Dennekamp II: When Public Scrutiny Justifies Naming Names

Case T-115/13 | Gert-Jan Dennekamp v European Parliament | General Court of the European Union | Fifth Chamber | 15 July 2015

Practice Takeaways: ① Necessity remains a strict test. Explain why disclosing the personal data is the most appropriate and proportionate way to achieve the stated objective. ② A general public-interest objective can support disclosure, but it does not itself prove necessity. ③ Potential conflicts of interest can justify identifying decision-makers with a personal stake in the decision. Proof of actual bias is not required. ④ Public figures retain data-protection rights, but information connected to their public functions may receive less protection in the balancing exercise. ⑤ Privacy does not enjoy an automatic presumption of priority. Once necessity is established, the institution must assess the competing interests. ⑥ Match disclosure to the demonstrated need. The judgment concerned scheme members who actually participated in three specified votes, not every participant.

In Dennekamp I, a journalist failed to obtain the names of MEPs participating in Parliament’s additional pension scheme because he had not adequately established the necessity of transferring the personal data. In Dennekamp II, he returned with a new request explaining how those names could reveal potential conflicts between MEPs’ financial interests and their voting behaviour.

The General Court again applied the access-to-documents and data-protection regulations together. This time, however, it found that identifying scheme members who actually voted on the scheme was necessary to expose potential conflicts of interest, and that the relevant balancing exercise favoured disclosure. (Judgment, paras. 88–114, 116–130.)

What changes when a requester explains not just why information interests the public, but why identifying particular people is necessary for public scrutiny?

What Happened

Gert-Jan Dennekamp was a journalist employed by the Netherlands Broadcasting Association. His efforts to obtain information about Parliament’s additional pension scheme began in 2005 and led to the unsuccessful challenge decided in Dennekamp I in November 2011. (Judgment, paras. 1–4.)

On 10 September 2012, he submitted another request. It sought documents identifying current MEPs who participated in the scheme, names of MEPs who had participated after September 2005, names of members for whom Parliament paid a monthly contribution, and documents concerning the scheme’s financial position since 2009. (Judgment, para. 5.)

This request expressly addressed Article 8(b) of Regulation 45/2001. Dennekamp argued that disclosure was necessary to inform the public about the scheme and identify possible conflicts of interest. He pointed to Parliament’s funding of two thirds of participants’ contributions, its covering of shortfalls, and its commitment to compensate losses. His confirmatory application explained that the names would allow him to report on public spending, possible effects of private interests on voting, and the operation of oversight mechanisms. (Judgment, paras. 6–11.)

Parliament directed him to publicly available financial documents but refused access to the three categories identifying participants. It rejected the confirmatory application on 11 December 2012, maintaining that necessity had not been established and that the MEPs’ legitimate interests opposed disclosure. (Judgment, paras. 10–15.)

Dennekamp challenged that decision before the General Court. Finland, Sweden, and the European Data Protection Supervisor intervened in support of his application. This was a new annulment action concerning a later refusal, not an appeal against Dennekamp I. (Judgment, paras. 16–22.)

Why the Case Matters

Dennekamp I established the importance of the necessity threshold. Dennekamp II explains both how demanding that threshold remains and how a properly supported request can cross it.

The Court distinguished two objectives: informing the public about the use of public money and identifying potential conflicts of interest in MEPs’ voting. The broader reporting objective did not establish why the names were the most appropriate and proportionate means of achieving it. The conflicts-of-interest objective did, for a defined group of decision-makers. (Judgment, paras. 78–87, 93–113.)

Data protection does not invariably prevent public disclosure.

The judgment therefore demonstrates that data protection does not invariably prevent public disclosure. It requires the request to connect the specific data to a legitimate objective and requires the institution to evaluate the data subjects’ interests in context.

The Key Holding

The Court annulled Parliament’s refusal insofar as it withheld the names of scheme participants who, as members of the plenary, actually took part in votes on the scheme on 24 April 2007, 22 April 2008, and 10 May 2012. It did not require disclosure of the names of every participant. (Judgment, paras. 103, 113, 130–131, 143; operative part, point 2.)

