Case C-28/08 P

European Commission

v

The Bavarian Lager Co. Ltd

(Appeal – Access to the documents of the institutions – Document concerning a meeting held in the context of a procedure for failure to fulfil obligations – Protection of personal data – Regulation (EC) No 45/2001 – Regulation (EC) No 1049/2001)

Summary of the Judgment

1.        European Communities – Institutions – Right of public access to documents – Regulation No 1049/2001

(Art. 6 EU; European Parliament and Council Regulations No 45/2001 and No 1049/2001, Art. 4(1)(b))

2.        Approximation of laws – Protection of natural persons in relation to the processing of personal data – Processing of those data by Community institutions and bodies – Regulation No 45/2001

(European Parliament and Council Regulations No 45/2001, Arts 2(a), and 8(b), and No 1049/2001)

1.        Article 4(1)(b) of Regulation No 1049/2001 regarding public access to European Parliament, Council and Commission documents, which provides for an exception to access to a document where disclosure would undermine the protection of privacy and the integrity of the individual, in particular in accordance with EU legislation regarding the protection of personal data, establishes a specific and reinforced system of protection of a person whose personal data could, in certain cases, be communicated to the public. That provision is indivisible and requires that any undermining of privacy and the integrity of the individual must always be examined and assessed in conformity with that legislation, and in particular with Regulation No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data.

Whilst, according to Article 1(1) of Regulation No 45/2001, the purpose of that regulation is to ‘protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data’, that provision does not allow cases of processing of personal data to be separated into two categories, namely a category in which that treatment is examined solely on the basis of Article 8 of the European Court of Human Rights (ECHR) and the case-law of the European Court of Human Rights relating to that article and another category in which that processing is subject to the provisions of Regulation No 45/2001. In that regard, whilst it is clear from the first sentence of recital 15 of Regulation No 45/2001 that the Union legislature has pointed to the need to apply Article 6 EU and, by that means, Article 8 of the ECHR, where such processing is carried out by Community institutions or bodies in the exercise of activities falling outside the scope of that regulation, in particular those laid down in Titles V and VI of the EU Treaty in its version prior to the Treaty of Lisbon, such a reference has not been found necessary for processing carried out in the exercise of activities within the scope of that regulation, given that, in such cases, it is clearly Regulation No 45/2001 itself which applies.

It follows that, where a request based on Regulation No 1049/2001 seeks to obtain access to documents including personal data, the provisions of Regulation No 45/2001 become applicable in their entirety, including Articles 8 and 18 thereof, which constitute essential provisions of the system of protection established by that regulation.

(see paras 57, 59-64)

2.        The list of participants at a meeting held in the context of proceedings for failure to fulfil obligations appearing in the minutes of that meeting contains personal data for the purposes of Article 2(a) of Regulation No 45/2001, since the persons who participated in that meeting can be identified.

By requiring that, in respect of persons who have not given their express consent to the disclosure of their personal data contained in those minutes, the need for transfer of those personal data be established, the Commission complies with the provisions of Article 8(b) of that regulation.

Where, in the context of a request for access to those minutes under Regulation No 1049/2001, no express and legitimate justification or any convincing argument is provided in order to demonstrate the need for those personal data to be transferred, the Commission is not able to weigh up the various interests of the parties concerned. Nor is it able to verify whether there is any reason to assume that such transfer might prejudice the data subjects’ legitimate interests, as it is required to do by Article 8(b) of Regulation No 45/2001.

(see paras 70, 77-78)

JUDGMENT OF THE COURT (Grand Chamber)

29 June 2010 (*)

(Appeal – Access to the documents of the institutions – Document concerning a meeting held in the context of a procedure for failure to fulfil obligations –Protection of personal data – Regulation (EC) No 45/2001 – Regulation (EC) No 1049/2001)

In Case C‑28/08 P,

APPEAL under Article 56 of the Statute of the Court of Justice, brought on 23 January 2008,

European Commission, represented by C. Docksey and P. Aalto, acting as Agents, with an address for service in Luxembourg,

applicant,

supported by:

United Kingdom of Great Britain and Northern Ireland, represented by E. Jenkinson and V. Jackson, acting as Agents, assisted by J. Coppel, Barrister,

Council of the European Union, represented by B. Driessen and C. Fekete, acting as Agents,

interveners in the appeal,

the other parties to the proceedings being:

The Bavarian Lager Co. Ltd, established in Clitheroe (United Kingdom), represented by J. Webber and M. Readings, Solicitors,

applicant at first instance,

supported by:

Kingdom of Denmark, represented by B. Weis Fogh, acting as Agent,

Republic of Finland, represented by J. Heliskoski, acting as Agent,

Kingdom of Sweden, represented by K. Petkovska, acting as Agent,

interveners in the appeal,

European Data Protection Supervisor, represented by H. Hijmans, A. Scirocco and H. Kranenborg, acting as Agents,

intervener at first instance,

THE COURT (Grand Chamber),

composed of V. Skouris, President, A. Tizzano, J.N. Cunha Rodrigues, K. Lenaerts, R. Silva de Lapuerta and C. Toader, Presidents of Chambers, A. Rosas, K. Schiemann, E. Juhász (Rapporteur), G. Arestis and T. von Danwitz, Judges,

Advocate General: E. Sharpston,

Registrar: H. von Holstein, Deputy Registrar,

having regard to the written procedure and further to the hearing on 16 June 2009,

after hearing the Opinion of the Advocate General at the sitting on 15 October 2009,

gives the following

Judgment

1        By its appeal, the Commission of the European Communities seeks the annulment of the judgment of the Court of First Instance of the European Communities (now ‘the General Court’) of 8 November 2007 in Case T-194/04 Bavarian Lager v Commission [2007] ECR II‑4523; ‘the judgment under appeal’), in so far as that judgment annulled the Commission’s decision of 18 March 2004 (‘the contested decision’), rejecting the request by The Bavarian Lager Co. Ltd (‘Bavarian Lager’) for access to the full minutes of a meeting of 11 October 1996, held in the context of a procedure for failure to fulfil obligations (‘the meeting of 11 October 1996’).

