1

MS was a member of the Team Europe network between 20 July 2011 and 10 April 2013.

2

The Team Europe network is a local communications network whose main task is to assist Commission Representations in providing information on European policies at local level and whose members are conference speakers, moderators, events facilitators and communications experts.

3

Team Europe network members and the European Union, represented by the Commission, are bound by a ‘letter of agreement and membership of Team Europe’ (‘the letter of agreement’). That letter provides for the possibility for each party to withdraw from the agreement, at any time, in writing, with no further conditions attached. It also states, in essence, that those members are not remunerated by the Commission. It provides, moreover, that members act on a voluntary basis, but that they may accept, under certain conditions, reimbursement of their expenses or reasonable compensation from the organisers of the events in which they participate.

4

On 10 April 2013, the Head of the Commission Representation in France (‘the Representation’) contacted MS by telephone, after receiving a complaint concerning his unwanted conduct from women who attended a Team Europe network conference or workshop. Following that conversation, she informed MS by letter that she was terminating his collaboration with that network, with immediate effect, in accordance with the provisions of the letter of agreement.

5

On 6 June 2013, MS lodged a complaint with the European Ombudsman against the Commission’s decision to terminate his collaboration with the Team Europe network.

6

During the proceedings before the Ombudsman, MS was informed that the Commission’s decision of 10 April 2013 to terminate his collaboration with the Team Europe network had been based on three documents: first, a complaint from a person who attended one of the conferences organised by the Team Europe network (‘X’), secondly, a letter sent by MS to X (with Y, another person, in copy) and thirdly, an exchange between MS and X on a social network (‘the documents at issue’). Moreover, he was informed that the Commission had argued that the strength of the case was underpinned by new facts that came to light during the proceedings, inasmuch as several members of staff from the Representation (‘members of the Representation’) had confirmed to the Representation leadership that a number of officers from the Commission’s Directorate-General (DG) Communication, including two working at the Representation and two performing their duties in Brussels (Belgium) (‘the Commission officers’), had, since 2013, been the victims of inappropriate remarks made by MS (‘the testimonies at issue’). The Commission had not disclosed the documents or testimonies at issue to MS.

7

By decision of 19 November 2015, the Ombudsman closed the enquiry into the complaint made by MS. In that decision, the Ombudsman, inter alia, made a finding of maladministration, on the ground that the Commission had not given MS a proper hearing or carried out a sufficiently thorough assessment of the case before deciding, on 10 April 2013, to terminate MS’ collaboration with the Team Europe network. The Commission did not adopt any measures concerning MS following the lodging of that complaint and the adoption of the Ombudsman’s decision.

8

By letter of 18 December 2015, on the basis of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 45), MS sent the Head of Representation an initial request for access to the documents and testimonies at issue and to the names of the persons who had given those testimonies.

9

By letter of 2 February 2016, after consulting X, who was described as the author of the documents at issue, the Director-General of the Commission’s DG Communication refused to grant MS access to those documents (‘the decision of 2 February 2016’). That refusal was based on the exception provided for in Article 4(1)(b) of Regulation No 1049/2001 and concerned the protection of privacy and the integrity of the individual, in so far as the documents at issue contained personal data relating to third parties, and it had not been shown that access to that data was necessary for MS and would not prejudice the legitimate interests of those third parties. As regards the request for access to the testimonies at issue, the Commission added that those testimonies had not been taken into consideration when it adopted its decision of 10 April 2013 to terminate MS’ collaboration with the Team Europe network.

10

By letter of 19 February 2016, MS made a confirmatory application in which he established that access to the documents at issue was necessary, and that the legitimate interests of third parties would not be prejudiced by such access. In that confirmatory application, he also requested that the personal data relating to him contained in the documents issue (‘the personal data at issue’) be transferred to him, under Article 13 of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L. 8, p. 1).

11

By decision of 19 April 2016, the Secretary-General of the Commission responded to the confirmatory application (‘the decision of 19 April 2016’). First, he stated that the testimonies at issue could not be disclosed to MS inasmuch as they had not been documented. Secondly, he refused to grant MS access to the documents at issue, on the basis of the exceptions provided for in Article 4(1)(b) and the second indent of Article 4(2) of Regulation No 1049/2001 concerning, respectively, the privacy and the integrity of the individual and the protection of court proceedings. Moreover, in that decision, he stated that the request for the transfer of the personal data at issue did not fall within the scope of Regulation No 1049/2001, and that it would be passed on to DG Communication, which was the competent department to respond to such a request.

12

By letter of 16 June 2016, the Head of Representation rejected the request to transfer the personal data at issue (‘the decision of 16 June 2016’). In that regard, he considered that ‘taking into account the dispute which … ar[ose] between [MS] and the persons mentioned in the testimonies [at issue], it appear[ed] that those persons [had] given legitimate reasons for concern that their individual interests would be prejudiced’ and that, in order to safeguard the rights and freedoms of those persons, that personal data could not be transferred to MS.

13

MS also made a complaint to the European Data Protection Supervisor (EDPS) under Article 20(3) and (4) of Regulation No 45/2001. By decision of the EDPS of 3 February 2017, the proceedings in that case were suspended pending delivery of the judgments in the present cases.

14

By document lodged at the Registry of the General Court on 19 July 2016, MS brought an action seeking an order that the Commission pay compensation for the damage caused following its decision of 10 April 2013 to terminate his collaboration with the Team Europe network. That action was registered under reference T‑17/16.