A separate part of the request concerned 65 MEPs whose membership had already become public through earlier litigation. The Court found no need to adjudicate on that aspect because the action was devoid of purpose to that extent. It dismissed the remainder of the action. (Judgment, paras. 25–29, 143.)

The Court’s Analysis

1. The Two Regulations Still Applied Together

The Court reaffirmed the framework established in Bavarian Lager and Dennekamp I. Regulation 1049/2001 promoted public access to institutional documents, while Regulation 45/2001 protected individuals when EU institutions processed personal data. Neither regulation automatically took priority over the other. (Judgment, paras. 35–43.)

A request for institutional documents was therefore not a route around the personal-data rules. Where disclosure would communicate personal data, the applicable provisions of Regulation 45/2001 had to be applied in full. (Judgment, paras. 49–51.)

The Court also addressed a tension within the combined framework. Article 6(1) of Regulation 1049/2001 ordinarily did not require an applicant to justify an interest in the requested documents. But where Article 8(b) of Regulation 45/2001 applied, the applicant had to give express and legitimate reasons establishing why the personal-data transfer was necessary. That qualified the ordinary rule that an access request needs no justification. (Judgment, paras. 52–55.)

Practice Tip: Distinguish the general right to request documents from the need to justify a transfer of personal data contained in them. The first does not necessarily dispense with the second.

2. A Strict Necessity Test Could Accommodate a General Objective

The Court rejected the argument that necessity should be interpreted loosely because the request concerned public access. To meet the condition, the applicant had to show that transferring the personal data was the most appropriate of the possible measures for attaining the objective and was proportionate to that objective. (Judgment, paras. 56–60.)

 [...] the test of necessity laid down in Article 8(b) of Regulation No 45/2001 must be strictly interpreted (Judgment, para. 68.)

Yet a strict test did not exclude a general public-interest objective, such as the public’s right to information about MEPs’ conduct. The general nature of the objective did not itself determine whether the transfer was necessary. The issue was whether the requested data were needed to achieve it. (Judgment, paras. 61–64.)

This clarifies the lesson of Dennekamp I. General public-interest reasons were not inadmissible; they were insufficient when the requester failed to establish the necessary link to the particular personal data sought.

The Court also distinguished reliance on public-interest reasons under the data-protection transfer test from an overriding-public-interest exception under Regulation 1049/2001. Article 4(1)(b) of the access regulation did not contain that override, but public-interest reasons could nevertheless be considered in applying Article 8(b) of Regulation 45/2001. (Judgment, paras. 62–64.)

3. An Intention to Publish Was Not an Automatic Bar

Parliament argued that Dennekamp intended to communicate the names to the public and that this would create the greatest interference with their protection. It maintained that Regulation 45/2001 was not designed to enable disclosure to everyone. (Judgment, para. 65.)

The Court rejected that argument as a categorical obstacle. The data-protection provisions were being applied within an access-to-documents procedure whose purpose, if successful, was public disclosure. They could not be interpreted as allowing access only to the applicant while necessarily prohibiting access by the public. (Judgment, paras. 66–68.)

Where the transfer conditions were satisfied and no other applicable access exception prevented disclosure, documents containing the personal data could be made available to the public. This did not create a general entitlement to publish any personal data; it preserved the operation of the public-access framework when its conditions were met. (Judgment, para. 67.)

4. Informing the Public Did Not Establish the Need for Every Name

The Court first considered Dennekamp’s objective of informing the public and encouraging debate about the scheme. His reliance on freedom of expression and the right to information did not establish that obtaining participants’ names was the most appropriate and proportionate means of achieving that objective. (Judgment, paras. 79–82.)

Nor did criticism of existing oversight mechanisms sufficiently analyze the alternatives. The existence of controversy, or the wish to generate debate, explained the purpose of the request without demonstrating the necessity of transferring the particular data. The information Dennekamp already possessed about the scheme could itself support reporting and public debate about its management and financial risks. (Judgment, paras. 83–87.)

The Court therefore retained an important limit: explaining what a report will cover does not necessarily explain why it needs identifiable information about everyone involved.

Practice Tip: State the objective, then explain the role of each requested category of personal data in achieving it. The public importance of the subject does not itself establish the necessity of every requested identity.

