Dennekamp I: Why Transparency Requests Must Explain the Need for Personal Data

Case T-82/09 | Gert-Jan Dennekamp v European Parliament | General Court of the European Union | Second Chamber | 23 November 2011

Practice Takeaways: ① Access to documents and data protection apply together. Neither regulation automatically takes priority over the other. ② Names are personal data, including the names of elected representatives. Disclosing them is processing. ③ A lawful basis does not replace the applicable conditions for transferring personal data. ④ Explain why the particular data are necessary. General references to transparency, accountability, or public spending may be insufficient. ⑤ Necessity comes before balancing. Without an adequate necessity justification, the institution need not proceed to weigh the competing interests under Article 8(b).

Can the public find out which elected representatives belong to a pension scheme supported by public funds?

In Dennekamp I, the General Court considered a request for documents identifying Members of the European Parliament who participated in its additional pension scheme. The applicant invoked transparency, accountability, public expenditure, and potential conflicts of interest. Parliament relied on the protection of the MEPs’ personal data.

The Court held that the access-to-documents and data-protection regulations had to be applied together. But the decisive issue arose before a full balancing of interests: the applicant had not sufficiently established why transferring the particular personal data was necessary. (Judgment, paras. 24–35, 43–44.)

Practice Tip: The case thereforea practical lesson for anyone seeking public records containing personal data. Explaining why a subject deserves public scrutiny is not necessarily enough. The request must also explain why disclosure of the specific personal data is needed to carry out that scrutiny.

What Happened

Gert-Jan Dennekamp first requested access to all documents relating to Parliament’s additional pension scheme in November 2005. Parliament disclosed several records, including annual reports and accounts, a note from its Secretary-General, and minutes of a Bureau meeting. It did not provide the list of participating MEPs. Dennekamp complained to the European Ombudsman, who closed the case after observing that the refusal appeared not to be legally justified. (Judgment, paras. 1–2.)

In October 2008, Dennekamp submitted a new request covering three categories: documents identifying MEPs who were then members of the scheme; the list of members as of 1 September 2005; and the list of current members for whom Parliament paid a monthly contribution. (Judgment, para. 3.)

Parliament refused the request and subsequently rejected his confirmatory application on 17 December 2008. It considered that disclosure would implicate the MEPs’ privacy and integrity, that the applicant had not established the need for the personal data to be transferred, and that disclosure would be disproportionate to his aims. (Judgment, paras. 4–7.)

Dennekamp sought annulment of that decision before the General Court. Denmark, Finland, and the European Data Protection Supervisor intervened in support of his application. This was a direct challenge to an EU institution’s decision, rather than a preliminary reference from a national court. (Judgment, paras. 8–16.)

Why the Case Matters

Dennekamp I illustrates how EU law addressed the overlap between public access to documents and the privacy of the individuals whose data could be revealed. Regulation (EC) No 1049/2001 sought to provide the widest possible public access to institutional documents, subject to its exceptions. Regulation (EC) No 45/2001 protected individuals when EU institutions and bodies processed their personal data. The General Court rejected the proposition that making a request under the first regulation removed the need to comply with the second. (Judgment, paras. 21–26.)

The judgment also makes the sequence of the analysis consequential. A requester’s failure to establish necessity could dispose of the request without requiring Parliament to undertake the competing-interests assessment under Article 8(b). (Judgment, paras. 43–44.)

The Key Holding

The General Court dismissed the action in its entirety. Parliament had correctly applied the access-to-documents exception by reference to the rules governing personal data, and Dennekamp had not demonstrated the necessity of transferring the names he sought. (Judgment, paras. 29–36, 39–41, 52.)

The Court did not establish a categorical prohibition on disclosing the names of pension-scheme members. Its central conclusion concerned the adequacy of the justification advanced in this particular request.

The Court’s Analysis

1. Neither Regulation Automatically Takes Priority

The Court began by recognizing the breadth of the access right. Regulation 1049/2001 aims to make institutional documents as accessible as possible, and its exceptions must be interpreted and applied strictly. Institutions must assess whether an exception applies in the individual case. (Judgment, paras. 21–22.)

That starting point did not make transparency legally superior to data protection. The two regulations pursued different objectives, and neither contained a provision giving it primacy over the other. In principle, both therefore had to be applied in full. (Judgment, paras. 23–24.)

Relying on Commission v Bavarian Lager, the Court explained that Article 4(1)(b) of Regulation 1049/2001 established reinforced protection for individuals whose personal data might be communicated to the public. When a request sought documents containing personal data, Regulation 45/2001 applied in its entirety, including its transfer provisions. (Judgment, paras. 25–26.)

