Bavarian Lager: When Transparency Requests Become Data-Protection Questions

Case C-28/08 P | European Commission v The Bavarian Lager Co. Ltd | Court of Justice of the European Union | Grand Chamber | 29 June 2010

Practice takeaways: ① Names can be personal data even when they appear in a professional context. ② Disclosing personal data in response to a public-records request is itself processing. ③ A right of access to government documents does not make applicable data-protection requirements disappear. ④ Where disclosure requires a transfer of personal data, the requester may have to establish why that transfer is necessary. ⑤ An institution can sometimes satisfy transparency obligations through partial disclosure while withholding personal data.

Bavarian Lager asked a deceptively simple question: when someone asks an EU institution for a public document containing names, is that merely an access-to-documents request—or also a transfer of personal data?

The answer mattered because the two legal regimes started from different places. Regulation (EC) No 1049/2001 regarding public access to European Parliament, Council and Commission documents (Regulation 1049/2001) sought the widest possible public access to EU documents and generally did not require applicants to explain why they wanted them. Regulation of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (Regulation 45/2001), by contrast, regulated EU institutions’ processing of personal data and required, for certain transfers, the recipient to establish necessity.

This case is about reconciling transparency and data protection—not giving either an automatic victory.

The Court held that the access rules did not displace data-protection law. Names appearing in meeting minutes were personal data, disclosing them was processing, and a request for documents containing personal data triggered the applicable EU data-protection rules.

That meant Bavarian Lager could obtain the substance of the meeting minutes while still being required to justify why it needed the identities of participants who had not consented to disclosure. Because it failed to establish that necessity, the Commission could withhold the five names.

A right of access to public documents does not eliminate the data-protection rules governing personal data contained in those documents.

What happened

Bavarian Lager was established to import German bottled beer into the United Kingdom. It encountered a regulatory problem: the United Kingdom's “Guest Beer Provision” allowed certain pubs to purchase beer from another brewery, but the exception was limited to cask-conditioned beer. Because much imported beer was bottled, Bavarian Lager complained to the Commission that the rule restricted imports contrary to EU law. (Judgment, paras. 19–20.)

The Commission opened infringement proceedings against the United Kingdom. During those proceedings, it held a meeting on 11 October 1996 attended by Commission officials, UK officials, and representatives of the Confédération des Brasseurs du Marché Commun (CBMC). Bavarian Lager asked to attend but was refused. The United Kingdom subsequently proposed changing the Guest Beer Provision, and the Commission eventually closed the infringement proceedings. (Judgment, paras. 20–22.)

Bavarian Lager spent years seeking documents and information concerning the proceeding. Eventually, relying on Regulation 1049/2001, it requested the relevant documents from the Commission. The Commission released documents concerning the October 1996 meeting but removed five participants’ names: two people had expressly refused consent to disclosure, and the Commission had been unable to contact the other three. Bavarian Lager then requested the complete minutes, including all names. (Judgment, paras. 34–36.)

The Commission refused. It concluded that Regulation 45/2001 applied to disclosure of the names and that Bavarian Lager had not established the purpose or necessity required to justify their transfer. It therefore relied on the privacy exception in Article 4(1)(b) of Regulation 1049/2001. (Judgment, para. 37.)

The General Court disagreed and annulled the Commission's decision. The Commission appealed to the Court of Justice. (Judgment, paras. 20–28.)

Why the case matters

The significance of Bavarian Lager lies in the relationship between government transparency and data protection.

Regulation 1049/2001 establishes a broad right of access to EU institutional documents. Indeed, Article 6(1) expressly provides that an applicant does not ordinarily have to explain why the document is being requested. (Judgment, paras. 12–18.)

But a document can also contain personal data.

The General Court had approached the problem primarily through the access-to-documents regime. It reasoned that the privacy exception should apply only where disclosure actually and specifically interfered with the privacy or integrity of the individual. The names here belonged to people participating in a meeting in a professional capacity, and the minutes did not attribute personal opinions to them.

The Court of Justice took a different approach.

The question was therefore not merely whether releasing the document would invade someone's private life. The institution also had to ask whether releasing the personal data contained in the document complied with the rules governing the processing and transfer of those data.

