–

Nova Kreditna Banka Maribor d.d., by D. Miklavčič and M. Menard, odvetnici,

–

the Republika Slovenija, by M. Prelesnik, Informacijska pooblaščenka,

–

the Slovenian Government, by T. Mihelič Žitko and V. Klemenc, acting as Agents,

–

the Hungarian Government, by M. Z. Fehér, acting as Agent,

–

the European Commission, by G. Braun, K.-Ph. Wojcik and M. Žebre, acting as Agents,

1

This request for a preliminary ruling concerns the interpretation of Article 1(2)(c) of Directive 2003/98/EC of the European Parliament and of the Council of 17 November 2003, on the re-use of public sector information (OJ 2003 L 345, p. 90), as amended by Directive 2013/37/EU of the European Parliament and of the Council of 26 June 2013 (OJ 2013 L 175, p. 1) (‘the PSI Directive’), together with Article 432(2) and Article 446 of Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (OJ 2013 L 176, p. 1, corrigenda OJ 2013 L 208, p. 68 and OJ 2013 L 321, p. 6).

2

The request was submitted in the course of proceedings between Nova Kreditna Banka Maribor d.d. (‘NKBM’) and the Republika Slovenija (Republic of Slovenia) concerning a decision of the Informacijski pooblaščenec (Information Commissioner, Slovenia) requiring NKBM to disclose information to a journalist.

3

Recitals 5, 6, 9 and 10 of the PSI Directive are worded as follows:

…

4

Article 1 of the PSI Directive, on the subject matter and scope thereof, is worded as follows:

‘1.   This Directive establishes a minimum set of rules governing the re-use and the practical means of facilitating re-use of existing documents held by public sector bodies of the Member States.

2.   This Directive shall not apply to:

…

…

3.   This Directive builds on and is without prejudice to access regimes in the Member States.

…’

5

Article 2 of that directive provides:

‘For the purpose of this Directive the following definitions shall apply:

…

…’

6

Under Recitals 68 and 76 of Regulation No 575/2013:

…

7

In accordance with the first paragraph of Article 1, subparagraph (e) of Regulation No 575/2013, the latter lays down uniforms rules concerning general prudential requirements that institutions supervised under Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ 2013 L 176, p. 338) are to comply with, so far as concerns public disclosure requirements.

8

Under Article 4(1)(3) of Regulation No 575/2013, ‘institution’ means a credit institution or an investment firm.

9

Article 431(1) and (3) of that regulation, set out in Part Eight and headed ‘Scope of disclosure requirements’, provides:

‘1.   Institutions shall publicly disclose the information laid down in Title II, subject to the provisions laid down in Article 432.

…

3.   Institutions shall adopt a formal policy to comply with the disclosure requirements laid down in this Part, and have policies for assessing the appropriateness of their disclosures, including their verification and frequency. Institutions shall also have policies for assessing whether their disclosures convey their risk profile comprehensively to market participants.

Where those disclosures do not convey the risk profile comprehensively to market participants, institutions shall publicly disclose the information necessary in addition to that required in accordance with paragraph 1. …’

10

Under the first subparagraph of Article 432(2) of Regulation No 575/2013:

‘Institutions may also omit one or more items of information included in the disclosures listed in Titles II and III if those items include information which is regarded as proprietary or confidential in accordance with the second and third subparagraphs, except for the disclosures laid down in Articles 437 and 450.’

11

In accordance with the first paragraph of Article 433 of that regulation, institutions are to publish the disclosures required by Part Eight at least on an annual basis.

12

Article 446 of Regulation No 575/2013 provides:

‘Institutions shall disclose the approaches for the assessment of own funds requirements for operational risk that the institution qualifies for; a description of the methodology set out in Article 312(2), if used by the institution, including a discussion of relevant internal and external factors considered in the institution’s measurement approach, and in the case of partial use, the scope and coverage of the different [approaches] used.’

