IN 2001, just a few months after the European Union had enacted data protection legislation applicable to its institutions (Regulation 45/2001 [2001] OJ L8/1), the EU also enacted freedom of information legislation (Regulation 1049/2001 [2001] OJ L145/43) as part of its continuing efforts to reinforce its democratic credentials. The objective of Regulation 45/2001 is to protect the right to privacy of individuals whose personal data is processed by EU institutions or bodies, while Regulation 1049/2001 aims to promote transparency by guaranteeing the “widest possible access to documents” held by the same institutions. The regulations therefore pursue potentially conflicting purposes. This becomes evident upon closer examination of their provisions. For instance, Article 8 of Regulation 45/2001 provides that data may only be transferred to a third party recipient if the necessity of the transfer is demonstrated (“the necessity test”) while it is a central tenet of Regulation 1049/2001, set out in Article 6(1), that no reasons need to be provided in support of a request for access to documents.

The EU judicature was asked to clarify the relationship between these regulations in Bavarian Lager (C-28/08 P, Commission v. Bavarian Lager [2010], not yet reported). Bavarian Lager, a German beer exporter, filed a complaint with the European Commission alleging that United Kingdom legislation prevented it from selling its beer on the British market and was therefore contrary to the Treaty provisions on the free movement of goods. As a result of this complaint, the Commission initiated Article 258 TFEU infringement proceedings against the UK. These proceedings were discontinued following a meeting attended by Commission officials, representatives of the British government and certain industry representatives. Having been refused permission to attend this meeting, Bavarian Lager sought access to the minutes of the meeting and a list of those attending it. The Commission enacted a decision according to which Bavarian Lager was provided with the minutes in an anonymised form; the names of those attendees who did not expressly consent to the disclosure of their names were blacked out. Bavarian Lager contested this decision before the General Court (see Case T-194/04 Bavarian Lager v. Commission [2007] ECR II-4523).

Article 4(1)(b) is the only provision of Regulation 1049/2001 that refers to data protection legislation. According to this article, a request for access to a document shall be refused where the document's disclosure would undermine the protection of “privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection of personal data”. The General Court used this provision as the starting point for its analysis by considering whether the disclosure of the names of those attending the meeting would undermine the protection of their privacy and their integrity. In particular, it analysed whether such disclosure would breach Article 8 of the European Convention on Human Rights. It concluded that it would not (at [132]) and therefore that the Article 4(1)(b) exception was not applicable (see [133]). Consequently, the General Court held that the application of the “additional conditions” set out in Regulation 45/2001 to the request, such as the need for consent of the data subject, would be contrary to the objective of Regulation 1049/2001 (at [107]). The General Court annulled the Commission decision (see [162]) and the Commission appealed to the Court of Justice of the EU.

The Court of Justice began by stating unhelpfully that the full application of both regulations should be ensured as neither is expressly granted primacy over the other. Advocate General Sharpston had convincingly argued in her Opinion (C-28/08 P, Commission v. Bavarian Lager [2010], not yet reported) that the clash between the two regulations was “more apparent than real” as the communication of the relevant data did not constitute “data processing” and therefore fell outside the scope of Regulation 45/2001 (at [190]). Unusually, the Court of Justice did not refer to the Advocate General's Opinion in its judgment. Instead it preferred to base its findings on Article 4(1)(b) of Regulation 1049/2001, simply noting tersely that the communication of personal data to a third party constitutes data processing. It accepted the Commission's plea that the General Court erred in law by limiting the application of Article 4(1)(b) to situations in which Article 8 ECHR is breached. It held that the disclosure should also be in conformity with the Union's data protection legislation and emphasised that data processing activities cannot be separated into two categories; those examined in light of the ECHR right to privacy and those examined for compliance with European data protection legislation (at [58]–[61]). This statement is noteworthy as, when the Court was asked in Rundfunk (C-139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989) to examine the compatibility of Austrian legislation with EU data protection law, it examined the national law solely in light of Article 8 ECHR without reference to European data protection legislation. The Court concluded that where a request for access to a document containing personal data is made in accordance with Regulation 1049/2001, the provisions of Regulation 45/2001 become applicable in their entirety. Accordingly, the consent of the data subject is required pre-disclosure and the party seeking the data must demonstrate that its disclosure is necessary (at [63]). The Court therefore concluded that the General Court had erred in law when applying Article 4(1)(b) of Regulation 1049/2001(at [80]) and it set aside the judgment under appeal (at [81]).

The Court claimed in its judgment that the General Court's interpretation of Regulation 1049/2001 did “not correspond to the equilibrium which the Union legislature intended to establish between the two regulations in question” (at [65]). However, by simply asserting that the data protection rules are applicable when a request is made for access to a document containing personal data the Court itself failed to strike the balance arguably sought by the legislature. Given that, unlike other primary human rights texts, the EU's Charter of Fundamental Rights explicitly sets out both a right of access to documents and a right to data protection, it is disappointing that the Court did not attempt to reach a more nuanced or helpful conclusion.