That distinction is the heart of the case.

Bavarian Lager makes clear that a right to obtain a document does not automatically create a right to receive the personal data of other individuals contained in it. (Judgment, paras. 58–60, 68–70.)

Key holding

The Court reached several connected conclusions.

• Names are personal data when they identify individuals. The list of participants in the meeting therefore contained personal data within the meaning of Regulation 45/2001. (Judgment, paras. 68, 70.)
• Disclosure is processing. Communicating those names in response to an access request constituted processing of personal data. (Judgment, para. 69.)
• The two regulatory regimes operate together. Article 4(1)(b) of Regulation 1049/2001 requires protection of privacy and integrity to be assessed in accordance with EU legislation on personal-data protection. Where an access request concerns documents containing personal data, Regulation 45/2001 applies. (Judgment, paras. 58–65.)
• The requester therefore had to establish necessity. Under Article 8(b) of Regulation 45/2001, Bavarian Lager had to demonstrate why transfer of the five participants’ names was necessary. (Judgment, paras. 76-77.)
• It failed to do so. Because Bavarian Lager offered no express and legitimate justification or convincing argument demonstrating necessity, the Commission could not proceed to weigh that necessity against the individuals’ legitimate interests. (Judgment, para. 78.)

The Commission was therefore entitled to release the minutes with the five names removed. (Judgment, paras. 79–81.)

The Court’s analysis

1. The privacy exception incorporates data-protection law

Article 4(1)(b) of Regulation 1049/2001 requires institutions to refuse access where disclosure would undermine “privacy and the integrity of the individual,” in particular in accordance with EU legislation concerning the protection of personal data. (Judgment, para. 17.)

The General Court had effectively separated those concepts. It focused on whether disclosure would interfere with privacy as understood under Article 8 ECHR and concluded that identifying people who participated professionally in the meeting did not do so.

The Court of Justice rejected that approach.

Article 4(1)(b) was an indivisible provision. The protection of privacy and integrity had to be examined in conformity with EU data-protection legislation. The provision therefore created what the Court described as a “specific and reinforced system of protection” where personal data might be disclosed to the public. (Judgment, paras. 58–60.)

Practice Tip: Names and surnames of individuals participating in meetings in their professional capacity are personal data and remain subject to EU data-protection requirements. If minutes or other documents containing those names must be disclosed, the names may need to be redacted unless their disclosure is independently permitted under applicable data-protection law. This remains true even where disclosure of the document itself is required—for example, in response to a data subject exercising a GDPR right of access. See, What is the Right of Access under GDPR.

2. Access to documents does not displace data-protection rules

The Court then addressed the relationship between the two Regulations directly.

It concluded that where a request under Regulation 1049/2001 seeks access to documents containing personal data, Regulation 45/2001 becomes applicable. The General Court therefore erred by effectively setting aside important requirements of that Regulation in the name of public access. (Judgment, paras. 62–65.)

A transparency request is not a route around data-protection law.

3. A name can be personal data

The information at issue was modest: the names of people who attended a professional meeting.

That was enough.

The Court agreed with the General Court that surnames and forenames may constitute personal data. Because the participants could be identified from the list contained in the minutes, the list contained personal data within the meaning of Regulation 45/2001. (Judgment, paras. 68, 70.)

The Court did not require the information to reveal something intimate, sensitive, or private about those individuals before treating it as personal data.

Practice Tip: Do not confuse the question whether information is personal data with the separate question whether its disclosure seriously intrudes upon someone's private life. Bavarian Lager involved little more than names attached to attendance at a professional meeting, yet those names were still personal data.

4. Public disclosure is processing

The next step followed directly from the statutory definition.

Regulation 45/2001 defined processing broadly to include disclosure by transmission, dissemination, or otherwise making personal data available. The Court therefore held that communicating the participants’ names in response to Bavarian Lager's request constituted processing. (Judgment, para. 69.)

Disclosing personal data in response to a transparency request is itself processing.

The institution must therefore consider not only its transparency obligations but also the legal requirements governing that disclosure.