Practice Tip: When a public-records request involves personal data, identify both the access rules and the applicable data-protection conditions. A request under one framework does not displace the other.

2. MEPs’ Names Were Personal Data

The request sought the names of identifiable MEPs linked to their participation in the additional pension scheme. The Court held that those names constituted personal data under Article 2(a) of Regulation 45/2001. Communicating the data also constituted processing under that regulation. (Judgment, paras. 27–28.)

• The fact that the individuals were elected representatives, or that the records concerned a scheme receiving public support, did not remove the requested information from data-protection law. Those circumstances formed part of the applicant’s case for disclosure; they did not eliminate the need to apply the legal conditions governing it.

Practice Tip: Dennekamp I is connected with the broader distinction explored in Nowak: determining that information is personal data does not itself resolve whether access must be granted.

3. A Lawful Basis Did Not Replace the Transfer Conditions

Dennekamp argued that the access right under Regulation 1049/2001 constituted a legal obligation for the purposes of Article 5(b) of Regulation 45/2001. On his interpretation, that obligation was sufficient to make the requested processing lawful and prevented Parliament from relying on other provisions to refuse access. (Judgment, para. 19.)

• The Court rejected that argument. Article 8(b) applied without prejudice to Article 5. A claim that processing was lawful under Article 5(b) therefore did not dispense with the separate conditions governing the transfer. (Judgment, para. 29.)
• For the requested disclosure, Dennekamp had to provide express and legitimate justifications establishing why the transfer was necessary. That would enable Parliament to weigh the relevant interests and determine whether there was reason to assume that the transfer might prejudice the MEPs’ legitimate interests. (Judgment, para. 30.)

Practice Tip: Keep the lawfulness of processing and the conditions governing a particular disclosure distinct. Establishing one does not necessarily satisfy the other.

4. Public Interest Was Not the Same as Demonstrated Necessity

Dennekamp’s applications were not silent about public interest. He argued that scheme membership arose from the MEPs’ mandates, that Parliament had established and substantially financed the scheme, and that MEPs could influence its future and funding. He also pointed to Parliament’s past votes to cover shortfalls. (Judgment, para. 32.)

• In his confirmatory application, he emphasized the public’s interest in identifying members with a personal stake in the scheme and potential conflicts of interest. He disputed the suggestion that other scrutiny mechanisms, such as parliamentary budgetary oversight or the Court of Auditors, justified withholding access. At the same time, he expressly maintained that he did not have to establish necessity under Article 8(b). (Judgment, para. 33.)

The Court found these arguments insufficient. They explained why the information could be of public interest but did not adequately establish why transferring the requested names was necessary to serve that interest. In particular, Dennekamp had not shown that disclosure would be more appropriate than the measures Parliament had identified, or proportionate to his aims. (Judgment, para. 34.)

Nor was Parliament obliged to infer necessity from general public-interest considerations. Treating those considerations as sufficient by implication would bypass the requester’s obligation to justify the transfer. (Judgment, para. 35.)

Practice Tip: Explain why the particular identities are needed to answer the public-interest question. Address the adequacy of available alternatives and the proportionality of the requested disclosure.

5. Necessity Came Before the Competing Interests Assessment

Dennekamp also alleged that Parliament had failed to strike a fair balance between the public interests supporting disclosure and the private interests affected. He challenged its assessment of harm to privacy and its failure to distinguish between the three categories of documents. (Judgment, para. 42.)

The Court returned to the threshold requirement. Because Dennekamp had not established necessity, Parliament was not required to weigh his interests against those of the MEPs or determine whether the transfer might prejudice their legitimate interests under Article 8(b). Any error in that weighing exercise therefore had no bearing on the lawfulness of the decision in this case. (Judgment, paras. 43–44.)

This is the judgment’s most consequential procedural point. Its statement that both regulations apply in full does not mean that every request necessarily reaches a final balancing exercise. The applicant first had to satisfy the necessity requirement.

Before competing interests can be balanced, the requester must establish why disclosure of the personal data is necessary.

6. Different Documents Did Not Necessarily Require Different Reasons

The Court also rejected the claim that Parliament had to assess the privacy implications separately for each document category. Although the names appeared in three categories, the data sought were of the same nature. Dennekamp had not explained why the category of document required a different assessment. (Judgment, paras. 46–47.)