 Legal context

2        Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) requires Member States to ensure the protection of the fundamental rights and freedoms of natural persons, and in particular their privacy in relation to the handling of personal data, in order to ensure the free movement of personal data in the European Community.

3        Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1), was adopted on the basis of Article 286 EC.

4        Recitals 1, 2, 5, 7, 8, 12, 14 and 15 of Regulation No 45/2001, or certain parts thereof, read as follows:

(1)      Article 286 [EC] requires the application to the Community institutions and bodies of the Community acts on the protection of individuals with regard to the processing of personal data and the free movement of such data.

(2)      A fully-fledged system of protection of personal data not only requires the establishment of rights for data subjects and obligations for those who process personal data, but also appropriate sanctions for offenders and monitoring by an independent supervisory body.

…

(5)      A Regulation is necessary to provide the individual with legally enforceable rights …

…

(7)      The persons to be protected are those whose personal data are processed by Community institutions or bodies in any context whatsoever …

(8)      The principles of data protection should apply to any information concerning an identified or identifiable person. …

…

(12)      Consistent and homogeneous application of the rules for the protection of individuals’ fundamental rights and freedoms with regard to the processing of personal data should be ensured throughout the Community.

…

(14)      To this end measures should be adopted which are binding on the Community institutions and bodies. These measures should apply to all processing of personal data by all Community institutions and bodies insofar as such processing is carried out in the exercise of activities all or part of which fall within the scope of Community law.

(15)      Where such processing is carried out by Community institutions or bodies in the exercise of activities falling outside the scope of this Regulation, in particular those laid down in Titles V and VI of the [EU Treaty, in its version prior to the Treaty of Lisbon], the protection of individuals’ fundamental rights and freedoms shall be ensured with due regard to Article 6 of [that EU Treaty]. Access to documents, including conditions for access to documents containing personal data, is governed by the rules adopted on the basis of Article 255 … EC the scope of which includes Titles V and VI of [the said EU Treaty].’

5        Article 1 of Regulation No 45/2001 provides:

‘1.      In accordance with this Regulation, the institutions and bodies set up by, or on the basis of, the Treaties establishing the European Communities, hereinafter referred to as “Community institutions or bodies”, shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data and shall neither restrict nor prohibit the free flow of personal data between themselves or to recipients subject to the national law of the Member States implementing Directive 95/46 …

2.      The independent supervisory authority established by this Regulation, hereinafter referred to as the European Data Protection Supervisor, shall monitor the application of the provisions of this Regulation to all processing operations carried out by a Community institution or body.’

6        Article 2 of that regulation provides:

‘For the purposes of this Regulation:

(a)      “personal data” shall mean any information relating to an identified or identifiable natural person hereinafter referred to as “data subject”; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity;

(b)      “processing of personal data” … any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

…’

7        Article 3 of the said regulation provides:

‘1.      This Regulation shall apply to the processing of personal data by all Community institutions and bodies insofar as such processing is carried out in the exercise of activities all or part of which fall within the scope of Community law.

2.      This Regulation shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.’

8        According to Article 4 of the same regulation:

‘1.      Personal data must be:

(a)      processed fairly and lawfully;

(b)      collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes …

...’

9        Article 5 of Regulation No 45/2001 provides:

‘Personal data may be processed only if:

(a)      processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties establishing the European Communities or other legal instruments adopted on the basis thereof or in the legitimate exercise of official authority vested in the Community institution or body or in a third party to whom the data are disclosed, or

(b)      processing is necessary for compliance with a legal obligation to which the controller is subject, or

...

(c)      the data subject has unambiguously given his or her consent ...

…’

10      Article 8 of that regulation, headed ‘Transfer of personal data to recipients, other than Community institutions and bodies, subject to Directive 95/46 …’, provides:

‘Without prejudice to Articles 4, 5, 6 and 10, personal data shall only be transferred to recipients subject to the national law adopted for the implementation of Directive 95/46:

(a)      if the recipient establishes that the data are necessary for the performance of a task carried out in the public interest or subject to the exercise of public authority, or

(b)      if the recipient establishes the necessity of having the data transferred and if there is no reason to assume that the data subject’s legitimate interests might be prejudiced.’

11      Article 18 of the said regulation, headed ‘The data subject’s right to object’, states:

‘The data subject shall have the right:

(a)      to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her, except in the cases covered by Article 5(b), (c) and (d). Where there is a justified objection, the processing in question may no longer involve those data;

(b)      to be informed before personal data are disclosed for the first time to third parties or before they are used on their behalf for the purposes of direct marketing, and to be expressly offered the right to object free of charge to such disclosure or use.’

12      Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43), defines the principles, conditions and limits for the right of access to documents of those institutions laid down by Article 255 EC. That regulation has applied since 3 December 2001.

