CJEU: Commission lawfully redacted participant names from meeting minutes under Access

Access: Where a request based on Regulation No 1049/2001 (Access to Documents Regulation) seeks to obtain documents including personal data, applicable EU data protection law applies in its entirety. When requesting minutes of a meeting between the Commission and a member state that include the names of the participants, the requester must establish an express and legitimate purpose or need for disclosure of the names of the participants. The Commission was right to verify whether the data subjects had given their consent to disclosure of their names as attendees of a meeting organized by the Commission. By releasing the expurgated version of the minutes, with the names of five participants removed (three could not be contacted, two objected), the Commission did not infringe Regulation 1049/2001 and complied with its duty of openness.

Whether under the former system of Directive 95/46 or under the system of Regulations Nos 45/2001 and 1049/2001, the Commission was right to verify whether the data subjects had given their consent to the disclosure of personal data concerning them.

This Court finds that, by releasing the expurgated version of the minutes of the meeting of 11 October 1996 with the names of five participants removed therefrom, the Commission did not infringe the provisions of Regulation No 1049/2001 and sufficiently complied with its duty of openness.

By requiring that, in respect of the five persons who had not given their express consent, Bavarian Lager establish the necessity for those personal data to be transferred, the Commission complied with the provisions of Article 8(b) of Regulation No 45/2001.

As Bavarian Lager has not provided any express and legitimate justification or any convincing argument in order to demonstrate the necessity for those personal data to be transferred, the Commission has not been able to weigh up the various interests of the parties concerned. Nor was it able to verify whether there was any reason to assume that the data subjects’ legitimate interests might be prejudiced, as required by Article 8(b) of Regulation No 45/2001.