EUROPEAN COMMISSION Brussels, 7.12.2021 C(2021) 9324 final Ms Luisa Izuzquiza Open Knowledge Foundation Deutschland Singerstr. 109 10179 Berlin Germany DECISION OF THE EUROPEAN COMMISSION PURSUANT TO ARTICLE 4 OF THE IMPLEMENTING RULES TO REGULATION NO (EC) 1049/2001                                1 Subject:            Your confirmatory application for access to documents under Regulation (EC) No 1049/2001 - GESTDEM 2021/1970 Dear Ms Izuzquiza, I refer to your confirmatory application of 19 May 2021, registered on 25 May 2021, in accordance with Article 7(2) of Regulation (EC) No 1049/2001 regarding public access to European Parliament, Council and Commission documents (hereafter ‘Regulation      2 (EC) No 1049/2001’). 1.    SCOPE OF YOUR REQUEST In your initial application of 29 March 2021, addressed to the Directorate-General for Migration and Home Affairs, you requested access to the grant agreement, including all its annexes, concluded with the Greek authorities for the construction of three new reception centres on the Greek islands of Samos, Kos and Leros (HOME/2020/AMIF/AG/EMAS/0127). The European Commission has identified the following documents as falling under the scope of your request, all registered under reference number Ares(2021)3639599: -    Special Conditions of the Grant Agreement (hereafter ‘document 1’); -    Annex I Description of the Action (hereafter ‘document 2’); -    Annex II General Conditions (hereafter ‘document 3’); 1   Official Journal L 345 of 29.12.2001, p. 94. 2 Official Journal L 145 of 31.5.2001, p. 43. Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIË - Tel. +32 22991111

-    Annex III Estimated budget of the action and model financial statement (hereafter ‘document 4’) ;3 -    Annex IV.1 Model technical report (hereafter ‘document 5’); -    Annex IV.2: Final technical implementation report (hereafter ‘document 6’); -    Annex VI Model terms of reference for the certificate on the financial statements when required by the grant agreement (hereafter ‘document 7’); -    Annex IX Specific conditions related to visibility (hereafter ‘document 8’). In its initial reply of 27 April 2021, the Directorate-General for Migration and Home Affairs refused access to these documents based on the first indent of Article 4(2) (protection of commercial interests) and first subparagraph of Article 4(3) (protection of the ongoing decision-making process) of Regulation (EC) No 1049/2001. In your confirmatory application, you request a review of this position. 2.    ASSESSMENT AND CONCLUSIONS UNDER REGULATION (EC) NO 1049/2001 When assessing a confirmatory application for access to documents submitted pursuant to Regulation (EC) No 1049/2001, the Secretariat-General conducts a fresh review of the reply given by the Directorate-General concerned at the initial stage. Following this review, I can inform you that: -    Full access is given to documents 3, 5, 6, 7 and 8; -    Partial access is given to documents 1 and 4, parts of them being redacted based on the first indent of Article 4(2) (protection of commercial interests), Article 4(2)(b) (protection of personal data) and first indent of article 4(1)(a) (protection of public security) of Regulation (EC) No 1049/2001; -    Access is denied to document 2 based on the first indent of Article 4(2) (protection of commercial interests) of Regulation (EC) No 1049/2001. The reasons are explained below. 2.1.   Protection of the commercial interests Article 4(2), first indent of Regulation (EC) No 1049/2001 provides that ‘[t]he institutions shall refuse access to a document where disclosure would undermine the protection of commercial interests of a natural or legal person, including intellectual property, […], unless there is an overriding public interest in disclosure’. Firstly, I note that Article 4(2), first indent of Regulation (EC) No 1049/2001 must be interpreted consistently with Article 339 of the Treaty on the Functioning of the European Union (TFEU), which requires staff members of the EU institutions to refrain from disclosing ‘information of the kind covered by the obligation of professional secrecy, in particular information about undertakings, their business relations or their cost components’. Applying Regulation (EC) No 1049/2001 cannot have the effect of rendering Article 339 of the Treaty on the Functioning of the European Union, over which it does not have precedence, ineffective. 3 Note that Annex V Model financial statement is included within Annex III (document 4). 2