15

By order of 31 May 2017, MS v Commission (T‑17/16, not published, EU:T:2017:379), the General Court dismissed MS’ claim for compensation as manifestly inadmissible in that the action concerned a contractual dispute and, therefore, in the absence of an arbitration clause, did not fall within its jurisdiction.

16

On 5 January 2018, MS brought an appeal against that order.

17

By documents lodged at the Registry of the General Court on 15 June and 1 August 2016, MS submitted applications for legal aid.

18

By orders of 30 September and 28 November 2016, the President of the General Court, respectively, granted MS’ application for legal aid and assigned a lawyer.

19

By applications lodged at the Registry of the General Court on 15 and 22 December 2016, MS brought the actions that were registered under references T‑314/16 and T‑435/16.

20

In Case T‑314/16, by order of 6 July 2017, pursuant to Article 91(c), Article 92(1) and Article 104 of the Rules of Procedure of the General Court, the General Court ordered the Commission to produce all the documents on which it had based its decision of 10 April 2013, by which it had terminated MS’ participation in the Team Europe network.

21

On 14 July, the Commission produced the documents at issue, asking that those documents be subject to confidential treatment vis-à-vis MS. In accordance with Article 104 of the Rules of Procedure, those documents were not disclosed to MS.

22

Acting on a proposal from the Judge-Rapporteur, the General Court (First Chamber) decided to open the oral procedure and, by way of measures of organisation of procedure as provided for in Article 89 of the Rules of Procedure, invited the Commission to answer certain questions. The Commission complied with that request within the prescribed period.

23

By order of the President of the First Chamber of the General Court of 30 January 2018, Cases T‑314/16 and T‑435/16 were joined for the purposes of the oral part of the procedure and the final decision, in accordance with Article 68 of the Rules of Procedure.

24

On 19 February 2018, MS’ lawyer informed the registrar of the General Court that MS had died. Consequently, the General Court was informed that the applicant, VG, as sole heir of MS, had decided to continue the proceedings.

25

In Case T‑314/16, the applicant, as sole heir of MS, claims that the Court should:

26

The Commission contends that the Court should:

27

In Case T‑435/16, the applicant, as sole heir of MS, claims that the Court should:

28

The Commission contends that the Court should:

29

At the hearing, the Commission submitted that, following the death of MS, the action in Case T‑435/16 had become devoid of purpose and that there was, consequently, no longer any need to adjudicate on it. Article 2(a) of Regulation No 45/2001 defines the data subject as ‘an identified or identifiable natural person’, which means that it does not apply to data concerning deceased persons and that the rights that were relied on by MS were not transferable.

30

By its application, the Commission contends, in essence, that, as the sole heir of MS, the applicant no longer has an interest in the outcome of the dispute on account of the death of MS.

31

In that regard, it is clear from the case-law that an action for annulment brought by the addressee of a measure can be pursued by the addressee’s universal successor in title, particularly in the case of the death of a natural person (see order of 12 July 2016, Yanukovych v Council, T‑347/14, EU:T:2016:433, paragraph 67 and the case-law cited). Similarly, the universal successor in title may bring an action for damages in respect of non-material harm allegedly suffered by the deceased, where, prior to his death, the latter had claimed the right to bring that action and, accordingly, that action formed part of his estate at the point of succession.

32

Moreover, according to settled case-law, an applicant’s interest in bringing proceedings must continue until the final decision, failing which there will be no need to adjudicate, which presupposes that the action must be liable, if successful, to procure an advantage for the party bringing it (see order of 12 July 2016, Yanukovych v Council, T‑347/14, EU:T:2016:433, paragraph 67 and the case-law cited).

33

In the present case, as noted in paragraph 24 above, MS died after bringing the present actions and his representative has shown that the applicant wished to continue those proceedings, as sole heir of her late son, by producing a written statement from the applicant to that effect, the official death certificate and the applicant’s identity document.

34

The action in case T‑435/16 sought, in particular, to have the personal data at issue transferred to MS and to obtain compensation for the non-material damage he allegedly suffered as a result of the Commission’s rejection of his request for transfer. It is not disputed that that personal data related to MS’ unwanted conduct linked to his collaboration with the Team Europe network (see paragraph 4 above), and could, inter alia, have damaged his reputation and dishonoured him as a network collaborator. Moreover, it is not disputed that that data formed the basis of the Commission decision of 10 April 2013 to terminate MS’ collaboration with that network (see paragraph 6 above).

35

In those circumstances, as stated in paragraph 31 above, since MS’ universal successor in title is entitled to pursue the action, her interest in bringing proceedings is retained, despite the death of MS, for the purpose of obtaining the annulment of the decision of 16 June 2016 rejecting MS’ request that the personal data at issue be transferred to him, and of obtaining compensation for the non-material damage that MS suffered as a result of the Commission’s rejection of his request to transfer that data to him.

36

It must therefore be concluded that the applicant’s interest, as sole heir of MS, in bringing proceedings in Case T‑435/16 continues to exist notwithstanding the death of MS.

37

Accordingly, the Commission’s application for a declaration that there was no need to adjudicate in Case T‑435/16 must be rejected.

38

It is clear that an EU institution may grant a request for access to documents held by the institutions, within the meaning of Article 2(3) of Regulation No 1049/2001, only if the requested documents exist (judgment of 2 October 2014, Strack v Commission, C‑127/13 P, EU:C:2014:2250, paragraph 38; see, also, judgment of 11 June 2015, McCullough v Cedefop, T‑496/13, not published, EU:T:2015:374, paragraph 49 and the case-law cited).