13      According to recital 1 of Regulation No 1049/2001:

‘The second subparagraph of Article 1 of the [EU Treaty in its version prior to the Lisbon Treaty] enshrines the concept of openness, stating that the Treaty marks a new stage in the process of creating an ever closer union among the peoples of Europe, in which decisions are taken as openly as possible and as closely as possible to the citizen.’

14      According to recital 2 of Regulation No 1049/2001:

‘Openness enables citizens to participate more closely in the decision-making process and guarantees that the administration enjoys greater legitimacy and is more effective and more accountable to the citizen in a democratic system. Openness contributes to strengthening the principles of democracy and respect for fundamental rights as laid down in Article 6 of the EU Treaty [in its version prior to the Treaty of Lisbon] and in the Charter of Fundamental Rights of the European Union [“the Charter”].’

15      Recitals 4 and 11 of Regulation No 1049/2010 state:

‘(4)      The purpose of this Regulation is to give the fullest possible effect to the right of public access to documents and to lay down the general principles and limits on such access in accordance with Article 255(2) … EC.

...

(11)      In principle, all documents of the institutions should be accessible to the public. However, certain public and private interests should be protected by way of exceptions. The institutions should be entitled to protect their internal consultations and deliberations where necessary to safeguard their ability to carry out their tasks. In assessing the exceptions, the institutions should take account of the principles in Community legislation concerning the protection of personal data, in all areas of Union activities.’

16      According to Article 2 of Regulation No 1049/2001, headed ‘Beneficiaries and scope’:

‘1.      Any citizen of the Union, and any natural or legal person residing or having its registered office in a Member State, has a right of access to documents of the institutions, subject to the principles, conditions and limits defined in this Regulation.

2.      The institutions may, subject to the same principles, conditions and limits, grant access to documents to any natural or legal person not residing or not having its registered office in a Member State.

3.      This Regulation shall apply to all documents held by an institution, that is to say, documents drawn up or received by it and in its possession, in all areas of activity of the European Union.

4.      Without prejudice to Articles 4 and 9, documents shall be made accessible to the public either following a written application or directly in electronic form or through a register. In particular, documents drawn up or received in the course of a legislative procedure shall be made directly accessible in accordance with Article 12.

5.      Sensitive documents as defined in Article 9(1) shall be subject to special treatment in accordance with that Article.

…’

17      According to Article 4 of Regulation No 1049/2001, concerning exceptions to the right of access:

The institutions shall refuse access to a document where disclosure would undermine the protection of:

...

b)      privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection of personal data.

2.      The institutions shall refuse access to a document where disclosure would undermine the protection of:

...

–        the purpose of inspections, investigations and audits,

unless there is an overriding public interest in disclosure.

...’

18      Article 6(1) of Regulation No 1049/2001 provides that ‘[t]he applicant is not obliged to state reasons for the application’.

 Factual background to the dispute

19      The facts behind the present dispute are set out in paragraphs 15 to 28 and 34 to 37 of the judgment under appeal as follows:

‘15      [Bavarian Lager] was established on 28 May 1992 for the importation of German beer for public houses and bars in the United Kingdom, situated primarily in the North of England.

16      However, Bavarian Lager was not able to sell its product, since a large number of publicans in the United Kingdom were tied by exclusive purchasing contracts obliging them to obtain their supplies of beer from certain breweries.

17      Under the Supply of Beer (Tied Estate) Order 1989 SI 1989/2390, British breweries holding rights in more than 2 000 pubs are required to allow the managers of those establishments the possibility of buying a beer from another brewery, on condition, according to Article 7(2)(a) of the order, that it is conditioned in a cask and has an alcohol content exceeding 1.2% by volume. That provision is commonly known as the “Guest Beer Provision” (“the GBP”).

18      However, most beers produced outside the United Kingdom cannot be regarded as “cask-conditioned beers”, within the meaning of the GBP, and thus do not fall within its scope.

19      Considering that the GBP constituted a measure having equivalent effect to a quantitative restriction on imports, and was thus incompatible with Article 30 of the EC Treaty (now, after amendment, Article 28 EC), [Bavarian Lager] lodged a complaint with the Commission by letter of 3 April 1993, registered under reference P/93/4490/UK.

20      Following its investigation, the Commission decided, on 12 April 1995, to institute proceedings against the United Kingdom of Great Britain and Northern Ireland under Article 169 of the EC Treaty (now Article 226 EC). It notified the applicant on 28 September 1995 of that investigation and of the fact that it had sent a letter of formal notice to the United Kingdom on 15 September 1995. On 26 June 1996, the Commission decided to send a reasoned opinion to the United Kingdom and, on 5 August 1996, issued a press release announcing that decision.

21      On 11 October 1996, … [the meeting of 11 October 1996 was held] which was attended by officers of the Directorate-General (DG) for the Internal Market and Financial Services, officials of the United Kingdom Government Department of Trade and Industry and representatives of the Confederation des Brasseurs du Marche Commun (“CBMC”). [Bavarian Lager] had requested the right to attend the meeting [of 11 October 1996] in a letter dated 27 August 1996, but the Commission refused to grant permission to attend.