Secondly, Article 4(2), first indent, of Regulation (EC) No 1049/2001 must be 4 interpreted consistently with the provisions of the Financial Regulation and its Rules of 5 Application relating to access to information and confidentiality, which were applicable at the time of the signature of the document in question. Furthermore, as neither Regulation (EC) No 1049/2001 nor the Financial Regulation contain any provision expressly giving one regulation primacy over the other, the right to disclosure of documents under Regulation (EC) No 1049/2001 cannot apply in contradiction with the specific confidentiality provisions laid down in the Financial Regulation and its Rules of Application, as this would result in these provisions being deprived of their meaningful effect. 6 Furthermore, the General Court in its Cosepuri judgement confirmed that Regulation (EC) No 1049/2001 and the Financial Regulation have different objectives and do not contain any provision expressly giving one regulation primacy over the other. Therefore, it is appropriate to ensure that each of those regulations is applied in a manner which is compatible with the other and which enables their coherent application. As the Court of Justice explained, ‘in order to apply the exception provided for by the first indent of Article 4(2) of Regulation No 1049/2001, it must be shown that the documents requested contain elements which may, if disclosed, seriously undermine the commercial interests of a legal person. That is the case, in particular, where the requested documents contain commercially sensitive information relating, in particular, to the business strategies of the undertakings concerned or to their commercial relations […]’ . Furthermore, the Court of Justice recognised that, ‘[i]n order that information be 7 of the kind to fall within the ambit of the obligation of professional secrecy, it is necessary, first of all, that it be known only to a limited number of persons. It must then be information whose disclosure is liable to cause serious harm to the person who has provided it or to third parties. Finally, the interests liable to be harmed by disclosure must, objectively, be worthy of protection. The assessment as to the confidentiality of a piece of information thus requires the legitimate interests opposing disclosure of the information to be weighed against the public interest that the activities of the Community institutions take place as openly as possible. ’.     8 In its judgment in Case T-439/08, the General Court ruled that ‘methodology and expertise […] relate to the specific know-how […] and contribute to the uniqueness and 4 Regulation (EU, Euratom) No. 966/2012 of the European Parliament and the Council of 25 October 2012 on the financial rules applicable to the general budget of the Union and repealing Council Regulation (EC, Euratom) No. 1605/2002, Official Journal L 298 of 26.10.2012, p.1, as amended. 5 Commission Delegated Regulation (EU) No. 1268/2012 of 29 October 2012 on the rules of application of Regulation (EU, Euratom) No. 966/2012 of the European Parliament and the Council on the financial rules applicable to the general budget of the Union, Official Journal 362 of 31.12.2012, p.1, as amended. 6 Judgment of the General Court of 29 January 2013, Cosepuri Soc. Coop. pA v European Food Safety Agency (EFSA), T-339/10, EU:T:2013:38, paragraph 85. 7 Judgment of the General Court of 5 February 2018, PTC Therapeutics International v European Medicines Agency (EMA), T-718/15, EU:T:2018:66, paragraph 85. 8 Judgment of the Court of First Instance of 30 May 2006, Bank Austria Creditanstalt v Commission, T-198/03, EU:T:2006:136, paragraph 71. 3

attractiveness of applications in the context of calls for proposals such as that at issue, which was intended to select one or more applications, following in particular a comparative review of proposed projects’ . Furthermore, the General Court held that ‘the 9 transparent conduct of public tenders procedures, which aims to make possible the monitoring of compliance with the relevant rules and principles does not require the publication of documents or information relating to the know-how, methodology or business relationships of the tenderers’ . The General Court also stressed that ‘in 10 principle, precise information relating to the cost structure of an undertaking constitutes business secrets, the disclosure of which to third parties is likely to undermine its 11 commercial interests’ . The Courts have recognised the existence of a general presumption of non-disclosure 12 applicable to bids submitted by tenderers under direct management of EU budget . The present case concerns a grant awarded by the Commission under direct management to the project HOME/2020/AMIF/AG/EMAS/0127 presented by Greek authorities. Document 2 contains the description of the action and is a grant application submitted by the Greek Ministry of Migration and Asylum. It describes in detail the proposed actions to be conducted through the grant, methodologies, internal organisation, particular know- how, strategy and other specific information with competitive value, such as the scope and description of actions, their timetable and funding perspectives. This includes, for example, the descriptions of the planned activities, the elaboration of specific approaches to the problems described, pricing and reasoning how resources (including equipment, logistics, accommodation, catering, transportation and medical assistance services) will be spent etc. Such information undoubtedly constitutes inside knowledge, experience and specific know-how belonging to the entity that submitted the grant application. This know-how was taken into account by the Commission when evaluating the grant applications and, therefore, had a major impact on the selection of this application for funding. The public disclosure of such information would undermine the commercial interests of the applicants, as it would give other potential grant applicants in future calls the possibility to copy from these applications and use it to support their own application. Even though the grant was awarded under the so-called direct grant procedure (i.e. without a publication of call for proposals), I conclude that the procedure itself was competitive in character. Under the Emergency Assistance envelope of Home Affairs Funds (in this case we refer to the Asylum Migration and Integration Fund) the available budget is limited by the financing decision and is allocated to grant applications based on their relevance and potential impact to address the emergency situation, following certain guidance and criteria. In practice, this means that, in case there would not be enough budget for all applications received, applications could get rejected. This situation has already occurred in the past. In other words, the disclosure of document 2 would allow 9 Judgment of 21 October 2010, Kalliope Agapiou Joséphidès v European Commission and Education, Audiovisual and Culture Executive Agency (EACEA), T-439/08, EU:T:2010:442, paragraph 127. 10 Judgment of 22 May 2012, Sviluppo Globale v Commission, T-6/10, EU:T:2012:245, paragraph 88. 11 Judgment of 30 January 2008, Terezakis v Commission, T-380/04, EU:T:2008:19, paragraph 95. 12 Cosepuri Soc. Coop. pA v European Food Safety Authority (EFSA), cited above, paragraph 101. 4