13

Article 1a of the Zakon o dostopu do informacij javnega značaja (Law on access to public information; ‘ZDIJZ’) provides:

‘(1)   The present law governs also the procedure enabling anyone to have free access to information of public importance held by commercial companies and other private law entities which are under the dominant influence, whether directly or indirectly, individually or jointly, of the Republic of Slovenia, autonomous local territorial entities or other public law entities (“undertakings under the dominant influence of public law entities”) and to reuse that information.

(2)   There shall be deemed to be dominant influence within the meaning of the preceding paragraph where the Republic of Slovenia, autonomous local territorial entities or other public law entities, individually or collectively:

…

(3)   A bank which benefits from measures taken pursuant to the law governing the measures taken by the Republic of Slovenia to strengthen the stability of banks shall also be deemed to be under a dominant influence within the meaning of paragraph 1 of this Article.

(4)   An undertaking shall also be considered subject to the obligation laid down in paragraph 1 of this Article for a period of five years after the dominant influence as referred to in paragraph 2 of this Article has come to an end, in the case of information of public importance that dates from the period during which that undertaking was under a dominant influence.

(5)   An undertaking under the dominant influence of public law entities shall be subject to the obligation to provide access to information of public importance within the meaning of Article 4a of this Law, which originates at any time during which that undertaking was under the dominant influence of a public law entity.

(6)   In addition to the objective set out in Article 2(1), the present Law shall also have the objective of enhancing transparency, and the responsible management of public funds and the finances of undertakings under the dominant influence of public law entities.’

14

Article 4a(1) of that law states:

‘In the case of undertakings under the dominant influence of public law entities, information of public importance shall mean:

…’

15

Article 6a of that law provides:

‘(1)   Notwithstanding the provisions of paragraph 1 of the preceding Article, access requested to information of public importance on undertakings under the dominant influence of public law entities shall be given in respect of the main data concerning completed transactions referred to in the first indent of Article 4a(1) of the present Law, that is:

…

(3)   Notwithstanding the provisions of paragraph 1 of this Article, where the information of public importance is not accessible via the internet in accordance with Article 10a(4) of this Law, a person required to provide access shall refuse access to the main data relating to a transaction referred to in paragraph 1 of this Article, if that person demonstrates that disclosure would seriously prejudice their competitive position on the market, unless those data concern transactions involving the provision of services by financiers, sponsors, consultants, authors or other intellectual services, or other transactions that produce a similar outcome.

…’

16

NKBM is a Slovenian bank.

17

In 2014, a journalist made a request to NKBM for information on the contracts that it had concluded with consultancy firms, law firms and companies providing services of an intellectual nature over the period from 1 October 2012 to 17 April 2014 and, more specifically, on the type of transactions, contractual partners, the value of those contracts, the amounts of the various payments made in respect of those services, the date on which those contracts were concluded, and the duration of the transactions.

18

During the period at issue in the main proceedings, NKBM was under the dominant influence of a public law entity, within the meaning of Article 1a(2) and (3) of the ZDIJZ, since the Republic of Slovenia directly or indirectly held the majority of the capital and NKBM had been substantially recapitalised by that Member State. On 21 April 2016, NKBM became a private limited liability company. According to the information provided by the referring court, NKBM is nonetheless required to provide the information requested, pursuant to Article 1a(4) of the ZDIJZ.

19

NKBM refused the request for access to the information at issue in the main proceedings, and the Information Commissioner ordered the bank, on the basis of the ZDIJZ, to grant that request. The action brought by NKBM against that decision was dismissed by the court at first instance.

20

NKBM brought an appeal on a point of law before the Vrhovno sodišče (Supreme Court, Slovenia), invoking incompatibility with both the Slovenian Constitution and EU law. In that regard, NKBM stated that the information at issue in the main proceedings included data considered commercially confidential. The Vrhovno sodišče (Supreme Court) made a referral to the Ustavno sodišče (Constitutional Court, Slovenia) for an assessment of the constitutionality of the provisions of the ZDIJZ at issue in the main proceedings; the Ustavno sodišče declared those provisions compatible with the Slovenian Constitution.