39

According to the case-law, a presumption of legality attaches to any statement of the institutions relating to the non-existence of documents requested. Consequently, a presumption of veracity attaches to such a statement. That is, however, a simple presumption that the applicant, as sole heir of MS, may rebut in any way on the basis of relevant and consistent evidence (see judgment of 11 June 2015, McCullough v Cedefop, T‑496/13, not published, EU:T:2015:374, paragraph 50 and the case-law cited).

40

In the present case, in its decision of 2 February 2016, the Commission refused to grant access to the testimonies at issue on the basis of the exception provided for in Article 4(1)(b) of Regulation No 1049/2001, and explained that it had not taken those testimonies into account in its decision of 10 April 2013 to terminate the applicant’s collaboration with the Team Europe network. The Commission then contended, in its decision of 19 April 2016, that the testimonies at issue had not been documented.

41

In response to a measure of organisation of procedure of the General Court, the Commission confirmed that it ‘[had] no written record of those testimonies … and therefore [did] not hold any documents containing the testimonies [at issue]’. Taking into account that statement and the lack of evidence submitted by the applicant, in her capacity as sole heir of MS, to rebut the presumption of legality and of veracity that attach thereto, there are insufficient grounds, in the present case, to doubt that statement.

42

Therefore, the application for annulment of the decisions of 2 February and 19 April 2016 should be rejected in so far as those decisions reject MS’ request for access to the testimonies at issue, without it being necessary to rule on the admissibility of the application for annulment in so far as it concerns the decision of 2 February 2016.

43

In support of the present application for annulment, the applicant, in her capacity as sole heir of MS, relies, in essence, on two pleas in law. The first plea alleges infringement of Article 2 and Article 4(1)(b) of Regulation No 1049/2001 and of Article 2 and the second indent of Article 4(2) of that regulation. The second plea alleges infringements of the obligation to state reasons, of the rights of the defence and of the principles of respect for privacy and of proportionality.

44

The applicant submits that, although the documents at issue contain personal data relating to X and other third parties, the Commission has not shown that the disclosure of those documents would actually and specifically undermine the protection of privacy and the integrity of X, or the protection of privacy and the integrity of any other third parties mentioned in those documents.

45

Moreover, according to the applicant, in her capacity as sole heir of MS, the legitimate interests of the third parties would not be jeopardised because she was ‘acting in the interests of setting the record straight as regards MS and restoring his honour’. She adds that the complaints are directed only at MS, so the disclosure of the documents at issue cannot undermine the protection of privacy and the integrity of X, or the protection of privacy and the integrity of any other third parties also mentioned in those documents.

46

In that regard, in her capacity as sole heir of MS, the applicant refers to the fact that the Ombudsman has already found, in paragraph 32 of its friendly solution proposal, that the Commission ‘[had] not provided evidence of a real risk for … the legitimate interests of [X]’.

47

In her capacity as sole heir of MS, the applicant ( 1 )also submits that she has established the necessity for the personal data at issue to be transferred, in accordance with Article 8(b) of Regulation No 45/2001. According to the applicant, the documents at issue are essential in order to understand the Commission’s allegations concerning MS and the Commission’s decision of 10 April 2013 to terminate his collaboration with Team Europe, and in order to show that the Commission’s allegations are unfounded. She explained that MS was already in possession of the messages exchanged between him and X via social media and e-mail, but that he disputed the authenticity of the documents at issue to which he had not had access.

48

On the basis of the judgment of 22 May 2012, Internationaler Hilfsfonds v Commission (T‑300/10, EU:T:2012:247, paragraph 107), the applicant submits, lastly, that the documents at issue would not become public if they were disclosed in accordance with Regulation No 1049/2001.

49

In the first place, the Court notes that Regulation No 1049/2001 is intended, as is apparent from recital 4 and Article 1 thereof, to give the fullest possible effect to the right of public access to documents of the institutions (see judgment of 21 July 2011, Sweden v MyTravel and Commission, C‑506/08 P, EU:C:2011:496, paragraph 73 and the case-law cited).

50

Under Article 2(3) of Regulation No 1049/2001, the provisions on public access to documents apply to all documents held by the Commission, namely all documents drawn up or received by it and in its possession, in all areas of activity of the European Union.

51

Since Regulation No 1049/2001 is intended to ensure that any person may have access to documents, a document that has been disclosed in accordance with the provisions of that regulation enters the public domain (judgments of 21 May 2014, Catinis v Commission, T‑447/11, EU:T:2014:267, paragraph 62, and of 15 July 2015, Dennekamp v Parliament, T‑115/13, EU:T:2015:497, paragraph 67).

52

In that regard, it is true that the General Court has held that the disclosure of personal data exclusively concerning the applicant for access in question cannot be refused on the ground that it would undermine the protection of privacy and the integrity of the individual (see, to that effect, judgments of 22 May 2012, Internationaler Hilfsfonds v Commission, T‑300/10, EU:T:2012:247, paragraphs 107 to 109, and of 12 May 2015, Unión de Almacenistas de Hierros de España v Commission, T‑623/13, EU:T:2015:268, paragraph 91).

53

However, contrary to the applicant’s arguments, that case-law is not applicable to the present case, since the documents at issue contain personal data that does not concern MS exclusively.

54

It is also explicitly clear from the judgment of 22 May 2012, Internationaler Hilfsfonds v Commission (T‑300/10, EU:T:2012:247, paragraph 109), that, whilst protection of the interest referred to in Article 4(1)(b) of Regulation No 1049/2001 is not necessary in relation to the applicant for access, it must, however, be guaranteed, in accordance with the provisions of Regulation No 45/2001, in relation to third parties.