other eligible beneficiaries (which also include international organisations, national authorities etc.) to copy its elements, submit a grant application and get awarded a budget. This would leave less remaining budget for other potential beneficiaries. As explained above, the Greek Ministry invested its resources in elaborating their grant proposal and the disclosure of the document requested would undermine their commercial interests. I would like to remind you that documents disclosed under Regulation (EC) No 1049/2001 become available to the public at large (‘erga omnes’) not only to the applicant who requested the documents. Contrary to what you argue in your confirmatory application, I also note that the exception relating to commercial interests can be applied to non-commercial entities such as public bodies in the Member States, as in this case. Please see in that regard the 13 judgment of the General Court in Case T-439/08 . In recent case law, the General Court also clarified that a public company, but also a private company fulfilling tasks in the 14 public interest, can have commercial interests . In such cases, the commercial interests of the applicant is to submit a proposal that will be granted financial assistance and to have their investment in developing a viable grant proposal, in terms of time and resources, protected from other potential, current or future, grant applicants. The Commission also has an interest in not revealing the applicants' know-how in order not to distort the fair competition in subsequent calls for proposals, and therefore as a funding entity, to ensure that the projects selected in future calls win on their own merits, and not on the basis of the methodology developed by others. Concerning document 4, parts related to the detailed budget estimations and bank details of the grant applicant have been redacted as they constitute commercially sensitive information. Limited parts of document 1 have also been redacted as it also contains commercially sensitive information, such as bank account of the grant applicant. Consequently, I conclude that, pursuant to Article 4(2), first indent of Regulation (EC) No 1049/2001 (protection of commercial interests), access to document 2 and certain parts of documents 1 and 4 cannot be granted as their disclosure would pose a real and not hypothetical risk for the commercial interests. 2.1.  Protection of the public interest as regards public security The first indent of Article 4(1)(a) of Regulation (EC) No 1049/2001 provides that ‘[t]he institutions shall refuse access to a document where disclosure would undermine the protection of the public interest as regards public security’. The Court of Justice has confirmed that it ‘is clear from the wording of Article 4(1)(a) of Regulation No 1049/2001 that, as regards the exceptions to the right of access provided for by that provision, refusal of access by the institution is mandatory where disclosure of a document to the public would undermine the interests which that provision protects, 13 Kalliope Agapiou Joséphidès v European Commission and Education, Audiovisual and Culture Executive Agency (EACEA), cited above, paragraphs 127-128. 14 Judgment of the General Court of 5 December 2018, Falcon Technologies International LLC v European Commission, T-875/16, EU:T:2018:877, paragraphs 48-49. 5