21

The referring court states that, according to the provisions of the ZDIJZ, persons who are under the influence of a public law entity are required to grant access to the information at issue in the main proceedings, even if the public interest presented by the disclosure thereof is not greater than the interest of such persons to restrict access to that information. The referring court is unclear, in particular, as to whether the third indent of Article 1(2)(c) of the PSI Directive, together with Article 432(2) of Regulation No 575/2013, precludes such a right of access to that information.

22

In that context, the referring court refers also to Article 16 of the Charter of Fundamental Rights of the European Union (‘the Charter’) and to the fundamental freedoms enshrined in Articles 49, 56 and 63 TFEU. In that connection, although the referring court expresses doubts as to the cross-border nature of the dispute in the main proceedings, it is unclear nevertheless as to the applicability of those fundamental freedoms, on account of (i) NKBM’s claim that it has a subsidiary in Austria and that that subsidiary was acquired, after the dispute emerged, by an undertaking established in another Member State; and (ii) the fact that the access to the data of banks under the dominant influence of a public law entity, granted by the ZDIJZ, might deter some service providers from other Member States from providing services to banks such as NKBM, as well as potential investors in other Member States from acquiring shares in such a bank.

23

In those circumstances, the Vrhovno sodišče (Supreme Court) decided to stay the proceedings and to refer the following questions to the Court for a preliminary ruling:

24

By its questions, which it is appropriate to examine together, the referring court is asking, in essence, whether Article 1(2)(c), third indent, of the PSI Directive and Article 432(2) of Regulation No 575/2013 must be interpreted as precluding national legislation, such as that at issue in the main proceedings, requiring a bank which has been under the dominant influence of a public law entity to disclose information on contracts provided for consultancy and legal services, copyright contracts and other services of an intellectual nature that it concluded during the period in which it was under that dominant influence, with no exceptions on the ground of protecting that bank’s business secrets.

25

In order to answer those questions, it is necessary to verify whether a request for access to information, such as that addressed to NKBM on the basis of the ZDIJZ, comes within the scope of the PSI Directive and of Regulation No 575/2013.

26

So far as concerns the scope ratione personae of the PSI Directive, it is clear from Article 1(1) thereof that it establishes a minimum set of rules governing the re-use and the practical means of facilitating re-use of existing documents held by ‘public sector bodies of the Member States’. That directive therefore applies to ‘public sector bodies of the Member States’. Under Article 2(1) of the directive, that concept encompasses the State, regional or local authorities, bodies governed by public law and associations formed by one or several such authorities or one or several such bodies governed by public law.

27

Furthermore, under Article 2(2)(a) to (c) of the PSI Directive, a ‘body governed by public law’ means any body which (i) is established for the specific purpose of meeting needs in the general interest, not having an industrial or commercial character; (ii) has legal personality; and (iii) is financed for the most part by the State, or regional or local authorities, or other bodies governed by public law, or subject to management supervision by those bodies, or having an administrative, managerial or supervisory board, more than half of whose members are appointed by the State, regional or local authorities or by other bodies governed by public law.

28

As the Advocate General notes in point 32 of his Opinion, the conditions set out in that provision are cumulative, in such a way that a body cannot be categorised as a body governed by public law, within the meaning of that provision, where one of those conditions is not satisfied. Furthermore, Recital 10 of the PSI Directive states that that concept of ‘body governed by public law’ is taken from the public procurement directives and does not cover public undertakings. It is therefore not sufficient that an undertaking be established by the State or by another body governed by public law, or that it be financed by means resulting from the activities of such bodies for that undertaking to be itself considered a ‘body governed by public law’. It must also have been established for the specific purpose of meeting needs in the general interest, not having an industrial or commercial character (see, by analogy, with regard to the public procurement directives, judgment of 5 October 2017, LitSpecMet, C‑567/15, EU:C:2017:736, paragraphs 34 and 36 and the case-law cited).