55

In the second place, it should be noted that the right of access to documents does not depend on the nature of the specific interest that the applicant for access may or may not have in obtaining the information requested (judgment of 21 May 2014, Catinis v Commission, T‑447/11, EU:T:2014:267, paragraph 61; see also, to that effect, judgment of 1 February 2007, Sison v Council, C‑266/05 P, EU:C:2007:75, paragraph 43).

56

Moreover, in so far as the applicant for access does not have to justify his request for access to the documents, the real interest that the disclosure of the documents at issue may represent for the applicant is also irrelevant for the purposes of Regulation No 1049/2001 (see judgment of 26 April 2016, Strack v Commission, T‑221/08, EU:T:2016:242, paragraph 252 and the case-law cited).

57

In the third place, it should be noted that Article 4 of Regulation No 1049/2001, in reflection of recital 11 in the preamble thereto, provides that the institutions are to refuse access to a document where its disclosure would undermine the protection of one of the interests protected by that provision (see judgments of 21 July 2011, Sweden v MyTravel and Commission, C‑506/08 P, EU:C:2011:496, paragraph 74 and the case-law cited, and of 13 January 2017, Deza v ECHA, T‑189/14, EU:T:2017:4, paragraph 51 and the case-law cited).

58

In that regard, Article 4(1)(b) of Regulation No 1049/2001 provides that the institutions are to refuse access to a document where its disclosure would undermine the protection of privacy and the integrity of the individual, in particular in accordance with EU legislation regarding the protection of personal data. That provision, which establishes a specific and reinforced system of protection for persons whose personal data could, in certain cases, be disclosed to the public, requires that any undermining of their privacy and integrity must always be examined and assessed in conformity, in particular, with Regulation No 45/2001 (see judgment of 7 July 2015, Axa Versicherung v Commission, T‑677/13, EU:T:2015:473, paragraphs 138 and 139 and the case-law cited).

59

Therefore, if an institution decides to refuse access to a document that it has been asked to disclose, it must, in principle, explain how disclosure of that document could specifically and actually undermine the interest protected by the exception — among those provided for in Article 4 of Regulation No 1049/2001 — upon which it is relying. Moreover, the risk of that undermining must be reasonably foreseeable and not purely hypothetical (judgment of 21 July 2011, Sweden v MyTravel and Commission, C‑506/08 P, EU:C:2011:496, paragraph 76 and the case-law cited).

60

That system of exceptions is based on a balancing of the opposing interests in a given situation, that is to say, first, the interests that would be favoured by the disclosure of the documents in question and, secondly, those that would be jeopardised by such disclosure. The decision taken on a request for access to documents depends on which interest must prevail in the particular case (judgment of 14 November 2013, LPN and Finland v Commission, C‑514/11 P and C‑605/11 P, EU:C:2013:738, paragraph 42).

61

In the present case, it is not disputed that the documents at issue contain personal data concerning MS, as well as X and some third parties.

62

Under Article 2(a) of Regulation No 45/2001, ‘personal data’ means ‘any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity’.

63

It is clear from Article 2(a) of Regulation No 45/2001 and from the case-law of the Court (judgments of 29 June 2010, Commission v Bavarian Lager, C‑28/08 P, EU:C:2010:378, paragraph 68, and of 23 November 2011, Dennekamp v Parliament, T‑82/09, not published, EU:T:2011:688, paragraph 27) that surnames and forenames may be regarded as personal data.

64

In addition to names, information concerning the professional or occupational activities of a person can also be regarded as personal data where, first, the information relates to the working conditions of the said persons and, second, that information is capable of indirectly identifying, where it can be related to a date or a precise calendar period, a natural person, within the meaning of Article 2(a) of Regulation No 45/2001 (see judgment of 22 May 2012, Internationaler Hilfsfonds v Commission, T‑300/10, EU:T:2012:247, paragraph 117 and the case-law cited).

65

Moreover, the Court held that the use of the expression ‘any information’ in the definition of the concept of ‘personal data’ reflected the aim of the EU legislature to assign a wide scope to that concept, which was not restricted to information that is sensitive or private, but potentially encompassed all kinds of information, not only objective but also subjective, in the form of opinions and assessments, provided that it ‘relates’ to the data subject (judgment of 20 December 2017, Nowak, C‑434/16, EU:C:2017:994, paragraph 34).

66

Under Article 8(b) of Regulation No 45/2001, personal data may, as a general rule, be transferred only if the recipient establishes the necessity of having the data transferred and if there is no reason to assume that that transfer might prejudice the legitimate interests of the data subject.

67

In that context, whoever requests such a transfer must first establish that it is necessary. If it is demonstrated to be necessary, it is then for the institution concerned to determine that there is no reason to assume that that transfer might prejudice the legitimate interests of the data subject. If there is no such reason, the transfer requested must be made, whereas, if there is such a reason, the institution concerned must weigh the competing interests in order to decide on the request for access. The decision taken on a request for public access to such documents depends on which interest must prevail in the particular case (see judgments of 16 July 2015, ClientEarth and PAN Europe v EFSA, C‑615/13 P, EU:C:2015:489, paragraph 47 and the case-law cited, and of 13 January 2017, Deza v ECHA, T‑189/14, EU:T:2017:4, paragraph 53 and the case-law cited).

68

In the present case, the Commission rightly considered that, as regards the information and assessments relating to the privacy of MS and X, as well as other parties, which are capable of identifying those persons, the content of the documents at issue fell within the concept of personal data.

