Article 86 — Processing and public access to official documents

Article 86 addresses a conflict that is particularly important in a democratic society: the public's interest in accessing official documents versus an individual's right to protection of personal data contained in those documents. The provision recognises that public authorities may hold documents containing information about identifiable individuals and that transparency laws may require those documents, or information contained in them, to be made available to the public.

The GDPR does not resolve this conflict by giving automatic priority either to transparency or to privacy. Instead, Article 86 requires the two interests to be reconciled. It allows personal data contained in official documents to be disclosed where disclosure is permitted under applicable Union or Member State law, while expressly requiring that disclosure to remain compatible with the GDPR's protection of personal data.

This makes Article 86 different from a conventional exemption provision. It does not say that public access laws override the GDPR. Nor does it say that the GDPR prevents public access to documents containing personal data. Rather, it creates a legal space in which transparency may justify disclosure, but disclosure must still satisfy data-protection requirements.

The provision is therefore best understood through three questions:

What kind of documents are covered?

When can personal data contained in those documents be disclosed?

How should public access be reconciled with the rights of the individuals identified in those documents?

---

1. The basic purpose of Article 86

Transparency is an essential component of public administration. Citizens must be able to examine how governments, courts and public institutions exercise public power. Access to official documents allows individuals, journalists, researchers and civil society organisations to scrutinise governmental decision-making.

At the same time, official documents frequently contain personal data.

A government procurement document may identify individual officials.

A court record may contain information about a person's criminal proceedings.

A public authority's disciplinary decision may identify an employee.

A planning document may contain information about property owners.

A register may contain names, addresses or identification details.

If the existence of personal data automatically prevented disclosure, transparency laws could become ineffective. Conversely, if the fact that information appears in an official document automatically made it publicly accessible, the GDPR's protection of personal data could be seriously undermined.

Article 86 attempts to occupy the space between these two positions.

Recital 154 is particularly important. It recognises public access to official documents as an important public interest and explains that public authorities and bodies should be able to disclose personal data contained in official documents in accordance with Union or Member State law. At the same time, the Recital emphasises that the right of access must be reconciled with the protection of personal data under the GDPR.

Thus, Article 86 is not a transparency override.

It is a reconciliation provision.

---

---

2. “Personal data in official documents”

The first important expression is “personal data in official documents.”

Article 86 does not create a special category of data called “official document data.” Personal data do not cease to be personal data merely because they are contained in a document held by a public authority.

This is significant.

Suppose a court possesses a judgment containing the name, address and criminal conviction of an individual. The fact that the information has entered the public institutional record does not, by itself, remove it from the material scope of the GDPR.

The same principle applies to information contained in government records.

Therefore:

Official document ≠ non-personal document.

Instead:

Official document + information relating to an identifiable individual = potentially personal data subject to the GDPR.

This is consistent with the broader definition of processing under Article 4(2). Disclosure itself can constitute processing of personal data. The CJEU confirmed in Endemol Shine Finland, Case C-740/22, that even oral disclosure of information concerning criminal proceedings can constitute processing where the information forms part of, or is intended to form part of, a filing system.

This prevents authorities from arguing that the GDPR becomes irrelevant simply because the information is being communicated rather than copied or electronically transferred.

---

---

3. What is an “official document”?

The GDPR does not provide a detailed autonomous definition of “official documents.”

This creates an important interpretative question.

Does the expression refer only to documents formally produced by public authorities in their official capacity?

Or does it encompass documents held by public authorities, irrespective of who originally created them?

Recital 154 uses broader language by referring to personal data in documents “held by a public authority or a public body.”

This suggests that the focus is not necessarily on the origin of the document but on its institutional possession and its relationship with public-access regimes.

For example, a public authority may hold:

• a report prepared by an external consultant;
• correspondence received from a private company;
• witness statements;
• applications submitted by individuals;
• internal administrative records; or
• documents generated by another public body.

Whether each such document falls within the relevant national access regime will depend on the applicable law.

The practical consequence is that Article 86 cannot be applied without looking at the national or Union access regime governing the document.

---

---

4. “Held by a public authority or a public body”

The provision applies to documents held by:

1. a public authority;
2. a public body; or
3. a private body, where it is performing a task carried out in the public interest.

The third category is particularly significant.

Article 86 therefore does not operate exclusively within traditional government departments. A private organisation may come within its scope where it holds official documents in connection with a task performed in the public interest.

For example, a private entity entrusted by law with a public regulatory or administrative function may possess documents relevant to public access.

The relevant question is therefore not simply:

“Is the organisation privately incorporated?”

Instead, the enquiry is:

“Is the body holding the official documents in the context of performing a task carried out in the public interest?”

This reflects the GDPR's broader functional approach to certain public-interest processing activities.

---

---

5. “May be disclosed”

The wording “may be disclosed” is important.

Article 86 does not impose a general obligation to publish every official document containing personal data.

Nor does it prohibit disclosure.

It recognises that disclosure may occur where the requirements of the applicable access law and the GDPR are satisfied.

The permissive wording therefore leaves room for national transparency legislation to determine when official documents are accessible.

But that discretion is not unlimited.

The authority cannot simply say:

“Our freedom-of-information law allows access, therefore the GDPR does not apply.”

Disclosure remains processing of personal data, and that processing must satisfy the GDPR.

The CJEU's jurisprudence strongly supports this understanding.

---

---

6. The role of Union or Member State law

Article 86 expressly links disclosure to Union or Member State law to which the public authority or body is subject.

This reflects the fact that access to official documents is substantially governed by constitutional, administrative and transparency rules at Union and national level.

Member States may therefore establish rules determining:

• which documents are publicly accessible;
• who can request them;
• whether an applicant must establish an interest;
• whether disclosure is automatic or request-based;
• whether certain categories of information are exempt; and
• whether documents may be reused.

However, national law cannot be interpreted as creating a blanket exemption from the GDPR.

The CJEU emphasised this point in Endemol Shine Finland. The Court stated that the disclosure of personal data remains subject to the GDPR's principles in Article 5 and must satisfy a lawful basis under Article 6.

Therefore, the structure is:

1. Access law permits disclosure
2. But disclosure constitutes processing
3. Processing must satisfy the GDPR
4. The competing interests must be reconciled --- ------------------------------------------------------------------------

7. The legal basis problem

One of the most important practical questions under Article 86 is the legal basis for disclosure.

In many situations involving public authorities, Article 6(1)(e) may be particularly relevant because it permits processing necessary for performing a task carried out in the public interest or exercising official authority.

But Article 86 itself does not automatically constitute a standalone legal basis for every disclosure.

This distinction is important.

Article 86 identifies the specific context in which disclosure can occur. It does not eliminate the general lawfulness requirements of the GDPR.

Accordingly, an authority considering disclosure should ask:

What Union or Member State law requires or permits the disclosure?

What public-interest objective does that law serve?

Is disclosure necessary for achieving that objective?

What personal data will be disclosed?

Is the interference with the data subject's rights proportionate?

The CJEU confirmed this approach in Endemol Shine Finland, holding that public disclosure of personal data must comply with Article 5 and satisfy an applicable condition of lawfulness under Article 6.

---

---

8. Article 86 does not create a blanket transparency exception

This is perhaps the most important point in understanding Article 86.

The provision does not operate like Article 85.

Article 85 specifically requires Member States to reconcile data protection with freedom of expression and information and expressly contemplates exemptions and derogations from specified GDPR provisions in appropriate circumstances.

Article 86 contains no equivalent list of GDPR provisions that may simply be disapplied.

Instead, it requires reconciliation with the GDPR itself.

This means that a public authority cannot automatically disregard:

• Article 5 principles;
• Article 6 lawfulness requirements;
• Article 9 restrictions concerning special categories of data; or
• Article 10 requirements concerning criminal convictions and offences.

The CJEU's approach in Endemol Shine Finland makes this especially clear.

---

---

9. The GDPR's protection becomes particularly important with sensitive data

The balancing exercise becomes substantially more difficult when the official document contains sensitive personal data.

Article 86 must therefore be read with Articles 9 and 10.

Article 10 is particularly important where official documents contain information relating to criminal convictions and offences.

In Latvijas Republikas Saeima, Case C-439/19, the CJEU considered Latvian legislation that made information concerning penalty points imposed for road traffic offences publicly accessible. The Court concluded that the disclosure could not be justified merely because road safety was a public-interest objective. The disclosure also had to satisfy the requirements of necessity and proportionality.

The case demonstrates that a legitimate public purpose is only the beginning of the analysis.

The authority must still establish that the particular method of disclosure is necessary and proportionate.

---

---

10. Public interest does not automatically defeat privacy

This principle was reinforced in Endemol Shine Finland, Case C-740/22.

The case concerned a request to obtain information concerning the criminal convictions of another individual from a Finnish court. The information was sought by a commercial company in connection with a competition.

The Court recognised that public access to official documents constitutes a public interest capable of justifying disclosure. However, it held that this interest must be reconciled with the fundamental rights to private life and protection of personal data. Given the sensitivity of criminal-conviction data and the seriousness of the interference caused by disclosure, the Court concluded that such data could not simply be disclosed to anyone requesting them without requiring a specific interest.

This provides an important practical rule:

The existence of a public-access regime does not mean that every member of the public is automatically entitled to every piece of personal information contained in an official record.

The nature of the information matters.

The purpose of the request matters.

The seriousness of the interference matters.

And the necessity of disclosure matters.

---

---

11. Bavarian Lager and the transparency debate

The earlier Bavarian Lager litigation is also important in understanding the development of this principle.

The case concerned access to documents held by the European Commission and the relationship between transparency rules and protection of personal data. The CJEU ultimately required the data-protection interests of identifiable individuals to be taken seriously when access to documents containing personal data was sought.

The significance of Bavarian Lager is broader than its particular facts.

It demonstrates that transparency cannot be analysed independently of data protection simply because the information is held by a public institution.

This is particularly relevant today because public records increasingly contain extensive personal information.

---

---

12. A practical example

Consider a government authority investigating a company for regulatory violations.

Its investigation file contains:

• the company's corporate information;
• names of government officials;
• names of witnesses;
• email addresses;
• statements made by individual employees; and
• information concerning alleged misconduct.

A journalist requests the entire investigation file under the applicable transparency law.

The authority cannot simply choose between:

“disclose everything”

or

“withhold everything.”

It should examine the individual categories of information.

Corporate information may be suitable for disclosure.

Information concerning public officials may require a separate assessment.

Private contact details may be redacted.

Highly sensitive information may require stronger protection.

Witness statements may require protection depending on their contents and purpose.

Article 86 therefore encourages a document-level and data-level assessment, rather than treating an entire document as automatically public or automatically confidential.

---

---

13. The deeper issue: Article 86 and fragmented harmonisation

A significant structural feature of Article 86 is that it leaves substantial space for Member States.

Different Member States may have different traditions concerning:

• freedom of information;
• public registers;
• court transparency;
• administrative transparency;
• access to government records; and
• protection of personal information.

Consequently, the balance between transparency and privacy may not be identical throughout the EU.

This creates a degree of fragmented application.

However, the discretion given to Member States is not unlimited. The CJEU has repeatedly emphasised that national rules operating within the GDPR framework must respect the conditions and limits imposed by EU law and must not undermine the content and objectives of the Regulation.

Thus, Article 86 accommodates national transparency traditions without creating a GDPR-free zone for public documents.

---

---

14. A useful decision-making framework

An authority considering disclosure under Article 86 can approach the issue through the following sequence:

Question	Legal significance
Does the document contain personal data?	Determines whether GDPR obligations are engaged
Is the document covered by a public-access regime?	Establishes the transparency basis
What Union or Member State law governs disclosure?	Identifies the legal framework
What is the purpose of disclosure?	Helps assess the public interest
What data will actually be disclosed?	Determines the degree of privacy interference
Is there a lawful basis under Article 6?	Establishes lawfulness
Do Articles 9 or 10 impose additional restrictions?	Important for sensitive or criminal data
Is disclosure necessary and proportionate?	Prevents excessive interference
Can partial disclosure or redaction achieve the objective?	Provides a less intrusive alternative
Does the public interest outweigh the relevant privacy interests?	Completes the reconciliation exercise

This framework demonstrates why Article 86 cannot be reduced to a simple rule favouring either transparency or privacy.

---

---

15. Conclusion

Article 86 occupies a narrow but constitutionally important position within the GDPR. It recognises that official transparency and data protection are both legitimate public interests, and that official documents may contain personal data whose disclosure may sometimes be necessary for democratic accountability. At the same time, it rejects the proposition that information becomes freely disclosable merely because it is contained in an official document.

The critical expression in Article 86 is therefore “in order to reconcile”.

The provision does not establish an automatic hierarchy between the two competing interests. Instead, it requires public access to be reconciled with the right to protection of personal data under the GDPR.

The CJEU's jurisprudence makes this principle increasingly clear. Bavarian Lager established the importance of applying data-protection safeguards when transparency requests concern documents containing personal data. Latvijas Republikas Saeima demonstrated that even a legitimate public-interest objective cannot justify unrestricted disclosure where the interference with privacy is disproportionate. More recently, Endemol Shine Finland confirmed that even oral disclosure of criminal-conviction data from a court record remains subject to the GDPR and that public access cannot automatically justify disclosure to anyone without a specific interest.

Article 86 can therefore be reduced to a simple proposition:

The fact that personal data are contained in an official document may provide a context for disclosure, but it does not remove the data from the protection of the GDPR.

The authority must identify the applicable access law, establish a lawful basis for processing, consider any heightened protection applicable to the data, and assess whether the particular disclosure is necessary and proportionate to the transparency objective.

In this sense, Article 86 is not a provision against privacy and not a provisionagainst transparency.

It is a provision about how the two must coexist.