5. Transparency can be satisfied without disclosing every piece of personal data

The Court also emphasized what Bavarian Lager had already received.

It had access to all the information concerning the meeting, including the opinions expressed by participants in their professional capacity. What remained withheld were five names. (Judgment, para. 72.)

That fact mattered to the Court's assessment of the Commission's duty of openness.

The Commission had sought the participants’ agreement to disclosure and ultimately released an expurgated version of the minutes removing only the five names at issue. The Court concluded that this did not violate Regulation 1049/2001 and that the Commission had sufficiently complied with its duty of openness. (Judgment, paras. 73–76.)

6. The requester had to establish necessity

The decisive issue was Article 8(b) of Regulation 45/2001.

That provision permitted transfer where the recipient established the necessity of receiving the data and there was no reason to assume that the data subjects’ legitimate interests might be prejudiced.

The Commission was therefore entitled to require Bavarian Lager to establish why it needed the five names. (Judgment, para. 77.)

Bavarian Lager did not do so.

The Court found that it had provided neither an express and legitimate justification nor a convincing argument demonstrating necessity. Without that showing, the Commission could not weigh the competing interests or determine whether the individuals’ legitimate interests might be prejudiced. (Judgment, para. 78.)

The Commission was consequently right to refuse access to the unredacted minutes. (Judgment, paras. 79–80.)

Practice Tip: When an entity is required to disclose information that includes personal data about other individuals, the obligation to disclose does not automatically authorize disclosure of those personal data. If the individuals have not consented, the disclosing entity should determine whether disclosure of the personal data is necessary and whether the individuals’ legitimate interests could be prejudiced. If necessity cannot be established, the personal data may need to be redacted even though the underlying document or information must be disclosed. (Judgment, paras. 77–78.)

The Advocate General’s Opinion

Advocate General Eleanor Sharpston saw the relationship between the two rights differently.

She began from the premise that both public access to documents and protection of privacy were fundamental rights of equal importance. Her objective was therefore to reconcile them rather than allow one automatically to prevail over the other. (Opinion, paras. 1–4, 93–96.)

Her proposed solution distinguished between two kinds of documents.

Some documents exist primarily to contain personal data—for example, a list of individuals and their characteristics. Others are ordinary administrative documents in which personal data appear only incidentally. In her view, the first category should principally engage the data-protection regime, while the second should principally be handled under the access-to-documents regime.

The meeting minutes fell into the second category.

Sharpston therefore concluded that the Commission should have disclosed the complete minutes, including the names of participants who had objected. (Opinion, para. 218.)

The Court did not adopt that approach.

That disagreement makes Bavarian Lager particularly useful for understanding the Court's conception of personal-data protection. The Court did not create a threshold under which personal data become too incidental to matter. Once the requested disclosure involved personal data and the applicable data-protection regime applied, its requirements had to be respected.

What the Court did—and did not—decide

The Court did hold that names identifying participants in an institutional meeting can constitute personal data and that communicating those names to a requester constitutes processing. (Judgment, paras. 68–70.)

It did hold that an access-to-documents request involving personal data must be assessed in accordance with the applicable EU data-protection regime. (Judgment, paras. 58–65.)

And it did hold that Bavarian Lager could be required to establish the necessity of receiving the five withheld names under Article 8(b) of Regulation 45/2001. Because it failed to do so, the Commission was entitled to withhold them. (Judgment, paras. 77–80.)

But the Court did not hold that every document containing personal data must remain confidential.

It did not hold that the presence of a person's name automatically defeats a transparency request.

And it did not establish that privacy always takes precedence over openness.

Bavarian Lager and Schecke: two different transparency problems

Bavarian Lager and Schecke, decided only a few months apart in 2010, address transparency from different directions.

• In Schecke, EU legislation itself required publication of identifiable beneficiaries and the precise agricultural subsidies they received. The Court accepted transparency as a legitimate objective but held that indiscriminate publication concerning natural persons went too far because lawmakers had not adequately considered less intrusive alternatives. (Schecke, Judgment, paras. 76–86.) See also, Schecke: Transparency Does Not Automatically Trump Data Protection
• Bavarian Lager involved an individual request for an institutional document. The issue was not whether a general publication regime was proportionate, but whether the access-to-documents framework allowed personal data embedded in a requested document to be disclosed without satisfying the applicable rules governing their transfer.