without the need, in such a case and in contrast to the provisions, in particular, of Article 4(2), to balance the requirements connected to the protection of those interests against those which stem from other interests’ .   15 The General Court has acknowledged that ‘the institutions enjoy a wide discretion when considering whether access to a document may undermine the public interest and, consequently, […] the Courts review of the legality of the institutions' decisions refusing access to documents on the basis of the mandatory exceptions relating to the public interest must be limited to verifying whether the procedural rules and the duty to state reasons have been complied with, the facts have been accurately stated, and whether 16 there has been a manifest error of assessment of the facts or a misuse of powers’ . A number of passages of document 2 contain sensitive information related to the construction of the new facilities on the islands of Samos, Kos and Leros. This includes the information about the number of places to be built, security measures, precise location etc. If disclosed, this information could undermine public security, for example by facilitating attacks on the migrants and staff on the ground. It is not possible to give more detailed reasons justifying the need for redactions of paragraphs concerned without disclosing the content of such paragraphs and, thereby, depriving this exception of its 17 very purpose . A few sentences on page 4 of document 1 have been redacted under this exception. The construction of reception centres posed challenges for the Greek authorities in terms of maintaining security and protecting the asylum-seeker refugees to be settled in them. The redacted parts concern the future strategy concerning these reception centres, the disclosure of which could compromise the public security. In the light of the above-mentioned, the use of the exception under Article 4(1)(a), first indent (protection of the public interest as regards public security) of Regulation (EC) No 1049/2001 is justified in order to redact parts of document 1 and 2. 2.2.    Protection of personal data Article 4(1)(b) of Regulation (EC) No 1049/2001 provides that ‘access to a document is refused where disclosure would undermine the protection of […] privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection of personal data’. 15 Judgement of the Court of Justice of 1 February 2007, C-266/05 P, Sison v Council, EU:C:2007:75 paragraph 46. 16 Judgment of the General Court of 25 April 2007, T-264/04, WWF European Policy Programme v Council, EU:T:2007:114, paragraph 40. 17 Please see in this respect: Judgment of the General Court of 24 May 2011, NLG v Commision, T-109/05 and T-444/05, EU:T:2011:235, paragraph 82. See also Judgment of the General Court of 8 February 2018, T-74/16, Pagkyprios organismos ageladotrofon v Commission, EU:T:2018:75, paragraph 71. 6

18 In its judgment in Case C-28/08 P (Bavarian Lager) , the Court of Justice ruled that when a request is made for access to documents containing personal data, Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the 19 Community institutions and bodies and on the free movement of such data (hereafter ‘Regulation (EC) No 45/2001’) becomes fully applicable. Please note that Regulation (EC) No 45/2001, as from 11 December 2018, was repealed by Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (hereafter ‘Regulation 2018/1725’). 20 However, the case law issued with regard to Regulation (EC) No 45/2001 remains relevant for the interpretation of Regulation 2018/1725. In the above-mentioned judgment, the Court of Justice stated that Article 4(1)(b) of Regulation (EC) No 1049/2001 ‘requires that any undermining of privacy and the integrity of the individual must always be examined and assessed in conformity with the legislation of the Union concerning the protection of personal data, and in particular with […] [the Data Protection] Regulation’ .       21 Article 3(1) of Regulation (EC) 2018/1725 provides that personal data ‘means any information relating to an identified or identifiable natural person […]’. As the Court of Justice confirmed in Case C-465/00 (Rechnungshof), ‘there is no reason of principle to justify excluding activities of a professional […] nature from the notion of private life’ . 22 Document 1 contains names and e-mail address of individuals who do not hold senior management positions in the European Commission. 23 The names of the persons concerned as well as other data from which their identity can be deduced undoubtedly constitute personal data in the meaning of Article 3(1) of Regulation (EU) 2018/1725. Pursuant to Article 9(1)(b) of Regulation 2018/1725, ‘personal data shall only be transmitted to recipients established in the Union other than Union institutions and bodies’ if ‘[t]he recipient establishes that it is necessary to have the data transmitted for a 18 Judgment of the Court of Justice of 29 June 2010, European Commission v The Bavarian Lager Co. Ltd, 378 (hereinafter ‘judgment in C-28/08 P’), C-28/08 P, EU:C:2010, paragraph 59. 19 Official Journal L 8 of 12.1.2001, page 1. 20 Official Journal L 205 of 21.11.2018, p. 39. 21 Judgment in C-28/08 P, cited above, paragraph 59. 22 Judgment of the Court of Justice of 20 May 2003, preliminary rulings in proceedings between Rechnungshof and Österreichischer Rundfunk, Joined Cases C-465/00, C-138/01 and C-139/01, EU:C:2003:294, paragraph 73. 23 European Commission v The Bavarian Lager judgment, cited above, paragraph 68. 7