22      On 15 March 1997 the Department of Trade and Industry in the United Kingdom announced a proposal to amend the GBP under which a bottle-conditioned beer could be sold as a guest beer, as well as cask-conditioned beer. After the Commission had, on two occasions, namely 19 March 1997 and 26 June 1997, suspended its decision to issue a reasoned opinion to the United Kingdom, the head of Unit 2 “Application of Articles 30 to 36 of the EC Treaty (notification, complaints, infringements etc.) and removal of trade barriers” of Directorate B “Free movement of goods and public procurement” of DG “Internal Market and Financial Services”, in a letter of 21 April 1997, informed [Bavarian Lager] that, in view of the proposed amendment of the GBP, the Article 169 procedure had been suspended and the reasoned opinion had not been served on the United Kingdom Government. He indicated that the procedure would be discontinued entirely as soon as the amended GBP came into force. The new version of the GBP became applicable on 22 August 1997. Consequently, the reasoned opinion was never sent to the United Kingdom and the Commission finally decided on 10 December 1997 to take no further action in the infringement procedure.

23      By fax of 21 March 1997, [Bavarian Lager] asked the Director-General of DG “Internal Market and Financial Services” for a copy of the “reasoned opinion”, in accordance with the Code of Conduct [concerning public access to Council and Commission documents (OJ 1993 L 340, p. 41)]. That request, despite being repeated, was refused.

24      By [decision] of 18 September 1997 …, the Secretary-General of the Commission confirmed the refusal of the application sent to DG “Internal Market and Financial Services”.

25      [Bavarian Lager] brought an action, registered as Case T‑309/97, before the [General Court] against the decision of 18 September 1997. In its judgment of 14 October 1999 in Case T‑309/97 Bavarian Lager v Commission [1999] ECR II‑3217, the [General Court] dismissed the action, stating that the preservation of the aim in question, namely allowing a Member State to comply voluntarily with the requirements of the Treaty, or, where necessary, to give it the opportunity to justify its position, justified, for the protection of the public interest, the refusal of access to a preparatory document relating to the investigation stage of the procedure under Article 169 of the Treaty …

26      On 4 May 1998, [Bavarian Lager] addressed a request to the Commission under the Code of Conduct for access to all of the submissions made under file reference P/93/4490/UK by 11 named companies and organisations and by three defined categories of person or company. The Commission refused the initial application on the ground that the [said] Code of Conduct applies only to documents of which the Commission is the author. The confirmatory application was rejected on the grounds that the Commission was not the author of the document in question and that any application had to be sent to the author.

27      On 8 July 1998, [Bavarian Lager] complained to the European Ombudsman under reference 713/98/IJH, stating, by letter dated 2 February 1999, that it wished to obtain the names of the delegates of the CBMC who had attended the meeting on 11 October 1996 and the names of the companies and any persons who fell into one of the 14 categories identified in the original request for access to documents containing the communications to the Commission under file reference P/93/4490/UK.

28      Following an exchange of letters between the Ombudsman and the Commission, the latter indicated to the Ombudsman in October and November 1999 that, of the 45 letters that it had written to the persons concerned requesting approval to disclose their identities to [Bavarian Lager], 20 replies had been received, of which 14 were positive and 6 were negative. The Commission supplied the names and addresses of those that had responded positively. [Bavarian Lager] stated to the Ombudsman that the information provided by the Commission was still incomplete.

…

34      By e-mail of 5 December 2003, [Bavarian Lager] sent a request to the Commission for access to the documents referred to in paragraph 26 above, based on Regulation No 1049/2001.

35      The Commission replied to that request by letter of 27 January 2004 stating that certain documents relating to the meeting [of 11 October 1996] could be disclosed, but drawing [Bavarian Lager’s] attention to the fact that five names had been blanked out from the minutes of the meeting of 11 October 1996, following two express refusals by persons to consent to the disclosure of their identity and the Commission’s failure to contact the remaining three attendees.

36      By e-mail of 9 February 2004, [Bavarian Lager] made a confirmatory application within the meaning of Article 7(2) of Regulation No 1049/2001, in which it requested the full minutes of the meeting of 11 October 1996, including all of the names.

37      By [the contested decision], the Commission rejected the confirmatory application of [Bavarian Lager]. It confirmed that Regulation No 45/2001 applied to the request for disclosure of the names of the other participants. As [Bavarian Lager] had not established an express and legitimate purpose or need for such a disclosure, the conditions set out by Article 8 of that regulation had not been met and the exception provided for in Article 4(1)(b) of Regulation No 1049/2001 applied. It added that, even if the rules on the protection of personal data did not apply, it would nevertheless have had to refuse to disclose the other names under Article 4(2), third indent, of Regulation No 1049/2001 so as not to compromise its ability to conduct inquiries.’

 Procedure before the General Court and the judgment under appeal

20      By the judgment under appeal, the General Court annulled the contested decision.

21      Regarding access to the full minutes of the meeting of 11 October 1996, the General Court took the view, in paragraphs 90 to 95 of the judgment under appeal, that Bavarian Lager’s request was based on Regulation No 1049/2001. Whilst pointing out that, according to Article 6(1) of Regulation No 1049/2001, a person requesting access is not required to justify his request and therefore does not have to demonstrate any interest in having access to the documents requested, the Court examined the exception to communication laid down in Article 4(1)(b) of that regulation, where disclosure of such a document might undermine the protection of privacy and the integrity of the individual.

22      In paragraphs 96 to 119 of the judgment under appeal, the General Court examined the relationship between Regulations Nos 45/2001 and 1049/2001. While stating that recital 15 of Regulation No 45/2001 indicates that access to documents, including those containing personal data, is governed by Article 255 EC, the Court emphasised that, according to recital 11 of Regulation No 1049/2001, in assessing the need for an exception, the institutions should take account of the principles in Community legislation concerning the protection of personal data in all areas of activity of the Union, thus including principles laid down in Regulation No 45/2001.

23      Referring to the definitions of ‘personal data’ and ‘processing of personal data’ mentioned in Article 2(a) and (b) of Regulation No 45/2001, in paragraph 105 of the judgment under appeal, the General Court concluded that communication of data, by transmission, dissemination or otherwise making available, falls within the definition of ‘processing’, and thus Regulation No 45/2001 itself provides, independently of Regulation No 1049/2001, for the possibility of making certain personal data public.

24      In paragraph 106 of the judgment under appeal, the General Court stated that the processing of personal data must be lawful under Article 5(a) or (b) of Regulation No 45/2001, according to which the processing must be necessary for the performance of a task carried out in the public interest or for compliance with a legal obligation to which the controller is subject. The Court then pointed out that the right of access to documents of the institutions recognised to citizens of the European Union and to any natural or legal person residing in or having its registered office in a Member State, laid down by Article 2 of Regulation No 1049/2001, constitutes a legal obligation for the purposes of Article 5(b) of Regulation No 45/2001. Therefore, if Regulation No 1049/2001 requires the communication of data, which constitutes ‘processing’ within the meaning of Article 2(b) of Regulation No 45/2001, Article 5 of that same regulation makes such communication lawful in that respect.

25      Ruling on the question of the obligation to prove the need to transfer, laid down by Article 8(b) of Regulation No 45/2001, and of the data subject’s right to object pursuant to Article 18 of that regulation, the General Court held, in particular, in paragraphs 107 to 109 of the judgment under appeal, as follows:

107      As regards the obligation to prove the need to transfer, laid down by Article 8(b) of Regulation No 45/2001, it should be remembered that access to documents containing personal data falls within the application of Regulation No 1049/2001, and that, according to Article 6(1) of the latter, a person requesting access is not required to justify his request and therefore does not have to demonstrate any interest in having access to the documents requested … Therefore, where personal data are transferred in order to give effect to Article 2 of Regulation No 1049/2001, laying down the right of access to documents for all citizens of the Union, the situation falls within the application of that regulation and, therefore, the applicant does not need to prove the necessity of disclosure for the purposes of Article 8(b) of Regulation No 45/2001. If one were to require the applicant to demonstrate the necessity of having the data transferred, as an additional condition imposed in Regulation No 45/2001, that requirement would be contrary to the objective of Regulation No 1049/2001, namely the widest possible public access to documents held by the institutions.

108      Moreover, given that access to a document will be refused under Article 4(1)(b) of Regulation No 1049/2001 where disclosure would undermine protection of the privacy and the integrity of the individual, a transfer that does not fall under that exception cannot, in principle, prejudice the legitimate interests of the person concerned within the meaning of Article 8(b) of Regulation No 45/2001.

109      As regards the data subject’s right to object, Article 18 of Regulation No 45/2001 provides that that person has the right to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her, except in cases covered by, in particular, Article 5(b) of that regulation. Therefore, given that the processing envisaged by Regulation No 1049/2001 constitutes a legal obligation for the purposes of Article 5(b) of Regulation No 45/2001, the data subject does not, in principle, have a right to object. However, since Article 4(1)(b) of Regulation No 1049/2001 lays down an exception to that legal obligation, it is necessary to take into account, on that basis, the impact of the disclosure of data concerning the data subject.’

26      Finally, the General Court held that the exception under Article 4(1)(b) of Regulation No 1049/2001 had to be interpreted restrictively and concerned only personal data that were capable of actually and specifically undermining the protection of privacy and the integrity of the individual. Examination as to whether a person’s private life might be undermined had to be carried out in the light of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’) and the case-law based thereon.

27      The Court concluded generally in paragraph 133, and specifically in paragraph 139 of the judgment under appeal, that the Commission had erred in law by holding that Bavarian Lager had not established either an express and legitimate purpose or any need to obtain the names of the five persons who participated in the meeting of 11 October 1996 and who, after that meeting, objected to communication of their identity to Bavarian Lager.

28      As regards the exception concerning protection of the purpose of inspections, investigations and audits laid down in Article 4(2), third indent, of Regulation No 1049/2001, the General Court found in general that that provision could not be applied to the present case, and, in particular, it held that confidential treatment could not be granted to persons other than the complainant and that that protection was justified only if the procedure in question was still in progress.

 Procedure before the Court and forms of order sought

29      By order of the President of the Court of Justice of 13 June 2008, the United Kingdom of Great Britain and Northern Ireland and the Council of the European Union were granted leave to intervene in support of the Commission. The Republic of Finland and the Kingdom of Sweden were granted leave to intervene in support of Bavarian Lager, and the Kingdom of Denmark was granted leave to intervene in support of Bavarian Lager and the European Data Protection Supervisor.

30      The Commission claims that the Court should:

–        set aside the judgment under appeal, in so far as it annuls the contested decision;

–        give a final ruling on the questions which form the subject-matter of the present appeal; and

–        order Bavarian Lager to pay the costs incurred by it at first instance and in the current appeal, or, should it be unsuccessful, order it to pay half the costs incurred by Bavarian Lager at first instance.

31      The Council contends that the Court should:

–        set aside the judgment under appeal, and

–        order Bavarian Lager to pay the costs.

32      The United Kingdom contends that the Court should:

–        uphold the appeal by the Commission and grant the forms of order sought by the latter.

33      Bavarian Lager contends that the Court should:

–        dismiss the Commission’s appeal in its entirety, and

–        order the Commission to pay the costs incurred by Bavarian Lager at first instance and in the present appeal, or, should the appeal be upheld, order each of the parties to bear its own costs.

34      The Kingdom of Denmark, the Republic of Finland, the Kingdom of Sweden and the European Data Protection Supervisor contend that the Court should:

–        dismiss the appeal in its entirety.

 The application for reopening of the oral procedure

35      By letters of 11 and 13 November 2009, the Commission and the European Data Protection Supervisor applied for the reopening of the oral procedure.

36      The Court may of its own motion, or on a proposal from the Advocate General, or at the request of the parties, order the reopening of the oral procedure in accordance with Article 61 of the Rules of Procedure if it considers that it lacks sufficient information, or that the case must be dealt with on the basis of an argument which has not been debated between the parties (Case C‑42/07 Liga Portuguesa de Futebol Profissional and Bwin International [2009] ECR I-0000, paragraph 31 and case-law cited).

37      In their applications, the Commission and the European Data Protection Supervisor restrict themselves to claiming that the Advocate General’s Opinion was based on arguments that were not debated either before the General Court or before the Court of Justice.

38      The Court considers that it has all the material necessary for it to decide the dispute before it and that the case does not have to be examined in the light of an argument that has not been the subject of discussion before it.

39      Therefore, there is no need to reopen the oral procedure.

 The appeal

40      In support of its appeal, the Commission puts forward three grounds, namely:

–        the General Court, by declaring that Article 8(b) of Regulation No 45/2001 was not applicable to this case, misinterpreted and misapplied Article 4(1)(b) of Regulation No 1049/2001;

–        by interpreting restrictively the condition in Article 4(1)(b) of Regulation No 1049/2001, the General Court erred in law by excluding from its scope the Community legislation on protection of personal data contained in a document; and

–        as regards the interpretation of Article 4(2), third indent, of Regulation No 1049/2001, the General Court wrongly limited the protection of confidentiality of investigations to complainants only, and, for that confidentiality to be maintained, required that the investigation be still current.

 Findings of the Court

41      Since the first two pleas largely overlap, it will be convenient to examine them together.

42      The Commission, supported by the United Kingdom and the Council, argues in essence that the General Court made errors of law in its findings concerning the application of the exemption in Article 4(1)(b) of Regulation No 1049/2001 and thereby rendered certain provisions of Regulation No 45/2001 ineffective.

43      The Commission considers that the General Court ruled without reference to the second part of the sentence in Article 4(1)(b) of Regulation No 1049/2001, which provides that institutions are to refuse access to a document where disclosure would undermine the protection of privacy and the integrity of the individual, ‘in particular in accordance with Community legislation regarding the protection of personal data’. The General Court interpreted the exception laid down in Article 4(1)(b) of Regulation No 1049/2001 only in the light of Article 8 of the ECHR and the case-law based thereon.

44      That erroneous interpretation of the exception laid down by the said Article 4(1)(b) had the consequence of rendering ineffective several provisions of Regulation No 45/2001, and in particular Articles 8(b) and 18(a) of that regulation.

45      It is precisely, the Commission argues, by giving precedence to Article 6(1) of Regulation No 1049/2001, which provides that, in the context of requests from the public for access to documents, the applicant is not obliged to state reasons for the application, that the General Court renders ineffective Article 8(b) of Regulation No 45/2001, which requires the recipient of a transfer of personal data to demonstrate the need for their disclosure.

46      The obligation on a recipient of a transfer of personal data to demonstrate that a legitimate purpose is being pursued, contained in Article 8(b) of Regulation 45/2001 is, the Commission submits, one of the key provisions of the whole of the Union legislation concerning data protection. Thus, communication of personal data appearing in a document held by an institution constitutes not only public access to a document under Regulation No 1049/2001, but also a processing of personal data under Regulation No 45/2001, which the General Court did not take into account.

47      The Commission adds that the General Court, in holding that any request for personal data must comply with the legal obligation arising from the right of public access, within the meaning of Article 5(b) of Regulation No 45/2001, renders devoid of purpose Article 18(a) of that regulation, which confers on the data subject the right to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her.

48      It should be noted that the General Court devotes a significant part of its reasoning, and in particular paragraphs 96 to 119 of the judgment under appeal, to the relationship between Regulations Nos 45/2001 and 1049/2001 and then applies, in paragraphs 121 to 139 of that judgment, the criteria which it inferred therefrom to this case.

49      As the General Court rightly states in paragraph 98 of the judgment under appeal, when examining the relationship between Regulations Nos 1049/2001 and 45/2001 for the purpose of applying the exception under Article 4(1)(b) of Regulation No 1049/2001 to the case in point, it must be borne in mind that those regulations have different objectives. The first is designed to ensure the greatest possible transparency of the decision-making process of the public authorities and the information on which they base their decisions. It is thus designed to facilitate as far as possible the exercise of the right of access to documents, and to promote good administrative practices. The second is designed to ensure the protection of the freedoms and fundamental rights of individuals, particularly their private life, in the handling of personal data.

50      As stated in recital 2 of Regulation No 45/2001, the Union legislature intended to establish a ‘fully-fledged system’ of protection of personal data, and considered it necessary, in the words of recital 12 thereof, to ensure throughout the Community ‘consistent and homogeneous application of the rules for the protection of individuals’ fundamental rights and freedoms with regard to the processing of personal data’.

51      According to that same recital 12, the rights conferred on data subjects for their protection with regard to the processing of personal data constitute rules for the protection of fundamental rights and freedoms. In the mind of the Union legislature, the Union legislation on the processing of personal data serves to protect fundamental rights and freedoms.

52      According to recitals 7 and 14 of Regulation No 45/2001, the measures in question are ‘binding measures’ which apply to ‘all processing of personal data by all Community institutions and bodies’ and ‘in any context whatsoever’.

53      As indicated in recital 1 thereof, Regulation No 1049/2001 forms part of the intention expressed in the second paragraph of Article 1 EU to mark a new stage in the process of creating an ever closer union among the peoples of Europe, in which decisions are taken as openly as possible and as closely as possible to the citizen.

54      According to recital 2 of that regulation, openness enables citizens to participate more closely in the decision-making process and guarantees that the administration enjoys greater legitimacy and is more effective and more accountable to the citizen in a democratic system.

55      Regulation No 1049/2001 lays down as a general rule that the public may have access to the documents of the institutions, but provides for exceptions by reason of certain public and private interests. In particular, recital 11 of that regulation states that, ‘[i]n assessing the exceptions, the institutions should take account of the principles in Community legislation concerning the protection of personal data, in all areas of Union activities’.

56      Regulations Nos 45/2001 and 1049/2001 were adopted on dates very close to each other. They do not contain any provisions granting one regulation primacy over the other. In principle, their full application should be ensured.

57      The only express link between those two regulations is established in Article 4(1)(b) of Regulation No 1049/2001, which provides for an exception to access to a document where disclosure would undermine the protection of privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection of personal data.

58      In this case, in paragraphs 111 to 120 of the judgment under appeal, the General Court limits the application of the exception under Article 4(1)(b) of that regulation to situations in which privacy or the integrity of the individual would be infringed for the purposes of Article 8 of the ECHR and the case-law of the European Court of Human Rights, without taking into account the legislation of the Union concerning the protection of personal data, particularly Regulation No 45/2001.

59      It should be observed that, in acting in that way, the General Court disregards the wording of Article 4(1)(b) of Regulation No 1049/2001, which is an indivisible provision and requires that any undermining of privacy and the integrity of the individual must always be examined and assessed in conformity with the legislation of the Union concerning the protection of personal data, and in particular with Regulation No 45/2001.

60      Article 4(1)(b) of Regulation No 1049/2001 establishes a specific and reinforced system of protection of a person whose personal data could, in certain cases, be communicated to the public.

61      According to Article 1(1) of Regulation No 45/2001, the purpose of that regulation is to ‘protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data’. That provision does not allow cases of processing of personal data to be separated into two categories, namely a category in which that treatment is examined solely on the basis of Article 8 of the ECHR and the case-law of the European Court of Human Rights relating to that article and another category in which that processing is subject to the provisions of Regulation No 45/2001.

62      It is clear from the first sentence of recital 15 of Regulation No 45/2001 that the Union legislature has pointed to the need to apply Article 6 EU and, by that means, Article 8 of the ECHR, ‘[w]here such processing is carried out by Community institutions or bodies in the exercise of activities falling outside the scope of this Regulation, in particular those laid down in Titles V and VI of the [EU Treaty in its version prior to the Treaty of Lisbon]’. By contrast, such a reference was not found necessary for processing carried out in the exercise of activities within the scope of that regulation, given that, in such cases, it is clearly Regulation No 45/2001 itself which applies.

63      It follows that, where a request based on Regulation No 1049/2001 seeks to obtain access to documents including personal data, the provisions of Regulation No 45/2001 become applicable in their entirety, including Articles 8 and 18 thereof.

64      By not taking account of the reference in Article 4(1)(b) of Regulation No 1049/2001 to the legislation of the Union concerning the protection of personal data and thus to Regulation No 45/2001, the General Court dismissed at the outset, in paragraph 107 of the judgment under appeal, the application of Article 8(b) of Regulation No 45/2001, and, in paragraph 109 of the judgment under appeal, the application of Article 18 of Regulation No 45/2001. And yet those articles constitute essential provisions of the system of protection established by Regulation No 45/2001.

65      Consequently, the particular and restrictive interpretation which the General Court gave to Article 4(1)(b) of Regulation No 1049/2001 does not correspond to the equilibrium which the Union legislature intended to establish between the two regulations in question.

66      In this case, it is apparent from the information on the file, and in particular from the contested decision, that, following the requests by Bavarian Lager of 4 May 1998, 5 December 2003 and 9 February 2004, the Commission sent the latter a document containing the minutes of the meeting of 11 October 1996, with five names removed. Of those five names, three persons could not be contacted by the Commission in order to give their consent, and two others expressly objected to the disclosure of their identity.

67      In refusing full access to that document, the Commission based its reasoning on Article 4(1)(b) of Regulation No 1049/2001 and Article 8 of Regulation No 45/2001.

68      It should be noted that, in paragraph 104 of the judgment under appeal, the General Court, in examining Article 2(a) of Regulation No 45/2001, that is to say the definition of the concept of ‘personal data’, correctly held that surnames and forenames may be regarded as personal data.

69      It also correctly established, in paragraph 105 of that judgment, in examining Article 2(b) of that regulation, that is to say the definition of the concept of ‘processing of personal data’, that the communication of such data falls within the definition of ‘processing’, for the purposes of that regulation.

70      The General Court was right to conclude, in paragraph 122 of the judgment under appeal, that the list of participants in the meeting of 11 October 1996 appearing in the minutes of that meeting thus contains personal data for the purposes of Article 2(a) of Regulation No 45/2001, since the persons who participated in that meeting can be identified.

71      Therefore, the decisive question is whether the Commission could grant access to the document including the five names of the participants in the meeting of 11 October 1996, in compliance with Article 4(1)(b) of Regulation No 1049/2001 and Regulation No 45/2001.

72      First of all, it should be noted that Bavarian Lager was able to have access to all the information concerning the meeting of 11 October 1996, including the opinions which those contributing expressed in their professional capacity.

73      The Commission, at the time of the first request by Bavarian Lager dated 4 May 1998, sought the agreement of the participants at the meeting of 11 October 1996 to the disclosure of their names. As the Commission indicates in the decision of 18 March 2003, that procedure was in compliance with the requirements of Directive 95/46, in force at that time.

74      Following a new request by Bavarian Lager to the Commission, dated 5 December 2003, seeking communication of the full minutes of the meeting of 11 October 1996, the Commission informed Bavarian Lager on 27 January 2004 that, having regard to the entry into force of Regulations Nos 45/2001 and 1049/2001, it was henceforward obliged to treat that request under the specific regime of those regulations, particularly Article 8(b) of Regulation No 45/2001.

75      Whether under the former system of Directive 95/46 or under the system of Regulations Nos 45/2001 and 1049/2001, the Commission was right to verify whether the data subjects had given their consent to the disclosure of personal data concerning them.

76      This Court finds that, by releasing the expurgated version of the minutes of the meeting of 11 October 1996 with the names of five participants removed therefrom, the Commission did not infringe the provisions of Regulation No 1049/2001 and sufficiently complied with its duty of openness.

77      By requiring that, in respect of the five persons who had not given their express consent, Bavarian Lager establish the necessity for those personal data to be transferred, the Commission complied with the provisions of Article 8(b) of Regulation No 45/2001.

78      As Bavarian Lager has not provided any express and legitimate justification or any convincing argument in order to demonstrate the necessity for those personal data to be transferred, the Commission has not been able to weigh up the various interests of the parties concerned. Nor was it able to verify whether there was any reason to assume that the data subjects’ legitimate interests might be prejudiced, as required by Article 8(b) of Regulation No 45/2001.

79      It follows from the above that the Commission was right to reject the application for access to the full minutes of the meeting of 11 October 1996.

80      Therefore, the General Court erred in law in concluding, in paragraphs 133 and 139 of the judgment under appeal, that in this case the Commission had wrongly applied Article 4(1)(b) of Regulation No 1049/2001 and held that Bavarian Lager had not established either an express and legitimate purpose in obtaining, or any need to obtain, the document at issue in its entirety.

81      In the light of those considerations as a whole, it is appropriate, without there being any need to examine the other arguments and pleas of the parties, to set aside the judgment under appeal in so far as it annuls the contested decision.

 The consequences of the judgment under appeal being set aside

82      In accordance with the first paragraph of Article 61 of the Statute of the Court of Justice, if the Court quashes the decision of the General Court, it may itself give final judgment in the matter, where the state of the proceedings so permits.

83      That is the case here.

84      As the Court has found in paragraphs 69 and 73 of this judgment, the contested decision did not infringe the provisions of Regulations Nos 45/2001 and 1049/2001.

85      The action for annulment by Bavarian Lager against that decision must therefore be dismissed.

 Costs

86      Pursuant to the first paragraph of Article 122 of the Rules of Procedure, where the appeal is well founded and the Court of Justice itself gives final judgment in the case, the Court is to make a decision as to costs. Under Article 69(2) of those rules, which applies to appeal proceedings by virtue of Article 118 thereof, the unsuccessful party is to be ordered to pay the costs, if they have been applied for in the successful party’s pleadings. Under Article 69(4) of those rules, which applies to appeal proceedings by virtue of Article 118 thereof, Member States and institutions which intervene in the proceedings are to bear their own costs. The Court may order an intervener to bear its own costs.

87      Since the Commission has applied for costs and Bavarian Lager has been unsuccessful in the appeal, Bavarian Lager must be ordered to pay the costs relating to the appeal.

88      Since the Commission has also applied for an order that Bavarian Lager pay the costs of the procedure before the General Court and the action before that Court has been dismissed, Bavarian Lager must be ordered to pay the costs relating to the procedure at first instance.

89      The Kingdom of Denmark, the Republic of Finland, the Kingdom of Sweden, the United Kingdom, the Council and the European Data Protection Supervisor must be ordered to bear their own costs.

On those grounds, the Court (Grand Chamber) hereby:

1.      Sets aside the judgment of the Court of First Instance of the European Communities of 8 November 2007 in Case T-194/04 Bavarian Lager v Commission, in so far as it annuls the Commission’s decision of 18 March 2004, rejecting an application for access to the full minutes of the meeting of 11 October 1996, including all the names, and in so far as it orders the European Commission to pay the costs of The Bavarian Lager Co. Ltd;

2.      Dismisses the action of The Bavarian Lager Co. Ltd against the Commission’s decision of 18 March 2004, rejecting an application for access to the full minutes of the meeting of 11 October 1996, including all the names;

3.      Orders The Bavarian Lager Co. Ltd to pay the costs incurred by the European Commission both in the context of the present appeal proceedings and before the Court of First Instance;

4.      Orders the Kingdom of Denmark, the Republic of Finland, the Kingdom of Sweden, the United Kingdom of Great Britain and Northern Ireland, the Council of the European Union and the European Data Protection Supervisor to bear their own costs.

[Signatures]

---

* Language of the case: English.