The Court reiterated that an institution refusing access must explain how disclosure could specifically and effectively undermine the protected interest. But in the circumstances of this request, Parliament did not have to provide additional reasons for each individual document containing the same kind of data. (Judgment, paras. 48–52.)

What the Court did—and did not—decide

Dennekamp I established that the access-to-documents framework did not displace the applicable personal-data rules, and that general public-interest arguments did not satisfy the necessity requirement on the facts presented.

It did not hold that MEPs’ pension-scheme participation was permanently shielded from disclosure, that public expenditure was irrelevant, or that the interests of public officials always outweighed transparency.

The request failed because the particular justification did not satisfy the legal threshold.

It also concerned public access to other people’s personal data, not a data subject’s right to access their own data. That distinction separates the issue in Dennekamp I from the access questions discussed in Nowak and CRIF.

Dennekamp I Today

The judgment applied Regulation 45/2001, the former data-protection framework for EU institutions and bodies. It was not a GDPR ruling. Regulation 45/2001 has since been repealed and replaced by Regulation (EU) 2018/1725.

• Article 9(1)(b) of Regulation 2018/1725 now expressly requires a recipient relying on that provision to establish that transmission is necessary for a specific purpose in the public interest. Where there is reason to assume that the data subject’s legitimate interests might be prejudiced, the controller must establish proportionality after demonstrably weighing the competing interests. The provision concerns recipients established in the Union other than Union institutions and bodies. (Regulation 2018/1725, Article 9(1)(b).)
• The current wording makes specificity and the allocation of responsibilities explicit. Dennekamp I remains useful for understanding why broad appeals to transparency may not establish the need for a particular transmission, but a present-day request must be analyzed under the current provisions.

The dispute also produced a later judgment, Dennekamp II, Case T-115/13, on 15 July 2015. That separate proceeding should be kept distinct from the 2011 decision discussed here.

Conclusion

Dennekamp I began with a straightforward accountability question: which elected representatives participated in a pension scheme supported by public funds?

The General Court’s answer turned on how the request was justified. Transparency and data protection had to operate together, and the applicant had to establish the necessity of transferring the particular personal data before Parliament was required to undertake the competing-interests assessment.

For requesters, the lesson is to connect the public-interest objective to the specific information sought. For institutions, it is to apply both legal frameworks through the relevant statutory conditions and explain the resulting decision.

Sources and Additional Materials

Sources

CJEU judgments, Advocate General opinions, procedural orders, summaries, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database.

Search Case T-82/09.

• General Court of the European Union, Second Chamber, Case T-82/09, Gert-Jan Dennekamp v European Parliament, Judgment of 23 November 2011, ECLI:EU:T:2011:688.

Useful Reading from The De La Torre Review

• Bavarian Lager: When Transparency Requests Become Data-Protection Questions — The foundation for Dennekamp I. The CJEU held that requests for institutional documents containing personal data must satisfy both the access-to-documents and data-protection rules. Dennekamp I applies that framework to MEPs’ pension-scheme membership and explains why general appeals to transparency do not necessarily establish the need to disclose particular names. Read the Article.
• Schecke: Transparency Does Not Automatically Trump Data Protection — Examines the related but distinct issue of mandatory online publication of information identifying recipients of public funds. It provides a useful comparison between systematic publication required by legislation and disclosure in response to an individual request. Read the Article.
• Österreichischer Rundfunk: When Salary Transparency Meets the Right to Privacy — An earlier judgment addressing the disclosure of identifiable individuals’ financial information for public accountability. It explores whether publishing names and income figures is necessary and appropriate to scrutinize public expenditure. Read the Article.
• Nowak: When an Exam Answer Becomes Personal Data — Explains the broad definition of personal data and the distinction between classifying information as personal data and determining the access rights that follow. Unlike Dennekamp I, it concerns an individual seeking access to their own information. Read the Article.
• Dennekamp II: When Public Scrutiny Justifies Naming Names — Builds on Dennekamp I by showing when a request satisfies the necessity requirement. The General Court found that identifying potential conflicts of interest justified disclosing the names of pension-scheme participants who had actually voted on the scheme, with the balancing of interests favoring disclosure. Read the Article.
• CRIF: When a “Copy” of Your Personal Data Requires More Than a Data List — Examines the right to obtain a faithful and intelligible copy of one’s own personal data, which may require document extracts or entire documents, while respecting the rights and freedoms of others. It provides a useful contrast with Dennekamp I, which concerns a third party seeking institutional documents containing other people’s personal data. Read the Article.