29

In the present case, it would appear from the information set out in the order for reference that NKBM is a commercial bank providing banking services, in particular, on the Slovenian banking market, in competition with other banks operating on the same market. Furthermore, according to the same information, NKBM appears to have been under the dominant influence of a body governed by public law only temporarily, that is, during the period which began to run as from its recapitalisation by the Slovenian State until it became a private limited liability company. Lastly, the information before the Court does not include any evidence allowing it to find that NKBM was established for the specific purpose of meeting needs in the general interest, not having an industrial or commercial character.

30

In those circumstances, it is apparent that NKBM does not satisfy the first condition referred to in paragraph 27 of the present judgment and, accordingly, does not come within the scope ratione personae of the PSI Directive, a matter which is, however, for the referring court to verify.

31

So far as concerns whether a request for access to information, such as that at issue in the main proceedings, comes within the scope ratione materiae of that directive, it is clear from Article 1(1), as has been stated in paragraph 26 of the present judgment, that that directive concerns the re-use of documents held by public sector bodies of the Member States. Under Article 2(4) of that directive, the word ‘re-use’ is to be understood as meaning the use of such documents by persons or legal entities for commercial or non-commercial purposes other than the initial purpose within the public task for which the documents were produced.

32

By contrast, it must be noted that the PSI Directive contains no obligation in matters of access to documents. In accordance with Article 1(3) read in conjunction with Recital 9, that directive builds on the existing access regimes in the Member States and does not change the national rules for access to documents. Thus the PSI Directive does not enshrine a right of access to public sector information, but presupposes the existence of such a right in the legislation in force in the Member States, so that the arrangements and procedures for accessing that information do not come within the scope of the directive.

33

Accordingly, a request for access to information, such as that at issue in the main proceedings, does not come within the scope ratione materiae of the PSI Directive. That directive is therefore irrelevant to the request at issue in the main proceedings.

34

The provisions of the ZDIJZ at issue in the main proceedings enshrine an individual right of access to information of public importance held, in particular, by undertakings under the dominant influence of bodies governed by public law, with the aim, set out in Article 1a(6) of the ZDIJZ, of enhancing transparency and the responsible management of public funds and the finances of those undertakings. As regards information concerning transactions involving the provision of services by financiers, sponsors, consultants, authors or other transactions that produce a similar outcome, those undertakings are even required, pursuant to Article 6a(3) of the ZDIJZ, to grant such access without exception.

35

So far as concerns the question whether Regulation No 575/2013, in particular Article 432(2) thereof, is such as to form the basis of a right to refuse a request for access to information such as that at issue in the main proceedings, it should be noted that the provisions set out in Part Eight of that regulation, including Article 432(2), do not enshrine an individual right of access to information, but provide for an obligation to disclose the information referred to under Title II of Part VII, irrespective of any such request.

36

As is clear from the provisions, read in conjunction, of Article 431(1) and the first paragraph of Article 433 of Regulation No 575/2013, credit institutions and investment firms are required to disclose that information of their own initiative, and not on request, at least once a year. Moreover, the information to be disclosed in the context of that obligation is determined by the regulation itself and encompasses, in principle, according to Article 431(1) and (3) together with Article 432 of that regulation, all the information referred to under Title II of Part Eight thereof.

37

It should be added that, as the Advocate General notes in essence in point 53 of his Opinion, the rules relating to disclosure laid down by Regulation No 575/2013 pursue a different objective to that of the access regime enshrined in the ZDIJZ.

38

Under Recitals 68 and 76 of the regulation, the latter’s objective is to enhance market discipline and financial stability, by providing market participants with accurate and comprehensive information regarding the risk profile of individual credit institutions and investment firms. By contrast, as has been explained in paragraph 34 of the present judgment, the objective of the access regime enshrined by the ZDIJZ is to enhance transparency, together with the responsible management of public funds and the finances of undertakings under the dominant influence of bodies governed by public law.