The cases nevertheless share an important premise: Government transparency does not create a data-protection-free zone.

Bavarian Lager Today

The legislation has changed, but the central lesson of Bavarian Lager remains highly relevant: a right to obtain a document does not necessarily entail a right to receive every person’s personal data contained in it.

Regulation 45/2001 has been replaced by Regulation (EU) 2018/1725, which governs the processing of personal data by EU institutions and bodies. The newer Regulation expressly requires those institutions and bodies to reconcile the right to protection of personal data with the right of access to documents. (Regulation 2018/1725, Art. 9(3).)

The necessity principle also survives, although the current rules are framed somewhat differently. A similar principle applies under the GDPR. A data subject’s right of access may require a controller to provide extracts from documents—or even entire documents—when necessary to make the personal data intelligible, but that right must not adversely affect the rights and freedoms of others. Where those rights conflict, the controller must balance them and, where possible, provide the requested information in a manner that protects third parties rather than withholding everything. (GDPR, Art. 15(3)–(4); Österreichische Datenschutzbehörde and CRIF, C-487/21, paras. 41–45.)

In practical terms, the lesson remains much the same: the right to obtain a document does not automatically extend to third-party personal data contained within it.

Conclusion

Bavarian Lager began with a request for five names but established a broader principle: a public document can still contain protected personal data, and disclosing those data is processing—even when responding to a transparency request.

Because the Commission had already disclosed the substance of the meeting, disclosure of the five participants’ identities required an additional showing of necessity.

The lasting lesson:

Openness governs access to government documents. Data protection continues to govern the personal data inside them.

Sources and Useful Reading

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database. The case can be located using Case C-28/08 P, European Commission v The Bavarian Lager Co. Ltd.

• Court of Justice of the European Union, Grand Chamber, Case C-28/08 P, European Commission v The Bavarian Lager Co. Ltd, Judgment of 29 June 2010, ECLI:EU:C:2010:378.
• Opinion of Advocate General Eleanor Sharpston, Case C-28/08 P, delivered 15 October 2009.

Useful reading from The De La Torre Review

• What Is the “Right of Access” under the GDPR? — A practical guide to Article 15 and Subject Access Requests, including the important limitation that access is not absolute: controllers may need to redact or withhold third-party personal data where disclosure would adversely affect the rights and freedoms of others. This provides the practical GDPR counterpart to the disclosure problem at the heart of Bavarian Lager. Read the Article
• Schecke: Transparency Does Not Automatically Trump Data Protection — Decided several months after Bavarian Lager, Schecke considers the related but distinct problem of legislation requiring systematic online publication of personal data in the name of government transparency. Read the Article
• Österreichischer Rundfunk: When Salary Transparency Meets the Right to Privacy — An earlier case examining the disclosure of identifiable individuals’ financial information and the relationship between transparency obligations and privacy. Read the Article
• Satakunnan & Satamedia: Public Data Is Still Personal Data — Another important part of the Court's developing distinction between information being publicly available and that information ceasing to receive data-protection safeguards. Read the Article.
• Österreichische Datenschutzbehörde and CRIF: What Does the GDPR Right of Access Actually Require? — A modern counterpart to Bavarian Lager. The Court held that the GDPR right of access may require providing extracts or even entire documents where necessary to make the personal data intelligible, while emphasizing that access must not adversely affect the rights and freedoms of others. Read the Article
• Rijkeboer: When the Right of Access Reaches Into the Past — An earlier examination of the right of access to personal data and the information needed to make that right effective, including information about recipients to whom personal data have been disclosed. Read the Article
• Nowak: When an Exam Answer Becomes Personal Data — Provides a broader framework for identifying the personal data that can trigger the data-protection interests at issue in Bavarian Lager. Nowak explains that personal data may include objective and subjective information and may relate to an individual through its content, purpose, or effect. Read the Article.