European Ombudswoman Teresa Anjinho has found maladministration in the European Commission’s refusal to analyse a 2023 risk assessment report drawn up by social media company X for possible public disclosure. Under the EU’s Digital Service Act, large social media companies such as X must provide annual reports to the Commission on their compliance with the Act’s provisions.

When a journalist requested access to X’s report, the Commission refused, arguing that it could be generally presumed that disclosure could undermine the company’s commercial interests as well as an ongoing investigation into its compliance with the Digital Services Act. The Commission later added that its use of a general presumption of non-disclosure was also justified by the need to protect an independent audit into the same issue.

This reliance on a general presumption means that the Commission had not individually assessed the report for possible disclosure.

The Ombudswoman found that it was unreasonable for the Commission to apply a general presumption of non-disclosure and that the circumstances in which the EU courts permitted this are very different from the rules that apply to risk assessment reports. She further found that the then ongoing audit was also not enough to justify a general presumption of non-disclosure, even if X was obliged to publish the report within three months of the audit’s completion.

While X has now made the report public with redactions, the Ombudswoman nevertheless recommended that the Commission conduct an individual assessment of the document for disclosure. This assessment should aim at granting the journalist the widest access possible, including possibly to the redactions made by the company.

The Ombudswoman further stressed that if the Commission concludes that access cannot be granted to certain parts of the report, it must thoroughly explain why.