specific purpose in the public interest and the controller, where there is any reason to assume that the data subject’s legitimate interests might be prejudiced, establishes that it is proportionate to transmit the personal data for that specific purpose after having demonstrably weighed the various competing interests’. Only if these conditions are fulfilled and the processing constitutes lawful processing in accordance with the requirements of Article 5 of Regulation 2018/1725, can the transmission of personal data occur. In Case C-615/13 P (ClientEarth), the Court of Justice ruled that the institution does not have to examine of its own motion the existence of a need for transferring personal 24 data . This is also clear from Article 9(1)(b) of Regulation 2018/1725, which requires that the necessity to have the personal data transmitted must be established by the recipient. According to Article 9(1)(b) of Regulation 2018/1725, the European Commission has to examine the further conditions for the lawful processing of personal data only if the first condition is fulfilled, namely if the recipient establishes that it is necessary to have the data transmitted for a specific purpose in the public interest. It is only in this case that the European Commission has to examine whether there is a reason to assume that the data subject’s legitimate interests might be prejudiced and, in the affirmative, establish the proportionality of the transmission of the personal data for that specific purpose after having demonstrably weighed the various competing interests. In your application, you do not put forward any arguments to establish the necessity to have the data transmitted for a specific purpose in the public interest. Therefore, the European Commission does not have to examine whether there is a reason to assume that the data subjects’ legitimate interests might be prejudiced. Notwithstanding the above, there are reasons to assume that the legitimate interests of the data subjects concerned would be prejudiced by the disclosure of the personal data reflected in the document as there is a real and not hypothetical risk that such public disclosure would harm their privacy and subject them to unsolicited external contacts. Consequently, I conclude that, pursuant to Article 4(1)(b) of Regulation (EC) No 1049/2001, access cannot be granted to the personal data, as the need to obtain access thereto for a purpose in the public interest has not been substantiated and there is no reason to think that the legitimate interests of the individuals concerned would not be prejudiced by disclosure of the personal data concerned. 3.    OVERRIDING PUBLIC INTEREST IN DISCLOSURE The exception laid down in Article 4(2), first indent of Regulation (EC) No 1049/2001 must be waived if there is an overriding public interest in disclosure. Such an interest must, firstly, be public and, secondly, outweigh the harm caused by disclosure. 24 Judgment of the Court of Justice of 16 July 2015, ClientEarth v European Food Safety Agency, C- 615/13 P, EU:C:2015:489, paragraph 47. 8

In your confirmatory application, you mentioned transparency, proper accountability and protection of human rights as interests that, in your view, override the protection of commercial interests. However, please note that such general considerations cannot provide an appropriate basis for establishing that the principle of transparency was in this case especially pressing and capable, therefore, of prevailing character over the reasons justifying the 25 refusal to disclose the documents in question . I would also like to refer to clarifications provided by the Court of First Instance in its Turco v Council judgment, where the Court has held explicitly that the overriding public interest capable of justifying the disclosure of a document covered by this exception must, as a rule, be distinct from the principles of transparency, openness and democracy or of participation in the decision-making 26 process . The reason is that those principles are effectively implemented by the provisions of Regulation (EC) No 1049/2001 as a whole. Furthermore, I have not been able, based on my own analysis, to establish the existence of any overriding public interest. The fact that the documents requested relate to an administrative procedure and not to any legislative act, for which the Court of Justice has acknowledged the existence of 27 wider openness , provides further support to this conclusion. Please also note that Article 4(1) of Regulation (EC) No 1049/2001 does not include the possibility for the exceptions defined therein to be set aside by an overriding public interest. 4.    PARTIAL ACCESS In accordance with Article 4(6) of Regulation (EC) No 1049/2001, I have considered the possibility of granting partial access to document 2. However, no partial access is possible without undermining the interests laid down in the first indent of Article 4(2) (protection of commercial interests) and the first indent of Article 4(1)(a) (protection of public security) of Regulation (EC) No 1049/2001. As for documents 1 and 4, no further partial access is possible without undermining the interests mentioned above. 25 Judgment of the Court of Justice of 14 November 2013, Liga para a Protecção da Natureza (LPN) and Republic of Finland v European Commission, Joined Cases C-514/11 P and C-605/11 P, EU:C:2013:738, paragraph 93. 26 Judgment of the Court of First Instance of 23 November 2004, Maurizio Turco v Council of the European Union, T-84/03, EU:T:2004:339, paragraphs 81-83. 27 Judgment of the Court of Justice of 29 June 2010, Commission v Technische Glaswerke Ilmenau Gmbh, C-139/07 P, EU:C:2010:376, paragraphs 53-55 and 60; Commission v Bavarian Lager judgment, cited above, paragraphs 56-57 and 63. 9

5.   MEANS OF REDRESS Finally, I draw your attention to the means of redress available against this decision. You may either bring proceedings before the General Court or file a complaint with the European Ombudsman under the conditions specified respectively in Articles 263 and 228 of the Treaty on the Functioning of the European Union. Yours sincerely, For the Commission Ilze JUHANSONE Secretary-General Enclosure: (7) 10