69

The disclosure of the documents at issue to the public under Regulation No 1049/2001 would undermine the protection of privacy and the integrity of MS, X and of the other third parties mentioned in those documents.

70

Given the circumstances of the present case, it is not in the interests of MS, X or of the other third parties mentioned for the documents at issue to enter the public domain.

71

It is for this reason that the Commission had to weigh the competing interests in order to give a decision on the request for access to the complaint lodged by X and the correspondence exchanged between her and MS by e-mail and via a social network in the light of the exception relating to the protection of privacy and the integrity of the individual provided for in Article 4(1)(b) of Regulation No 1049/2001, in accordance with Regulation No 45/2001.

72

In that regard, the Commission also had to take into account the fact that, in accordance with Article 4(6) of Regulation No 1049/2001, if only parts of the requested document are covered by any of the exceptions, the remaining parts of the document must be released (see, to that effect, order of 27 November 2012, Steinberg v Commission, T‑17/10, not published, EU:T:2012:625, paragraph 55 and the case-law cited).

73

The Commission considered, nevertheless, that in the present case it was not possible to separate certain parts of the documents at issue from the other parts, and to regard them as not being covered by the exception provided for in Article 4(1)(b) of Regulation No 1049/2001, or to separate, from among those documents, which ones contained the personal data at issue relating to MS and which contained personal data relating to X and other third parties.

74

In that regard, it should be noted that, even anonymised personal data, in so far as it can be attributed to an identifiable natural person by the use of additional information, should be regarded as personal data concerning a third party.

75

In the present case, partial access to the information contained in the complaint lodged by X or the correspondence exchanged between X and MS would have enabled the public to identify the persons mentioned in the documents at issue.

76

Therefore, it was not possible for the Commission to grant partial access to the documents at issue without revealing, inter alia, the identity of the other third parties mentioned therein.

77

Moreover, in so far as the documents at issue contained personal data that did not concern MS exclusively, and that would have entered the public domain if those documents had been disclosed to that person, the Commission was correct, after weighing the competing interests, to consider that the interest of X and the other third parties in preventing their identity from entering the public domain outweighed MS’ interest in their identity being made public, and to refuse to grant access to MS, on the basis of the exception provided for in Article 4(1)(b) of Regulation No 1049/2001.

78

It follows that the argument put forward by the applicant in that regard must be rejected.

79

Consequently, the first part of the first plea must be rejected.

80

The applicant submits that the documents at issue were not prepared for the purpose of court proceedings and that, therefore, the rejection of MS’ request for access is not justified in so far as it is based on the protection of court proceedings. She states that fundamental rights, in particular the rights of the defence, are capable of constituting an overriding public interest such as to justify the disclosure of those documents.

81

However, it follows from the considerations set out in paragraphs 44 to 78 above that the legality of the decisions of 2 February and 19 April 2016 cannot be challenged, since all of the documents at issue were covered by the exception provided for in Article 4(1)(b) of Regulation No 1049/2001.

82

The second part of the first plea must, therefore, be rejected as ineffective, with the result that the first plea must be rejected in its entirety.

83

The applicant submits that, by refusing her access to the documents at issue, the Commission has impaired the exercise of MS’ rights of defence and, in particular, his right of access to the file concerning him, guaranteed by Article 41(2)(b) of the Charter of Fundamental Rights of the European Union (‘the Charter’) and his right to a fair trial, guaranteed by Article 47 of the Charter, and infringed the principle of respect for privacy, guaranteed by Article 7 of the Charter, as well as the principle of proportionality.

84

As regards the Commission’s argument that it could terminate MS’ collaboration with the Team Network at any time, the applicant submits that, since the Commission made a serious allegation regarding MS’ unwanted conduct towards X and other third parties, MS’ rights of defence and the presumption of innocence required that access to the documents at issue be authorised.

85

Moreover, the applicant submits that the Commission has provided a purely general statement of reasons, since it does not explain how access to the documents at issue, if, for example, the names mentioned therein were obscured, would jeopardise the interest of the protection of personal data and of the privacy of the data subjects. She adds that the Commission’s impartiality cannot be taken for granted in the handling of X’s complaint.

86

Primarily, it must be recalled that, in accordance with the case-law, the obligation to state reasons is an essential procedural requirement, as distinct from the question whether the reasons given are correct, which goes to the substantive legality of the contested measure (judgments of 22 March 2001, France v Commission, C‑17/99, EU:C:2001:178, paragraph 35, and of 22 May 2012, Internationaler Hilfsfonds v Commission, T‑300/10, EU:T:2012:247, paragraph 180).

87

In that regard, in the decision of 19 April 2016, the Commission clearly stated which exceptions formed the basis for the rejection of MS’ request for access to the documents at issue, the principal exception for all those documents being that provided for in Article 4(1)(b) of Regulation No 1049/2001 on the protection of privacy and the integrity of the individual.

88

It is clear from the decision of 19 April 2016 that the Commission considered that the entire content of the documents at issue fell within the concept of personal data, as it consisted of information that related both to MS’ private life and the private life of other persons, and that would have identified those persons if the documents were disclosed to the public under Regulation No 1049/2001, that the disclosure of that data therefore constituted a transfer of personal data within the meaning of Article 8(b) of Regulation No 45/2001 and that none of the cumulative conditions for such a transfer was satisfied.

89

It follows not only that MS was in a position to ascertain the reasons for the decision of 19 April 2016, but also that it was possible for the Court to carry out a review of the legality of that decision, as is clear, moreover, from paragraphs 44 to 78 above. According to the case-law, the statement of reasons required by Article 296 TFEU must be appropriate to the measure at issue, and must disclose in a clear and unequivocal fashion the reasoning followed by the institution that adopted the measure, in such a way as to enable the persons concerned to ascertain the reasons for it and to enable the Court to carry out its review (see judgment of 22 April 2008, Commission v Salzgitter, C‑408/04 P, EU:C:2008:236, paragraph 56 and the case-law cited). Therefore, as regards the documents at issue, the Commission fulfilled its obligation to state reasons.

90

Moreover, the applicant’s argument that the fact of not having given MS access to the documents at issue infringed his rights of defence and, in particular, his right of access to the file concerning him as well as the principle of the presumption of innocence, and that it was contrary to the Charter, cannot succeed, in so far as the request for access to the documents at issue was made not in the context of administrative or judicial proceedings, in which those rights and principles would have been applicable, but in the context of a contractual relationship between MS and the Commission, governed by the letter of agreement and the law applicable thereto.

91

It follows from the foregoing that the second plea and, therefore, the application for annulment of the decisions of 2 February and 19 April 2016 should be rejected, in so far as those decisions reject MS’ request for access to the documents at issue, without it being necessary to rule on the admissibility of the application for annulment in so far as it concerns the decision of 2 February 2016.

92

In support of the present application for annulment, the applicant raises a single plea in law, alleging infringement of Articles 8, 13 and 20 of Regulation No 45/2001.

93

According to the applicant, the rules laid down in Article 8 of Regulation No 45/2001 do not form part of the conditions for or restrictions on the general right of access provided for in Article 13 of that regulation. There is no reason to assume that the transfer of the personal data at issue could have prejudiced the legitimate interests of third parties. In particular, the Commission did not show, as noted by the Ombudsman in paragraph 32 of the friendly solution proposal, that the disclosure of the documents at issue would actually and specifically have undermined the privacy and integrity of X or the privacy and integrity of other persons mentioned in those documents. In the alternative, the applicant submits that the cumulative conditions under Article 8(b) of Regulation No 45/2001 were satisfied in the present case.

94

Moreover, the applicant submits that the sole purpose of MS’ requests was for him to understand the allegations made against him and show that those allegations were unfounded, in order to set the record straight and restore his honour. Furthermore, the transfer of the personal data at issue was necessary in order to understand the Commission’s decision of 10 April 2013 to terminate MS’ collaboration with the Team Europe network. The rejection of MS’ request for the transfer of that personal data to him was not justified by Article 20 of Regulation No 45/2001. The same finding was made by the Ombudsman.

95

As regards the alleged misapplication of Articles 13 and 20 of Regulation No 45/2001, the Commission contends that the personal data at issue was not personal data concerning only MS and was not liable to be checked for accuracy or to be subject to rectification, erasure or blocking by MS. It is not the role or the objective of Regulation No 45/2001 to grant access to a purely subjective account, submitted to the Commission by a complainant who attended a conference and dinner with MS and corresponded with him via a social network and by e-mail, or to allow that account to be challenged or have it rectified.

96

Moreover, as regards the application of Article 8(b) of Regulation No 45/2001, the Commission submits that the personal data may be transferred to a third party only if that transfer, first, satisfies the conditions laid down in Article 8(a) or (b) of that regulation, and secondly, constitutes lawful processing of that data, in accordance with the requirements of Article 5 of that same regulation. In the action in case T‑435/16, the applicant does not state how the transfer of the personal data of third parties to MS could be regarded as lawful. The Commission contends, therefore, that the necessity of having the personal data transferred, within the meaning of Article 8(b) of that regulation, was not established. Moreover, it contends that MS was fully aware of the reasons for its decision of 10 April 2013 to terminate his collaboration with the Team Europe network.

97

As regards the applicant’s argument, challenging the application of Article 20 of Regulation No 45/2001, according to which the Commission had not provided proof that there was a real risk to fundamental rights or the legitimate interests of third parties, the Commission states that it consulted X and that she feared that MS might hold her or her friends accountable. Taking into account those concerns and the documents at issue in its possession, the Commission considers that such a risk did exist.

98

Finally, the Commission contends that it was not possible to separate certain parts of the documents at issue and regard those parts as not being covered by the concept of personal data. It would therefore not have been possible to grant partial access (other than to information with no substantive content) to the documents at issue without revealing personal data or information on the private lives of the third parties concerned or information that would identify those third parties.

99

As a preliminary point, it should be noted that the objective of Regulation No 45/2001 is different from that of Regulation No 1049/2001. While the latter is designed to ensure the greatest possible transparency of the decision-making process of the EU public authorities and the information on which they base their decisions, the former, as indicated in Article 1 thereof, is designed to ensure the protection of the freedoms and fundamental rights of natural persons, and in particular their right to privacy with respect to the processing of personal data (judgments of 29 June 2010, Commission v Bavarian Lager, C‑28/08 P, EU:C:2010:378, paragraph 49, and of 21 September 2016, Secolux v Commission, T‑363/14, EU:T:2016:521, paragraph 26).

100

It is clear from the case-law of the European Court of Human Rights on the application of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950, that a person’s right to protection of reputation is part of the right to respect for private life (ECtHR, 21 September 2010, Polanco Torres and Movilla Polanco v. Spain, CE:ECHR:2010:0921JUD003414706, § 40, and 7 February 2012, Axel Springer AG v. Germany, CE:ECHR:2012:0207JUD003995408, § 83). A person’s reputation forms part of his personal identity and psychological integrity, which fall within the scope of his private life (ECtHR, 25 February 1992, Pfeifer and Plankl v. Austria, CE:ECHR:1992:0225JUD001080284, § 35). The same considerations apply to personal honour (ECtHR, 4 October 2007, Sanchez Cardenas v. Norway, CE:ECHR:2007:1004JUD001214803, § 38, and 9 April 2009, A. v. Norway, CE:ECHR:2009:0409JUD002807006, § 64).

101

In accordance with Article 13(c) of Regulation No 45/2001, the data subject has the right to obtain communication in an intelligible form of any personal data undergoing processing and of any available information as to the source of that data. In that regard, Regulation No 45/2001 must be interpreted in accordance with Article 41 of the Charter, which recognises the right to good administration and in particular the right of every person to have access to his file (judgment of 16 September 2013, CN v Council, F‑84/12, EU:F:2013:128, paragraphs 39 and 40).

102

In that context, the protection of the fundamental right to respect for privacy means, inter alia, that any individual may be certain that the personal data relating to him is correct and that it is processed in a lawful manner. It is in order to be in a position to carry out the necessary checks that the data subject has a right of access to the data relating to him that is being processed. That right of access is necessary, inter alia, to enable the data subject to obtain, depending on the circumstances, the rectification, erasure or blocking of his data by the data controller and consequently to exercise the right to request that, after a certain period of time, assessments relating to him are erased, that is to say, destroyed (see, by analogy, judgment of 20 December 2017, Nowak, C‑434/16, EU:C:2017:994, paragraph 57 and the case-law cited).

103

As regards, in particular, the reasons relied on by the applicant in paragraph 94 above, the applicant has demonstrated to the requisite legal standard the need to have a right of access to the personal data at issue relating to MS in order to request, where appropriate, the rectification or erasure thereof. MS had not had access to the allegations of unwanted conduct made against him in X’s complaint, and yet those allegations had been clearly identified by the Commission as having formed the basis for its decision of 10 April 2013 to terminate MS’ collaboration with the Team Europe network (see paragraph 6 above), and had thus been such as to damage his reputation and his honour as a network collaborator.

104

Article 20 of Regulation No 45/2001 nevertheless lays down exceptions from and restrictions on the data subject’s right of access and provides, inter alia, that the EU institutions and bodies may restrict the application of Article 13 of that regulation where such restriction constitutes a necessary measure to safeguard the protection of the data subject or of the rights and freedoms of others.

105

Moreover, the transfer of personal data to recipients other than EU institutions and bodies or the data subjects is governed by Article 8 of Regulation No 45/2001, which provides, inter alia, that personal data may be transferred to such recipients only if they establish the necessity of having the data transferred and if there is no reason to assume that the data subject’s legitimate interests might be prejudiced.

106

In so far as the personal data at issue is personal data relating both to MS and to X and other third parties mentioned in the documents at issue, it is appropriate to weigh the competing legitimate interests in the case in order to determine whether there was an overriding interest justifying the refusal to grant MS a right of access to that personal data.

107

Even if it is accepted, as argued by the Commission, that the need for protection applied to the documents at issue in their entirety, the Commission did not explain, in its decision of 16 June 2016, how the disclosure of those documents, and in particular the two containing the exchange of correspondence between X and MS (to which MS had already had access as the author or recipient), could specifically and actually have prejudiced the legitimate interests of X or of the other third parties mentioned in those documents.

108

In that regard, in its decision of 19 April 2016, the Commission cannot, for the sake of completeness, refer to the fact that the person who lodged the complaint did not want the personal data at issue to be brought to the attention of MS for fear of reprisals. Although the Commission pointed out at the hearing that one of the persons referred to in the documents at issue lived in the same town as MS, there was nothing in the case file to indicate that MS, who already had sufficient information to be able to identify X and Y as the persons who might have lodged the complaint, intended to take any retaliatory action against them beyond what was necessary in order to defend his legitimate interests.

109

In paragraph 32 of its friendly solution proposal, the Ombudsman itself noted that ‘in respect of [MS’] rights of defence, [t]he reason [for the refusal to disclose the documents at issue relating to the need to protect X’s confidentiality was] insufficient, given that the Commission Representation [had] not provided evidence of a real risk for the fundamental rights or the legitimate interests of [X], and that [t]he statements [made by the latter] and the evidence submitted [by X] constituted the decisive, and indeed the only, proof against [MS]’.

110

In that regard, it should be noted that, according to the case-law, the mere fact that a document concerns an interest protected by an exception is not sufficient to justify application of that exception. The institution concerned must also provide explanations as to how access to that document could specifically and actually undermine the interest protected by an exception laid down in that article (see judgments of 16 July 2015, ClientEarth v Commission, C‑612/13 P, EU:C:2015:486, paragraph 68 and the case-law cited; of 11 March 2009, Borax Europe v Commission, T‑121/05, not published, EU:T:2009:64, paragraph 43 and the case-law cited; and of 11 March 2009, Borax Europe v Commission, T‑166/05, not published, EU:T:2009:65, paragraph 50 and the case-law cited).

111

In this case, it is not clear from the decision of 16 June 2016 that that institution adequately weighed the competing legitimate interests in the case, as is required under the combined provisions of Articles 8, 13 and 20 of Regulation No 45/2001.

112

It follows from all the foregoing considerations that the decision of 16 June 2016 rejecting MS’ request that the personal data at issue be transferred to him infringes Articles 8, 13 and 20 of Regulation No 45/2001 and, for that reason, must be annulled, without it being necessary to examine the other plea raised by the applicant.

113

The applicant seeks compensation for the non-material damage suffered by MS as a result of the Commission’s rejection of his request for access to the documents at issue and for the transfer of the personal data at issue to him.

114

The applicant submits that, by refusing to grant MS access to the documents and testimonies at issue and by refusing to transfer the personal data at issue to him, the Commission engaged in wrongful conduct and infringed his fundamental rights, such as his rights of defence and his right to respect for privacy, which led to his suffering a feeling of injustice and a loss of confidence in that institution. For those reasons, the applicant considers that the claim for compensation is severable from the application for annulment, and remains valid even if the action for annulment is dismissed. On that basis, the applicant assesses the damage suffered by MS at EUR 20000 in each case, which comes to a total of EUR 40000.

115

According to settled case-law, the European Union’s non-contractual liability under the second paragraph of Article 340 TFEU, for unlawful conduct of an institution, is subject to the satisfaction of a number of conditions, namely the unlawfulness of the conduct alleged against the institution, the fact of damage and the existence of a causal link between the alleged conduct and the damage complained of. If one of the conditions is not satisfied, the action must be dismissed in its entirety, without it being necessary to examine the other conditions for incurring non-contractual liability (judgments of 14 October 2014, Giordano v Commission, C‑611/12 P, EU:C:2014:2282, paragraph 35 and the case-law cited, and of 9 September 1999, Lucaccioni v Commission, C‑257/98 P, EU:C:1999:402, paragraph 14).

116

Moreover, a claim for compensation in respect of material or non-material damage must be dismissed where it has a direct link with an action for annulment that has itself been dismissed as inadmissible or unfounded (see, to that effect, judgment of 14 September 2006, Commission v Fernández Gómez, C‑417/05 P, EU:C:2006:582, paragraph 51).

117

In the present case, the claim for compensation for the non-material damage that MS suffered as a result of the alleged unlawfulness of the Commission’s refusal to give him access to the documents at issue is directly linked to the application for annulment of the decisions of 2 February and 19 April 2016, in so far as they reject MS’ request for access to the documents at issue. However, as is apparent from paragraphs 43 to 91 above, the examination of the pleas raised in support of that application for annulment has not revealed that the Commission acted unlawfully or, therefore, that there was any misconduct capable of incurring its liability. Consequently, the claim for compensation for the damage allegedly suffered by MS as a result of those unlawful acts must also be dismissed as unfounded.

118

As regards the claim for compensation for the non-material damage suffered by MS as a result of the alleged unlawfulness of the refusal to transfer the personal data at issue to him, it is clear from paragraph 112 above that the decision of 16 June 2016 rejecting the request to transfer that personal data to MS infringes Articles 8, 13 and 20 of Regulation No 45/2001 and must, accordingly, be annulled. According to settled case-law, the annulment of an unlawful measure may constitute, in itself, adequate and, in principle, sufficient compensation for all non-material damage that that measure may have caused (see judgment of 9 November 2004, Monalto v Council, T‑116/03, EU:T:2004:325, paragraph 127 and the case-law cited), unless the applicant can show that he has suffered non-material damage that is severable from the unlawfulness that is the basis for the annulment and that is incapable of being entirely repaired by that annulment (see judgment of 6 June 2006, Girardot v Commission, T‑10/02, EU:T:2006:148, paragraph 131 and the case-law cited).

119

The feeling of injustice and anxiety caused by the fact that an individual is required to undergo judicial proceedings in order to secure recognition of his rights constitutes harm that can be inferred from the mere fact that the administration acted unlawfully. That harm is reparable where it is not compensated by the satisfaction resulting from the annulment of the unlawful measure (see, to that effect, judgment of 10 July 2014, CG v EIB, F‑115/11, EU:F:2014:187, paragraph 132).

120

Moreover, the annulment of an unlawful measure cannot constitute, in itself, adequate compensation where the contested measure contains an explicitly negative and potentially damaging assessment of the applicant’s abilities (see, to that effect, judgments of 7 February 1990, Culin v Commission, C‑343/87, EU:C:1990:49, paragraphs 27 to 29; of 23 March 2000, Rudolph v Commission, T‑197/98, EU:T:2000:86, paragraph 98; and of 13 December 2005, Cwik v Commission, T‑155/03, T‑157/03 and T‑331/03, EU:T:2005:447, paragraphs 205 and 206).

121

In the present case, the decision of 16 June 2016 rejecting the request to transfer the personal data at issue to MS without adequately weighing the competing legitimate interests in the case caused MS to suffer a feeling of injustice and a loss of confidence in the Commission. Moreover, as is clear from the assertions made by the Commission before the Ombudsman and before the Court, that decision was based on the ‘fear of reprisals [from MS] against [X] or the other persons mentioned in [the] complaint’, which is to say it was based on a negative and potentially damaging assessment of MS.

122

In those circumstances, the annulment of the decision of 16 June 2016 cannot, in itself, suffice to constitute adequate compensation for the non-material damage suffered by MS as a result of that decision.

123

The applicant should be awarded EUR 5000 in respect of part of the claim for compensation for the non-material damage suffered by MS as a result of the unlawful refusal to transfer the personal data at issue to him. That claim should be rejected as to the remainder.

124

Under Article 134(3) of the Rules of Procedure, the parties are to bear their own costs where each party succeeds on some heads and fails on others.

125

In the present case, since the applicant and the Commission were both unsuccessful on some of their heads, each will bear their own costs.

On those grounds,

THE GENERAL COURT (First Chamber)

hereby: