The complainant asked the European Commission for public access to the risk assessment report of a large social media company on its compliance with the provisions of the Digital Services Act (DSA) – annual reporting is part of the obligations of ‘very large online platforms’ under the Act. The Commission refused access to the document, arguing that it could be generally presumed that disclosure could undermine the commercial interests of the company in question as well as an ongoing investigation into the company’s compliance with the DSA. The Commission did not individually assess the report for possible disclosure.
The Ombudsman concluded that the Commission’s application of a general presumption of non-disclosure to the risk assessment report constituted maladministration. She recommended that the Commission conduct an individual assessment of the document with a view to granting the widest access possible.