commission, C‑480/93 P, EU:C:1996:1, paragraph 14 and the case-law cited, and order of 16 March 1998, Goldstein v Commission, T‑235/95, EU:T:1998:56, paragraph 41 and the case-law cited).

32

In that regard, it should be pointed out that, of the similar requests mentioned in paragraph 33 of the defence, only the request of 19 June 2017 gave rise to a decision which pre-dated the contested decision, that is to say 30 June 2017. It is therefore only in relation to that decision that the contested decision might be confirmatory.

33

The contested decision does not, however, confirm the decision of 30 June 2017.

34

As the applicants point out, both requests for access concern different information. The request of 19 June 2017, which gave rise to the decision of 30 June 2017, concerned access to a list of vessels then deployed by Frontex as part of Joint Operations Triton and Poseidon, containing detailed information on the fleet, including the names of the vessels, their call signs, the mobile maritime service identity (MMSI), the home ports, cruising speeds, the type of vessels and fuel capacity, while the request of 1 September 2017, which gave rise to the contested decision, concerned the name, type and flag of those vessels during the period between 1 June and 30 August 2017.

35

Although the request of 19 June 2017 included information identical to that requested on 1 September 2017, that is to say the names, flags and types of vessels deployed under Operation Triton, the period covered by those requests was different. While the information requested on 19 June 2017 concerned the vessels deployed on the date of that request, the request of 1 September 2017 concerned the vessels deployed during the period between 1 June and 30 August 2017, which had therefore come to an end at the time of that request. Moreover, the first of those requests was made by Mr Semsrott, while the second was made by both applicants.

36

Therefore, it must be held that the request of 1 September 2017 is different from the request of 19 June 2017, so that the contested decision cannot be regarded as being confirmatory of the decision of 30 June 2017.

37

Consequently, the present action is admissible.

38

The applicants put forward five pleas in law.

39

The first plea in law is comprised of two parts. In the first part, the applicants submit that Frontex infringed the first indent of Article 4(1)(a) of Regulation No 1049/2001, in that it did not examine whether each document requested fell within the scope of the exception concerning public security, and in the second part, the applicants allege that Frontex infringed the duty to provide reasons.

40

The other four pleas allege respectively:

41

The second part of the first plea in law will be examined last.

42

The applicants claim that Frontex, in the contested decision, did not conduct an individual examination of the different documents containing the requested information in order to determine whether they fell within the scope of the exception in the first indent of Article 4(1)(a) of Regulation No 1049/2001.

43

Frontex submits that the first part of the first plea is unfounded and states that the applicants did not request access to specific documents, but to information contained in unspecified documents.

44

In that regard, it must be observed that, in their letter of 1 September 2017, the applicants requested access to ‘documents which contain ... information’ relating to the name, type and flag of all vessels deployed by Frontex between 1 June and 30 August 2017 in the central Mediterranean under Operation Triton 2017.

45

With regard to such a request, it is important to note that under Article 2(1) of Regulation No 1049/2001 requests for access must concern documents and that under Article 6(1) of that regulation the requests for access must be formulated ‘in a sufficiently precise manner to enable the institution to identify the document [requested]’.

46

Under Article 6(2) of Regulation No 1049/2001 ‘if an application is not sufficiently precise, the institution shall ask the applicant to clarify the application and shall assist the applicant in doing so, for example, by providing information on the use of the public registers of documents’.

47

The procedure laid down in Articles 6 to 8 of Regulation No 1049/2001 principally aims to achieve the swift and straightforward processing of applications for access to documents and, as a secondary matter, to avoid, in accordance with the principle of sound administration, the institution from bearing a disproportional workload (judgment of 3 May 2018, Malta v Commission, T‑653/16, EU:T:2018:241, paragraph 77; see also, to that effect, judgment of 2 October 2014, Strack v Commission, C‑127/13 P, EU:C:2014:2250, paragraphs 25, 27 and 28).

48

In addition, Article 11(1) of Regulation No 1049/2001 provides that ‘to make citizens’ rights under this Regulation effective, each institution, body, office and agency shall provide public access to a register of documents’.

49

In the present case, Frontex did not maintain a register of documents in accordance with the Article 11(1) of Regulation No 1049/2001. Nor did it invite the applicants to clarify further their access request and did not assist them in doing so. Frontex does not appear to have provided any other means capable of helping the applicants to find, describe or define the relevant documents.

50

In response to a measure of enquiry from the Court, Frontex submitted a document containing all the information requested by the applicants. At the hearing, Frontex stated that it had taken that information from an electronic database, before compiling the information in the document sent to the Court.