5. Potential Conflicts of Interest Supplied the Missing Link

The Court reached a different conclusion on Dennekamp’s objective of identifying potential conflicts of interest. A participant voting on the scheme could express a view or influence arrangements affecting a personal financial interest. To identify that situation, the public needed to know which decision-makers also participated in the scheme. (Judgment, paras. 88–94.)

The identities were indispensable to that comparison. No other measure could identify the MEPs exposed to the particular potential conflict. The transfer was therefore the most appropriate and proportionate means of determining whether their interests in the scheme could influence their voting behaviour. (Judgment, para. 94.)

• Parliament argued that names would not reveal the subjective motives for a vote. But identifying a potential conflict did not require proof that a private interest had actually influenced the decision. It also encompassed circumstances in which an interest could appear to the public to affect impartial performance of official duties. Disclosure could help identify risks and encourage their declaration, management, or avoidance. (Judgment, paras. 105–107.)
• Nor did Dennekamp have to prove misconduct by a particular MEP or first assemble all the evidence that the requested information would help reveal. The relevant risk arose from the dual position of being a scheme participant and voting on it. The Court also rejected the suggestion that he had to proceed through successive requests identifying the deciding bodies, then the voters, then their scheme membership. (Judgment, paras. 108–112.)

Practice Tip: To justify scrutiny of a potential conflict, explain the relationship between a person’s private interest and public decision-making role. The judgment did not require proof that the interest had already distorted the decision.

6. The Demonstrated Need Defined the Scope of Disclosure

Scheme membership alone did not identify the relevant potential conflict. The analysis also required identifying those who had actually participated in a vote on the scheme. Parliament maintained that only the Bureau made the relevant decisions, but the Court examined the role of the plenary as well. (Judgment, paras. 95–100.)

The evidence showed that separate votes on provisions concerning the scheme had taken place in plenary on 24 April 2007, 22 April 2008, and 10 May 2012. The relevant group comprised participating MEPs who were scheme members and actually voted on those dates. (Judgment, paras. 101–104.)

Parliament had therefore erred in denying necessity for that group. But the finding did not extend to members who had not participated in those votes or were not in office at the relevant times. The operative result reflected that boundary. (Judgment, paras. 113–114, 131, 143.)

Practice Tip: Match the scope of disclosure to the demonstrated purpose. Here, the relevant connection was participation in both the scheme and a specified vote on it.

7. Public Figures Retained Rights, but Context Changed the Balance

Once necessity was established, the Court turned to the second cumulative condition under Article 8(b): assessing the data subjects’ legitimate interests. It did not accept Dennekamp’s broad proposition that MEPs lacked legitimate privacy interests simply because they were public figures. Their status mattered to the assessment, but did not remove protection altogether. (Judgment, paras. 115–119.)

The specific information nevertheless belonged to the MEPs’ public sphere. Participation depended on holding a parliamentary mandate. Parliament’s substantial funding and financial commitments reinforced that connection. Voluntary membership and payment of pensions after a mandate ended did not make these particular data exclusively private. (Judgment, paras. 120–122.)

Disclosure would reveal membership, not the MEPs’ assets, savings, or the investments of the scheme’s funds. Their interests in the information therefore received less protection in the weighing exercise than interests belonging to their private sphere. (Judgment, paras. 123–125.)

The Court gave substantial weight to exposing potential conflicts of interest, improving institutional scrutiny, and sustaining public confidence. It concluded that the relevant legitimate interests could not be prejudiced by the transfer in the circumstances and that balancing should have led to approval. (Judgment, paras. 126–130.)

Parliament could not rely on a legally binding presumption that the data subjects’ interests took priority. Claims that disclosure would eliminate MEPs’ privacy or threaten their independence lacked supporting evidence. Possible public criticism also did not establish that the transfer should be refused. (Judgment, paras. 127–129.)

Practice Tip: Evaluate the particular information and the public function to which it relates. Public office does not remove data-protection rights, but a specific connection to official decision-making can change the balance.

8. An Incorrect Assessment Was Not Necessarily an Inadequately Reasoned Decision

Dennekamp separately alleged that Parliament had failed to explain how disclosure would harm privacy. The Court reiterated that refusal requires an explanation of how disclosure could specifically and actually undermine the protected interest; a bare assertion is insufficient. (Judgment, paras. 132–136.)

It nevertheless rejected the failure-to-state-reasons plea. Parliament’s reasoning was relatively brief but allowed Dennekamp and the Court to understand its position: that pension membership concerned private financial interests warranting protection. That assessment was substantively wrong for the relevant group, but its reasoning was sufficiently expressed. (Judgment, paras. 138–142.)

Practice Tip: A decision can disclose its reasoning clearly enough for review and still misapply the legal test or assess the competing interests incorrectly.

What the Court Did—and Did Not—Decide

The Court held that a properly supported conflicts-of-interest objective could establish necessity for disclosing a defined group of MEPs’ names. It also held that, for that group and that information, the assessment of legitimate interests favoured disclosure.

It did not declare every scheme member’s identity disclosable, abolish public officials’ privacy rights, or conclude that any MEP had acted improperly. Identifying a potential conflict is different from proving misconduct or establishing the subjective motive for a vote.

Dennekamp II Today

Like Dennekamp I, the judgment applied Regulation 45/2001, the former data-protection framework for EU institutions and bodies. It was not a post-GDPR ruling. Regulation 45/2001 has since been replaced by Regulation (EU) 2018/1725.

• Article 9(1)(b) of the current regulation expressly requires a recipient relying on it to establish that transmission is necessary for a specific purpose in the public interest. Where there is reason to assume that the data subject’s legitimate interests might be prejudiced, the controller must establish proportionality after demonstrably weighing the competing interests. The provision concerns recipients established in the Union other than Union institutions and bodies. (Regulation 2018/1725, Article 9(1)(b).)

Dennekamp II remains a useful illustration of the difference between an objective that is broadly stated and a justification that concretely explains why particular identities are needed. Its public-function analysis also shows why institutional assessments must address the specific data and circumstances. Present-day requests nevertheless require analysis under the current provisions.

Conclusion

The two Dennekamp judgments tell a connected story. The first request failed at the necessity threshold. The later request succeeded in part because it connected the names sought to scrutiny that could not be carried out without them: identifying scheme participants who had voted on the scheme.

The Court preserved both transparency and data protection by requiring justification, considering the legitimate interests in context, and limiting the resulting disclosure to the group for which the need had been established.

For requesters, the practical lesson is to explain what identifying the individuals makes possible. For institutions, it is to assess that explanation rather than treating either public interest or privacy as an automatic answer.

Sources and Additional Materials

Sources

CJEU judgments, Advocate General opinions, procedural orders, summaries, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database.

Search Case T-115/13.

General Court of the European Union, Fifth Chamber, Case T-115/13, Gert-Jan Dennekamp v European Parliament, Judgment of 15 July 2015, ECLI:EU:T:2015:497.

Useful Reading from The De La Torre Review

• Dennekamp I: Why Transparency Requests Must Explain the Need for Personal Data — The first chapter in the dispute. It explains why neither the public interest in transparency nor a general appeal to accountability establishes, by itself, the necessity of transferring the requested personal data. Read the Article.
• Bavarian Lager: When Transparency Requests Become Data-Protection Questions — The foundation for both Dennekamp judgments. It establishes how the EU institutions’ access-to-documents and data-protection rules operate together when requested records identify individuals. Read the Article.
• Schecke: Transparency Does Not Automatically Trump Data Protection — Examines mandatory publication of information identifying recipients of public funds, providing a comparison with disclosure following an individual request supported by a specific public-interest justification. Read the Article.
• Österreichischer Rundfunk: When Salary Transparency Meets the Right to Privacy — An earlier judgment on identifying individuals in public-expenditure disclosures and on the necessity and appropriateness of publishing names alongside financial information. Read the Article.
• Nowak: When an Exam Answer Becomes Personal Data — Explains the breadth of personal data and the distinction between classification and access. It provides a contrast with Dennekamp II because it concerns an individual’s access to their own information. Read the Article.
• CRIF: When a “Copy” of Your Personal Data Requires More Than a Data List — Examines an individual’s right to obtain an intelligible copy of their own personal data while respecting others’ rights and freedoms, rather than a third party’s public-access request. Read the Article.