39

Accordingly, a request for access to information, such as that at issue in the main proceedings, does not come within the scope of Regulation No 575/2013, so that Article 432(2) thereof cannot form the basis of a right to oppose such a request. That regulation is therefore irrelevant to the request at issue in the main proceedings.

40

In the light of the findings in paragraphs 33 and 39 of the present judgment, it should be noted that the provisions of the ZDIJZ at issue in the main proceedings cannot be considered as coming within the scope of the PSI Directive or of Regulation No 575/2013.

41

Furthermore, according to the information from the referring court, the dispute in the main proceedings concerns a situation in which all the elements are confined to a single Member State, a situation to which the fundamental freedoms guaranteed by the TFEU do not apply (see, to that effect, judgments of 15 November 2016, Ullens de Schooten, C‑268/15, EU:C:2016:874, paragraph 47 and the case-law cited, and of 20 September 2018, Fremoluc, C‑343/17, EU:C:2018:754, paragraph 18).

42

That finding is not called into question by the fact, mentioned in the order for reference, that NKBM owns a subsidiary in Austria which was acquired by an undertaking established in another Member State. It is not apparent from that order that the nature and scope of the information which is subject to the request for access at issue in the main proceedings has any connection with the Austrian subsidiary of NKBM or with the undertaking which acquired that bank. Moreover, as the referring court points out, that acquisition was completed only subsequently to the circumstances which gave rise to the dispute in the main proceedings.

43

So far as concerns the possible deterrent effect that the access to the data of banks under the dominant influence of a public law entity, granted by the ZDIJZ, might have for service providers or investors from other Member States, it suffices to note that although the request for a preliminary ruling raises questions as to such an effect of that national legislation with regard to ‘some’ of those service providers and ‘some’ potential investors, it does not, however, contain any concrete evidence allowing a finding that one of those situations might arise in the context of the dispute in the main proceedings.

44

According to the case-law of the Court, such a request must clearly set out specific factors, that is, not hypothetical considerations but specific evidence, such as complaints or applications brought by operators situated in other Member States or involving nationals of those Member States, on the basis of which it may be positively established that nationals of other Member States are interested in making use of those fundamental freedoms in the situation at issue in the main proceedings (see, to that effect, judgments of 15 November 2016, Ullens de Schooten, C‑268/15, EU:C:2016:874, paragraphs 54 and 55, and of 20 September 2018, Fremoluc, C‑343/17, EU:C:2018:754, paragraphs 28 and 29).

45

It follows that the provisions of the ZDIJZ at issue in the main proceedings cannot be considered as implementing EU law, for the purposes of Article 51 of the Charter, in such a way that Article 16 thereof is not applicable to a dispute such as that at issue in the main proceedings.

46

In light of the foregoing, the answer to the questions asked is that Article 1(2)(c), third indent, of the PSI Directive and Article 432(2) of Regulation No 575/2013 must be interpreted as not applying to national legislation, such as that at issue in the main proceedings, requiring a bank which has been under the dominant influence of a body governed by public law to disclose information on contracts provided for consultancy and legal services, copyright contracts and other services of an intellectual nature that it concluded during the period in which it was under that dominant influence, with no exceptions on the ground of protecting that bank’s business secrets and, accordingly, as not precluding such national legislation.

47

Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Fourth Chamber) hereby rules:

Article 1(2)(c), third indent, of Directive 2003/98/EC of the European Parliament and of the Council of 17 November 2003 on the re-use of public sector information, and Article 432(2) of Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012, must be interpreted as not applying to national legislation, such as that at issue in the main proceedings, requiring a bank which has been under the dominant influence of a body governed by public law to disclose information on contracts provided for consultancy and legal services, copyright contracts and other services of an intellectual nature that it concluded during the period in which it was under that dominant influence, with no exceptions on the ground of protecting that bank’s business secrets and, accordingly, as not precluding such national legislation.