51

In that regard, the Court of Justice held that, although the right of access to the institutions’ documents concerned only existing documents which are actually in the possession of the institution concerned, the distinction between an existing document and a new document must be made on the basis of a criterion adapted to the technical specificities of those databases and in line with the objective of Regulation No 1049/2001, whose purpose, as is apparent from recital 4 and Article 1(a) thereof, is to ensure the widest possible access to documents (judgment of 11 January 2017, Typke v Commission, C‑491/15 P, EU:C:2017:5, paragraphs 31 and 35).

52

Thus, all information which can be extracted from an electronic database by general use through pre-programmed search tools, even if that information has not previously been displayed in that form or ever been the subject matter of a search by the staff of the institutions, must be regarded as an existing document (judgment of 11 January 2017, Typke v Commission, C‑491/15 P, EU:C:2017:5, paragraph 37).

53

It is apparent from that case-law that, contrary to what the applicants claim, in order to satisfy the requirements of Regulation No 1049/2001, the institutions may establish a document from information contained in a database by using existing search tools (judgment of 11 January 2017, Typke v Commission, C‑491/15 P, EU:C:2017:5, paragraph 38).

54

Where a document containing such information is created, the institution or agency concerned is not required to carry out an individual examination of each document from which the requested information originates, the key point being that, as was the situation in the present case, the information concerned was put to such an examination.

55

The first part of the first plea in law must therefore be rejected.

56

The applicants dispute the assertion made by Frontex in the letter of 8 September 2017 and in the contested decision that it is possible to monitor vessels deployed under Operation Triton using publicly accessible maritime websites, such as marinetraffic.com. The vessels deployed in Operation Triton are fitted with equipment containing an automatic identification system (AIS) which makes it possible to communicate, in particular, their name, position, speed and direction using radio transmissions to stations or satellites. However, they do not transmit their AIS data when on mission, so as to avoid making themselves detectable. Due to this practice, information on the identity of the vessels deployed could not support third parties’ awareness on the position or patrolling schemes of these vessels when on mission, in particular border surveillance. Therefore, according to the applicants, the reason relied on by Frontex in the contested decision does not reflect reality.

57

Frontex contends that that argument is unfounded.

58

In that respect, it must be observed that Regulation No 1049/2001 is intended, as is indicated in recital 4 and Article 1, to give the public a right of access to documents of the institutions which is as wide as possible (judgment of 1 February 2007, Sison v Council, C‑266/05 P, EU:C:2007:75, paragraph 61; see also, judgment of 7 February 2018, Access Info Europe v Commission, T‑851/16, EU:T:2018:69, paragraph 34 and the case-law cited).

59

That right is nonetheless subject to certain limits based on grounds of public or private interest (judgments of 1 February 2007, Sison v Council, C‑266/05 P, EU:C:2007:75, paragraph 62, and of 7 February 2018, Access Info Europe v Commission, T‑851/16, EU:T:2018:69, paragraph 35).

60

More specifically, and in reflection of recital 11, Article 4 of Regulation No 1049/2001 provides that the institutions are to refuse access to a document where its disclosure would undermine the protection of one of the interests protected by that article (judgment of 7 February 2018, Access Info Europe v Commission, T‑851/16, EU:T:2018:69, paragraph 35).

61

As such exceptions derogate from the principle of the widest possible public access to documents, they must be interpreted and applied strictly (judgments of 1 February 2007, Sison v Council, C‑266/05 P, EU:C:2007:75, paragraph 63, and of 7 February 2018, Access Info Europe v Commission, T‑851/16, EU:T:2018:69, paragraph 36), with the result that the mere fact that a document concerns an interest protected by an exception is not in itself sufficient to justify application of the exception (judgments of 27 February 2014, Commission v EnBW, C‑365/12 P, EU:C:2014:112, paragraph 64, and of 7 February 2018, Access Info Europe v Commission, T‑851/16, EU:T:2018:69, paragraph 36).

62

If the institution concerned decides to refuse access to a document which it has been asked to disclose, it must, in principle, explain how disclosure of that document could specifically and actually undermine the interest protected by an exception provided for in Article 4 of Regulation No 1049/2001 upon which it is relying. Moreover, the risk of that undermining must be reasonably foreseeable and not purely hypothetical (judgments of 3 July 2014, Council v in’t Veld, C‑350/12 P, EU:C:2014:2039, paragraph 52, and of 7 February 2018, Access Info Europe v Commission, T‑851/16, EU:T:2018:69, paragraph 37).

63

The case-law of the Court of Justice has developed a specific set of rules for the exceptions laid down in Article 4(1)(a) of Regulation No 1049/2001 relating to the protection of the public interest as regards public security, defence and military matters, international relations and the financial, monetary or economic policy of the European Union or of a Member State.

64

With regard to those interests, the Court of Justice held that the particularly sensitive and essential nature of the public interests concerned, combined with the fact that access must be refused by the institution, under Article 4(1)(a) of Regulation No 1049/2001 if disclosure of a document to the public undermined those interests, conferred on the decision which must thus be adopted by the institution a complex and delicate nature calling for the exercise of particular care and that, in the present case, such a decision therefore required a margin of appreciation (judgments of 1 February 2007, Sison v Council, C‑266/05 P, EU:C:2007:75, paragraph 35, and of 7 February 2018, Access Info Europe v Commission, T‑851/16, EU:T:2018:69, paragraph 38).

65

Thus, according to the Court of Justice, the principle of strict construction does not, in respect of the public-interest exceptions provided for in Article 4(1)(a) of Regulation No 1049/2001, preclude the institution concerned from enjoying a wide discretion for the purpose of determining whether disclosure of a document to the public would undermine the interests protected by that provision and, by way of corollary, the review by the General Court of the legality of a decision by that institution refusing access to a document on the basis of one of those exceptions is limited to verifying whether the procedural rules and the duty to state reasons have been complied with, whether the facts have been accurately stated and whether there has been a manifest error of assessment or a misuse of powers (judgments of 1 February 2007, Sison v Council, C‑266/05 P, EU:C:2007:75, paragraph 64, and of 7 February 2018, Access Info Europe v Commission, T‑851/16, EU:T:2018:69, paragraph 40).

66

Consequently, it must be determined in the present case whether Frontex provided plausible explanations in the contested decision as to how access to the documents at issue could specifically and actually undermine the protection of the European Union’s public security and whether, in Frontex’s broad discretion in applying the exceptions in Article 4(1) of Regulation No 1049/2001, the risk of that undermining could be considered reasonably foreseeable and not purely hypothetical (judgment of 7 February 2018, Access Info Europe v Commission, T‑851/16, EU:T:2018:69, paragraph 41).

67

In the present case, the plea calls into question the factual accuracy of the assertion made by Frontex in the contested decision that, if the information requested were disclosed, it could be combined with information available on certain maritime websites or tools in order to establish the position of the vessels taking part in Operation Triton.

68

In that context, the applicants specifically claim that it is not possible to monitor the position of the vessels taking part in Operation Triton 2017 on the website www.marinetraffic.com, referred to by Frontex in its letter of 8 September 2017, because those vessels switch off their transponders during their missions with the consequence that they no longer emit any signal which would make it possible to locate them using that site.

69

In that respect, it should be noted that, according to the statements made by Frontex at the hearing, the transponders of vessels taking part in missions organised by Frontex are not systematically switched off during those periods.

70

On the contrary, it is apparent from the statements made by Frontex, contrary to what is claimed in the application, that the transponders installed in the vessels are sometimes activated, and the decision to activate them or to switch them off falls to the commanding officer of each vessel. Indeed, it is up to that officer to determine, having regard to the specific circumstances in which the vessel is navigating, whether it is appropriate, for reasons of security, to avoid being located, or whether, on the contrary, for example to avoid a collision or to save people in distress, the position of the vessel should appear on the radars of other craft.

71

Furthermore, according to Frontex, the information requested by the applicants is sufficient, even when the AIS system is not used, to locate and then monitor a vessel when combined, on the one hand, with low-tech surveillance methods, such as observing the movements of vessels from the coast or from one or more other vessels, or on the other, with high-tech surveillance methods, such as the use of drones, since the use of both those methods is widespread among criminal groups active on the high seas or in other maritime areas.

72

If traffickers know the location of the vessels, they will have at their disposal the information needed to avoid the controls aimed at preventing unlawful access to the borders.

73

The prospect that such vessels may be located by traffickers constitutes a significant risk which comes within public security in a context in which those traffickers do not hesitate to attack vessels, sometimes using military weapons, or to undertake manoeuvres capable of endangering crews and equipment.

74

Thus, it must be held that, despite the arguments relied on by the applicants, the explanations provided by Frontex in the contested decision remain plausible and demonstrate, as required by the case-law cited in paragraph 62 above, that there is a foreseeable, and not merely hypothetical, risk to public security which justifies the use of the exception referred to in the first indent of Article 4(1)(a) of Regulation No 1049/2001 within the wide discretion which, according to the case-law cited in paragraphs 63 to 65, must be accorded to Frontex for the application of that exception.

75

Consequently, the second plea in law must be rejected as unfounded.

76

The applicants submit that Frontex committed a manifest error of assessment by refusing to provide them with the information requested because that information concerned the period between 1 June and 30 August 2017, which had already come to an end when they lodged their request and, a fortiori, when the contested decision was adopted.

77

Frontex disputes that plea.

78

In the present case, the access request was made on 1 September 2017 and concerned information relating to the period between 1 June and 30 August 2017.

79

It is true that the period covered by the information requested had expired when the request was made. Nevertheless, it still covered a more extensive period during which Operation Triton 2017 was to be conducted and which, according to Frontex, expired on 31 January 2018.

80

Since Operation Triton 2017 was ongoing at the time of the request, the risk that the information requested would be used by criminals in order to locate the vessels taking part in that operation after 30 August 2017 continued to exist.

81

In that respect, there is no reason to consider, as the applicants suggest, that the fleet of vessels taking part in Operation Triton 2017 would have been modified between 31 August and 1 September 2017.

82

In that regard, Frontex did not commit a manifest error of assessment by refusing access to the documents at issue.

83

Accordingly, the third plea in law must be rejected as unfounded.

84

The applicants submit that Frontex committed a manifest error of assessment by not granting them partial access to the information requested when that information had already been revealed beforehand.

85

In that regard, the applicants claim, first, that on 2 February 2017 the Commission published in Issue 22 of the Strategic Notes of the European Political Strategy Centre (EPSC) the naval assets which had served under Operation Triton 2016, secondly, that the Commission and the EEAS, in 2017 and in 2016 respectively, published in the same document information relating to the vessels used in Operation Sophia EUNAVFOR MED and, thirdly, that in 2017 Frontex published on Twitter the name, flag and type of a number of vessels deployed under Joint Operation Triton in 2017.

86

In that regard, it is important to note that the published information cited by the applicants is not comparable to the information which they requested on 1 September 2017.

87

First of all, the information published by the Commission on 2 February 2017 in the EPSC Strategic Notes related to Operation Triton 2016, which was completed, whereas the information requested by the applicants on 1 September 2017 related to Operation Triton 2017, which was ongoing.

88

Next, Operation Sophia EUNAVFOR MED is not a Frontex operation, but is politically controlled and strategically directed by the Political and Security Committee, chaired by the EEAS, subject to the responsibility of the Council of the European Union and the High Representative of the European Union for Foreign Affairs and Security Policy.

89

In any event, the information published on that mission concerned information relating to 2016.

90

Finally, while it is true that some information published by Frontex on Twitter in 2017 concerned vessels deployed under Operation Triton 2017, that information was limited and concerned different points in time, so that it cannot be compared to the full set of information requested by the applicants on 1 September 2017, which related to the entire fleet deployed under Operation Triton 2017 between 1 June and 30 August 2017.

91

In that regard, it must be observed that, although Frontex is required under Article 8(3) and Article 74(2) of Regulation 2016/1624 to communicate with the public on matters falling within the scope of its tasks, it cannot reveal operational information which would jeopardise attainment of the objective of those operations.

92

In the present case, the information on which the applicants rely was published by Frontex as part of its communication obligation, which implies that checks had been carried out beforehand that disclosure of that information was compatible with all of the tasks stemming from its mandate and that any such disclosure was balanced with the needs of public security.

93

Thus, the fact that Frontex sent brief messages on Twitter containing certain selected information as part of its communication obligation cannot be regarded as setting a precedent that would require it to communicate information which it believes puts public security at risk.

94

The applicants also submit that the public, using information published by the Commission on Operation Triton 2016, could predict exactly at least the number and the type of vessels deployed in the following year.

95

That argument must be rejected. At the point when the information relating to 2016 was disseminated, there was no reason to conclude that the operation would be organised, in 2017, using the same number and the same type of vessels. Thus, the public could not, on the basis of information disseminated in 2016, have held precise information on the way in which the 2017 mission would be organised.

96

Moreover, the information requested by the applicants did not solely concern the number and type of vessels deployed under Operation Triton 2017, but also their name and flag which is important information for identifying vessels.

97

The fourth plea in law is therefore unfounded and must be rejected.

98

The applicants submit that Frontex infringed Article 4(6) of Regulation No 1049/2001 by not allowing them access to information relating to the flag and the type of the vessels deployed under Operation Triton 2017.

99

According to the applicants, even if, in a situation where the information requested was disclosed, there is a risk that criminal networks would circumvent border surveillance, that does not justify the refusal to communicate information on the flag and the type of the vessels concerned. Vessels are identified on websites by the name of the vessel, so that communicating information about the flag and the type of the vessels does not make it possible to identify them.

100

In that regard, it must be stated that it is common ground that, on the website www.marinetraffic.com, cited by Frontex in the letter of 8 September 2017, vessels are identified by the vessel name.

101

In the rejoinder, Frontex contended, however, that there were other methods for monitoring vessels, in particular low-tech solutions, such as simply observing the movement of the vessels from the coast or from one or more other vessels, or high-tech surveillance methods, such as the use of drones.

102

It is clear that, in order to use those other methods, information such as the flag and the type of the vessels is also useful.

103

In those circumstances, Frontex, in the contested decision, could also refuse access to the name of the vessels and to the other information requested, that is to say the flag and the type of the vessels involved in Operation Triton 2017.

104

The fifth plea in law must therefore be rejected as unfounded.

105

The applicants allege that Frontex did not explain in the contested decision how information on the name, type and flag of a vessel would make it possible for third parties to monitor that vessel on certain websites.

106

Frontex contends that the second part of the first plea is unfounded.

107

In that regard, it must be recalled that, according to settled case-law, the statement of reasons required by Article 296 TFEU must disclose in a clear and unequivocal fashion the reasoning followed by the institution which adopted the measure in such a way as to enable the person concerned to ascertain the reasons for the measures and to enable the court having jurisdiction to exercise its power of review (see judgment of 15 November 2012, Council v Bamba, C‑417/11 P, EU:C:2012:718, paragraph 50 and the case-law cited).

108

It is not necessary for the reasoning to go into all the relevant facts and points of law, since the question whether the statement of reasons is sufficient must be assessed with regard, not only to its wording, but also to its context and to all the legal rules governing the matter in question (judgments of 15 November 2012, Council v Bamba, C‑417/11 P, EU:C:2012:718, paragraph 53, and of 14 October 2009, Bank Melli Iran v Council, T‑390/08, EU:T:2009:401, paragraph 82).

109

In the present case, Frontex set out in the contested decision the reasons why the information requested could not be disclosed. In that regard, Frontex stated that, if the information requested were disclosed, it would be possible, by combining it with information made available to the public on certain websites or maritime tools, to ascertain the position of the patrol vessels and that, if that information were in the possession of the criminal gangs involved in migrant smuggling and trafficking of human beings, they would know the patrolling areas and patrolling schedules of the vessels, which would allow them to adapt their modus operandi accordingly in order to circumvent border surveillance and consequently cross the external border and access, irregularly, the territory of an EU Member State.

110

In themselves, those explanations allow the applicants to understand the reasons why access to the information requested was refused and the Court to exercise its power of legal review, given that they highlight how the requested information, combined with easily accessible information, may be used by trafficking networks to create a situation in which public security would be affected in a reasonably foreseeable and not purely hypothetical manner.

111

However, the applicants maintain that, in the contested decision, Frontex should have indicated how the required information, once it had been given to them, could have been used, together with websites and tools or other publicly available sources, to determine the likely future location of the vessels taking part in Operation Triton.

112

In that regard, it should be stated that the defendant institution or agency, when dealing with a request for disclosure of certain information, is not required to reveal in the statement of reasons for the contested act information the effect of which would be, if that information were disclosed, to undermine the public interest covered by the exception relied on by that institution or agency (see, to that effect, judgment of 7 February 2018, Access Info Europe v Commission, T‑852/16, EU:T:2018:71, paragraph 114 and the case-law cited).

113

If such an obligation existed, the institution or agency, by providing those explanations on the use which may be made of the requested information, would itself create a situation in which, by its conduct, the public security which it is tasked with protecting, among other things, would be endangered.

114

In those circumstances, it must be concluded that the contested decision satisfies the duty to state reasons.

115

The second part of the first ground of appeal must therefore be rejected as unfounded.

116

The action must therefore be dismissed.

117

Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings.

118

Since the applicants have been unsuccessful, they must be ordered to pay the costs, in accordance with the form of order sought by Frontex.

On those grounds,

THE GENERAL COURT (First Chamber),

hereby: