# CJEU Bavarian Lager: Disclosing personal data in access-to-documents requests is - Type: Case Law - Source: CJEU - Date: 2010-06-29 - Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62008CJ0028&ref=6182 - Canonical: https://overview.legal/posts/6182 - Topics: Right to Restriction, Personal Data, Controllers, Supervisory Authorities, Accountability, Consent, Processing, Processors, Supervision, Minors ## Summary Processing: Communication of personal data in response to a request for access to documents constitutes processing. (¶69) ## Sections (67) ### ¶900 KB. Apply EUR-Lex Access to European Union law This document is an excerpt from the EUR-Lex website You are here EUROPA EUR-Lex home EUR-Lex - 62008CJ0028 - EN Help Print Menu EU law Treaties Treaties currently in force Founding Treaties Accession Treaties Other treaties and protocols Chronological overview Legal acts Consolidated texts International agreements Preparatory documents EFTA documents Lawmaking procedures Summaries of EU legislation Browse by EU institutions European Parliament European Council Council of the European Union European Commission Court of Justice of the European Union European Central Bank European Court of Auditors European Economic and Social Committee European Committee of the Regions Browse by EuroVoc EU case-law Case-law Reports of cases Directory of case-law Official Journal Access to the Official Journal Official Journal L series daily view Official Journal C series daily view Browse the Official Journal Legally binding printed editions Special edition National law and case-law National transposition National case-law JURE case-law Information Themes in focus EUR-Lex developments Statistics ELI register What is ELI ELI background Why implement ELI Countries implementing ELI Testimonials Implementing ELI Glossary EU budget online Quick search Use quotation marks to search for an "exact phrase". Append an asterisk ( * ) to a search term to find variations of it (transp * , 32019R * ). Use a question mark ( ? ) instead of a single character in your search term to find variations of it (ca ? e finds case, cane, care). Search tips Need more search options? Use the Advanced search Document 62008CJ0028 Help Print Text Document information Summary / Keywords Permanent link Download notice Save to My items Create an email alert Create an RSS alert ​ Judgment of the Court (Grand Chamber) of > Topics: Statistics ### ¶11 October 1996 with the names of five participants removed therefrom, the Commission did not infringe the provisions of Regulation No 1049/2001 and sufficiently complied with its duty of openness. ### ¶2010 ( * ) (Appeal – Access to the documents of the institutions – Document concerning a meeting held in the context of a procedure for failure to fulfil obligations –Protection of personal data – Regulation (EC) No 45/2001 – Regulation (EC) No 1049/2001) In Case C‑28/08 P, APPEAL under Article 56 of the Statute of the Court of Justice, brought on > Topics: Personal Data · Applies: gdpr-art-56-en ### ¶1 By its appeal, the Commission of the European Communities seeks the annulment of the judgment of the Court of First Instance of the European Communities (now ‘the General Court’) of ### ¶2004 (‘the contested decision’), rejecting the request by The Bavarian Lager Co. Ltd (‘Bavarian Lager’) for access to the full minutes of a meeting of ### ¶286 EC. ### ¶6 Article 2 of that regulation provides: ‘For the purposes of this Regulation: (a) “personal data” shall mean any information relating to an identified or identifiable natural person hereinafter referred to as “data subject”; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity; (b) “processing of personal data” … any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; …’ > Topics: Identification, Personal Data, Processing · Applies: gdpr-art-2-en ### ¶7 Article 3 of the said regulation provides: ‘1. This Regulation shall apply to the processing of personal data by all Community institutions and bodies insofar as such processing is carried out in the exercise of activities all or part of which fall within the scope of Community law. > Topics: Processing, Personal Data · Applies: gdpr-art-3-en ### ¶2001 L 145, p. 43), defines the principles, conditions and limits for the right of access to documents of those institutions laid down by Article > Topics: Right of Access, Right of Access Procedures ### ¶16 However, Bavarian Lager was not able to sell its product, since a large number of publicans in the United Kingdom were tied by exclusive purchasing contracts obliging them to obtain their supplies of beer from certain breweries. ### ¶17 Under the Supply of Beer (Tied Estate) Order ### ¶1989 SI 1989/2390, British breweries holding rights in more than 2 000 pubs are required to allow the managers of those establishments the possibility of buying a beer from another brewery, on condition, according to Article 7(2)(a) of the order, that it is conditioned in a cask and has an alcohol content exceeding 1.2% by volume. That provision is commonly known as the “Guest Beer Provision” (“the GBP”). > Applies: gdpr-art-7-par-2-en ### ¶3 April 1993, registered under reference P/93/4490/UK. ### ¶12 April 1995, to institute proceedings against the United Kingdom of Great Britain and Northern Ireland under Article 169 of the EC Treaty (now Article ### ¶226 EC). It notified the applicant on ### ¶1995 On ### ¶15 March 1997 the Department of Trade and Industry in the United Kingdom announced a proposal to amend the GBP under which a bottle-conditioned beer could be sold as a guest beer, as well as cask-conditioned beer. After the Commission had, on two occasions, namely ### ¶19 March 1997 and ### ¶10 December 1997 to take no further action in the infringement procedure. ### ¶1993 L 340, p. 41)]. That request, despite being repeated, was refused. ### ¶18 September ### ¶1997 In its judgment of ### ¶14 October 1999 in Case T‑309/97 Bavarian Lager v Commission [1999] ECR II‑3217, the [General Court] dismissed the action, stating that the preservation of the aim in question, namely allowing a Member State to comply voluntarily with the requirements of the Treaty, or, where necessary, to give it the opportunity to justify its position, justified, for the protection of the public interest, the refusal of access to a preparatory document relating to the investigation stage of the procedure under Article 169 of the Treaty … ### ¶8 July 1998, [Bavarian Lager] complained to the European Ombudsman under reference 713/98/IJH, stating, by letter dated ### ¶2 February 1999, that it wished to obtain the names of the delegates of the CBMC who had attended the meeting on ### ¶5 December 2003, [Bavarian Lager] sent a request to the Commission for access to the documents referred to in paragraph 26 above, based on Regulation No 1049/2001. ### ¶9 February 2004, [Bavarian Lager] made a confirmatory application within the meaning of Article 7(2) of Regulation No 1049/2001, in which it requested the full minutes of the meeting of > Applies: gdpr-art-7-par-2-en ### ¶20 By the judgment under appeal, the General Court annulled the contested decision. ### ¶21 Regarding access to the full minutes of the meeting of ### ¶22 In paragraphs 96 to 119 of the judgment under appeal, the General Court examined the relationship between Regulations Nos 45/2001 and 1049/2001. While stating that recital 15 of Regulation No 45/2001 indicates that access to documents, including those containing personal data, is governed by Article > Topics: Personal Data ### ¶255 EC, the Court emphasised that, according to recital 11 of Regulation No 1049/2001, in assessing the need for an exception, the institutions should take account of the principles in Community legislation concerning the protection of personal data in all areas of activity of the Union, thus including principles laid down in Regulation No 45/2001. > Topics: Personal Data ### ¶23 Referring to the definitions of ‘personal data’ and ‘processing of personal data’ mentioned in Article 2(a) and (b) of Regulation No 45/2001, in paragraph 105 of the judgment under appeal, the General Court concluded that communication of data, by transmission, dissemination or otherwise making available, falls within the definition of ‘processing’, and thus Regulation No 45/2001 itself provides, independently of Regulation No 1049/2001, for the possibility of making certain personal data public. > Topics: Processing, Personal Data · Applies: gdpr-art-2-en ### ¶24 In paragraph 106 of the judgment under appeal, the General Court stated that the processing of personal data must be lawful under Article 5(a) or (b) of Regulation No 45/2001, according to which the processing must be necessary for the performance of a task carried out in the public interest or for compliance with a legal obligation to which the controller is subject. The Court then pointed out that the right of access to documents of the institutions recognised to citizens of the European Union and to any natural or legal person residing in or having its registered office in a Member State, laid down by Article 2 of Regulation No 1049/2001, constitutes a legal obligation for the purposes of Article 5(b) of Regulation No 45/2001. Therefore, if Regulation No 1049/2001 requires the communication of data, which constitutes ‘processing’ within the meaning of Article 2(b) of Regulation No 45/2001, Article 5 of that same regulation makes such communication lawful in that respect. > Topics: Personal Data, Right of Access Procedures, Right of Access, Processing · Applies: gdpr-art-2-en, gdpr-art-5-en ### ¶25 Ruling on the question of the obligation to prove the need to transfer, laid down by Article 8(b) of Regulation No 45/2001, and of the data subject’s right to object pursuant to Article 18 of that regulation, the General Court held, in particular, in paragraphs 107 to 109 of the judgment under appeal, as follows: > Topics: Right to Object, Personal Data · Applies: gdpr-art-8-en, gdpr-art-18-en ### ¶107 As regards the obligation to prove the need to transfer, laid down by Article 8(b) of Regulation No 45/2001, it should be remembered that access to documents containing personal data falls within the application of Regulation No 1049/2001, and that, according to Article 6(1) of the latter, a person requesting access is not required to justify his request and therefore does not have to demonstrate any interest in having access to the documents requested … Therefore, where personal data are transferred in order to give effect to Article 2 of Regulation No 1049/2001, laying down the right of access to documents for all citizens of the Union, the situation falls within the application of that regulation and, therefore, the applicant does not need to prove the necessity of disclosure for the purposes of Article 8(b) of Regulation No 45/2001. If one were to require the applicant to demonstrate the necessity of having the data transferred, as an additional condition imposed in Regulation No 45/2001, that requirement would be contrary to the objective of Regulation No 1049/2001, namely the widest possible public access to documents held by the institutions. > Topics: Personal Data, Right of Access Procedures, Right of Access · Applies: gdpr-art-6-par-1-en, gdpr-art-2-en, gdpr-art-8-en ### ¶108 Moreover, given that access to a document will be refused under Article 4(1)(b) of Regulation No 1049/2001 where disclosure would undermine protection of the privacy and the integrity of the individual, a transfer that does not fall under that exception cannot, in principle, prejudice the legitimate interests of the person concerned within the meaning of Article 8(b) of Regulation No 45/2001. > Topics: Legitimate Interest · Applies: gdpr-art-4-par-1-en, gdpr-art-8-en ### ¶109 As regards the data subject’s right to object, Article 18 of Regulation No 45/2001 provides that that person has the right to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her, except in cases covered by, in particular, Article 5(b) of that regulation. Therefore, given that the processing envisaged by Regulation No 1049/2001 constitutes a legal obligation for the purposes of Article 5(b) of Regulation No 45/2001, the data subject does not, in principle, have a right to object. However, since Article 4(1)(b) of Regulation No 1049/2001 lays down an exception to that legal obligation, it is necessary to take into account, on that basis, the impact of the disclosure of data concerning the data subject.’ > Topics: Personal Data, Right to Object · Applies: gdpr-art-4-par-1-en, gdpr-art-5-en, gdpr-art-18-en ### ¶26 Finally, the General Court held that the exception under Article 4(1)(b) of Regulation No 1049/2001 had to be interpreted restrictively and concerned only personal data that were capable of actually and specifically undermining the protection of privacy and the integrity of the individual. Examination as to whether a person’s private life might be undermined had to be carried out in the light of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on > Topics: Personal Data · Applies: gdpr-art-4-par-1-en, gdpr-art-8-en ### ¶4 November ### ¶1950 (‘the ECHR’) and the case-law based thereon. ### ¶27 The Court concluded generally in paragraph 133, and specifically in paragraph 139 of the judgment under appeal, that the Commission had erred in law by holding that Bavarian Lager had not established either an express and legitimate purpose or any need to obtain the names of the five persons who participated in the meeting of ### ¶28 As regards the exception concerning protection of the purpose of inspections, investigations and audits laid down in Article 4(2), third indent, of Regulation No 1049/2001, the General Court found in general that that provision could not be applied to the present case, and, in particular, it held that confidential treatment could not be granted to persons other than the complainant and that that protection was justified only if the procedure in question was still in progress. Procedure before the Court and forms of order sought > Applies: gdpr-art-4-par-2-en ### ¶29 By order of the President of the Court of Justice of ### ¶30 The Commission claims that the Court should: – set aside the judgment under appeal, in so far as it annuls the contested decision; – give a final ruling on the questions which form the subject-matter of the present appeal; and – order Bavarian Lager to pay the costs incurred by it at first instance and in the current appeal, or, should it be unsuccessful, order it to pay half the costs incurred by Bavarian Lager at first instance. ### ¶31 The Council contends that the Court should: – set aside the judgment under appeal, and – order Bavarian Lager to pay the costs. ### ¶32 The United Kingdom contends that the Court should: – uphold the appeal by the Commission and grant the forms of order sought by the latter. ### ¶33 Bavarian Lager contends that the Court should: – dismiss the Commission’s appeal in its entirety, and – order the Commission to pay the costs incurred by Bavarian Lager at first instance and in the present appeal, or, should the appeal be upheld, order each of the parties to bear its own costs. ### ¶34 The Kingdom of Denmark, the Republic of Finland, the Kingdom of Sweden and the European Data Protection Supervisor contend that the Court should: – dismiss the appeal in its entirety. The application for reopening of the oral procedure ### ¶35 By letters of 11 and ### ¶13 November 2009, the Commission and the European Data Protection Supervisor applied for the reopening of the oral procedure. ### ¶36 The Court may of its own motion, or on a proposal from the Advocate General, or at the request of the parties, order the reopening of the oral procedure in accordance with Article 61 of the Rules of Procedure if it considers that it lacks sufficient information, or that the case must be dealt with on the basis of an argument which has not been debated between the parties (Case C‑42/07 Liga Portuguesa de Futebol Profissional and Bwin International [2009] ECR I-0000, paragraph 31 and case-law cited). > Applies: gdpr-art-61-en ### ¶37 In their applications, the Commission and the European Data Protection Supervisor restrict themselves to claiming that the Advocate General’s Opinion was based on arguments that were not debated either before the General Court or before the Court of Justice. ### ¶38 The Court considers that it has all the material necessary for it to decide the dispute before it and that the case does not have to be examined in the light of an argument that has not been the subject of discussion before it. ### ¶39 Therefore, there is no need to reopen the oral procedure. The appeal ### ¶40 In support of its appeal, the Commission puts forward three grounds, namely: – the General Court, by declaring that Article 8(b) of Regulation No 45/2001 was not applicable to this case, misinterpreted and misapplied Article 4(1)(b) of Regulation No 1049/2001; – by interpreting restrictively the condition in Article 4(1)(b) of Regulation No 1049/2001, the General Court erred in law by excluding from its scope the Community legislation on protection of personal data contained in a document; and – as regards the interpretation of Article 4(2), third indent, of Regulation No 1049/2001, the General Court wrongly limited the protection of confidentiality of investigations to complainants only, and, for that confidentiality to be maintained, required that the investigation be still current. Findings of the Court > Topics: Personal Data · Applies: gdpr-art-4-par-1-en, gdpr-art-4-par-2-en, gdpr-art-8-en ### ¶41 Since the first two pleas largely overlap, it will be convenient to examine them together. ### ¶42 The Commission, supported by the United Kingdom and the Council, argues in essence that the General Court made errors of law in its findings concerning the application of the exemption in Article 4(1)(b) of Regulation No 1049/2001 and thereby rendered certain provisions of Regulation No 45/2001 ineffective. > Applies: gdpr-art-4-par-1-en ### ¶43 The Commission considers that the General Court ruled without reference to the second part of the sentence in Article 4(1)(b) of Regulation No 1049/2001, which provides that institutions are to refuse access to a document where disclosure would undermine the protection of privacy and the integrity of the individual, ‘in particular in accordance with Community legislation regarding the protection of personal data’. The General Court interpreted the exception laid down in Article 4(1)(b) of Regulation No 1049/2001 only in the light of Article 8 of the ECHR and the case-law based thereon. > Topics: Personal Data · Applies: gdpr-art-4-par-1-en, gdpr-art-8-en ### ¶44 That erroneous interpretation of the exception laid down by the said Article 4(1)(b) had the consequence of rendering ineffective several provisions of Regulation No 45/2001, and in particular Articles 8(b) and 18(a) of that regulation. > Applies: gdpr-art-4-par-1-en ### ¶45 It is precisely, the Commission argues, by giving precedence to Article 6(1) of Regulation No 1049/2001, which provides that, in the context of requests from the public for access to documents, the applicant is not obliged to state reasons for the application, that the General Court renders ineffective Article 8(b) of Regulation No 45/2001, which requires the recipient of a transfer of personal data to demonstrate the need for their disclosure. > Topics: Personal Data, Recipient · Applies: gdpr-art-6-par-1-en, gdpr-art-8-en ### ¶46 The obligation on a recipient of a transfer of personal data to demonstrate that a legitimate purpose is being pursued, contained in Article 8(b) of Regulation 45/2001 is, the Commission submits, one of the key provisions of the whole of the Union legislation concerning data protection. Thus, communication of personal data appearing in a document held by an institution constitutes not only public access to a document under Regulation No 1049/2001, but also a processing of personal data under Regulation No 45/2001, which the General Court did not take into account. > Topics: Recipient, Personal Data, Processing · Applies: gdpr-art-8-en ### ¶47 The Commission adds that the General Court, in holding that any request for personal data must comply with the legal obligation arising from the right of public access, within the meaning of Article 5(b) of Regulation No 45/2001, renders devoid of purpose Article 18(a) of that regulation, which confers on the data subject the right to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her. > Topics: Right to Object, Personal Data · Applies: gdpr-art-5-en, gdpr-art-18-en ### ¶48 It should be noted that the General Court devotes a significant part of its reasoning, and in particular paragraphs 96 to 119 of the judgment under appeal, to the relationship between Regulations Nos 45/2001 and 1049/2001 and then applies, in paragraphs 121 to 139 of that judgment, the criteria which it inferred therefrom to this case. ### ¶49 As the General Court rightly states in paragraph 98 of the judgment under appeal, when examining the relationship between Regulations Nos 1049/2001 and 45/2001 for the purpose of applying the exception under Article 4(1)(b) of Regulation No 1049/2001 to the case in point, it must be borne in mind that those regulations have different objectives. The first is designed to ensure the greatest possible transparency of the decision-making process of the public authorities and the information on which they base their decisions. It is thus designed to facilitate as far as possible the exercise of the right of access to documents, and to promote good administrative practices. The second is designed to ensure the protection of the freedoms and fundamental rights of individuals, particularly their private life, in the handling of personal data. > Topics: Right of Access, Personal Data, Right of Access Procedures, Transparency · Applies: gdpr-art-4-par-1-en ### ¶50 As stated in recital 2 of Regulation No 45/2001, the Union legislature intended to establish a ‘fully-fledged system’ of protection of personal data, and considered it necessary, in the words of recital 12 thereof, to ensure throughout the Community ‘consistent and homogeneous application of the rules for the protection of individuals’ fundamental rights and freedoms with regard to the processing of personal data’. > Topics: Processing, Personal Data ### ¶51 According to that same recital 12, the rights conferred on data subjects for their protection with regard to the processing of personal data constitute rules for the protection of fundamental rights and freedoms. In the mind of the Union legislature, the Union legislation on the processing of personal data serves to protect fundamental rights and freedoms. > Topics: Personal Data, Processing ### ¶52 According to recitals 7 and 14 of Regulation No 45/2001, the measures in question are ‘binding measures’ which apply to ‘all processing of personal data by all Community institutions and bodies > Topics: Personal Data, Processing ## Cited law provisions (19) ### GDPR — gdpr-art-1-par-1-en This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. ### GDPR — gdpr-art-4-par-1-en ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; ### GDPR — gdpr-art-4-par-2-en ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; ### GDPR — gdpr-art-6-par-1-en Processing shall be lawful only if and to the extent that at least one of the following applies: ### GDPR — gdpr-art-7-par-2-en If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. ### GDPR — gdpr-art-9-par-1-en Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited. ### GDPR — gdpr-art-1-en Subject-matter and objectives ### GDPR — gdpr-art-2-en Material scope ### GDPR — gdpr-art-3-en Territorial scope ### GDPR — gdpr-art-4-en For the purposes of this Regulation: ### GDPR — gdpr-art-5-en Principles relating to processing of personal data ### GDPR — gdpr-art-6-en Lawfulness of processing ### GDPR — gdpr-art-8-en Conditions applicable to child's consent in relation to information society services ### GDPR — gdpr-art-12-en Transparent information, communication and modalities for the exercise of the rights of the data subject ### GDPR — gdpr-art-18-en Right to restriction of processing ### GDPR — gdpr-art-28-en Processor ### GDPR — gdpr-art-30-en Records of processing activities ### GDPR — gdpr-art-56-en Competence of the lead supervisory authority ### GDPR — gdpr-art-61-en Mutual assistance --- Generated by overview.legal · https://overview.legal/posts/6182 · 2026-08-22