TS - 1119/2025
From GDPRhub
| TS - 1119/2025 | |
|---|---|
 | |
| Court: | TS (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 15(1)(h) GDPR Article 22(1) GDPR Art. 14.1.j LTAIBG |
| Decided: | 11.09.2025 |
| Published: | |
| Parties: | Spanish Ministry for Ecological Transition (MITECO) Fundación Ciudadana Civio |
| National Case Number/Name: | 1119/2025 |
| European Case Law Identifier: | ECLI:ES:TS:2025:3826 |
| Appeal from: | AN (Spain) 51/2022 |
| Appeal to: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | CGPJ (in Spanish) |
| Initial Contributor: | ap |
The Supreme Court stated that a public authority cannot deny an access request under national freedom of information law solely on intellectual property and security concerns. The request referred to the source code of a program used for granting financial assistance based on automated decision-making under Article 22 GDPR.
English Summary
Facts
BOSCO is a tool used by the Spanish Ministry for Ecological Transition (MITECO). Electricity companies use BOSCO to automatically check whether vulnerable consumers qualify for assistance for their electricity bill. In 2018 Fundación Ciudadana Civio (referred to as “Civio”, a nonprofit organisation) requested from MITECO access to technical documentation and source code in order to audit how automated decision-making took place. According to Civio, a significant number of people were denied access to this social bonus even if they seemed to meet the requirements. People also did not receive an explanation on why their request was denied.
Civio filed a complaint with the Transparency and Good Government Council (CTBG), after not receiving a response from MITECO. The CTBG granted Civio access to technical specifications and test results, but denied access to the source code on intellectual property grounds. Under national law (the law on transparency, access to public information and good governance, or LTAIBG), the right to access to public institutions may be limited if it harms professional secrecy and intellectual property. Civio appealed the decision to the Court of First Instance and High Court. Both courts denied access to the source code, on the grounds that it violated intellectual property rights. The right to access could also be limited in this case due to the security implications of disclosing the source code; according to the Court, the vulnerabilities found in the code could be used to access databases connected to BOSCO (such as those managed by the Tax Authority and Social Security).
Civio appealed the decision to the Supreme Court. Civio argued that the courts had misinterpreted Article 14(1) LTAIBG to completely limit the right to access; the courts did not consider that the limit must be necessary and proportionate, especially in relation to the public or private interests that justifies the access (article 14(2) LTAIBG). Furthermore, there is a public interest in knowing on what grounds BOSCO rejected applications for assistance, which must prevail over the intellectual property rights of the public administration. Finally, restricting the right to access in this way has significant implications for the right to participate in public affairs and legal certainty.
Holding
The Court first stated that the right to access to public institutions is recognised in the Spanish Constitution, which derives from both democratic and transparency requirements, as well as the subjective right of citizens. This is also enshrined in Article 42 CFREU.
The Court acknowledged the convenience for public administration bodies in using automated decision-making, however, this does not exempt them from their information and access obligations enshrined in the Constitution. Access to the source code is a way to ensure algorithmic transparency, however, it must be exercised within the legal limits of the right to access. The Court stated that Civio had a legitimate interest in accessing the source code, because its objective is to verify that the BOSCO system is working correctly and protect vulnerable consumers (especially in cases of energy poverty).
The Court concluded that the mere risk of harm to the public authority’s intellectual property right cannot in itself be a ground to exclude the right to access. The Court referred to the ECtHR’s reasoning in Magyar Helsinki Bizottság v. Hungary. This is especially relevant in this case, as it is impossible (or at least extremely difficult) to know the parameters used by BOSCO without accessing the source code. The Court also took into consideration the fact that the use of BOSCO was automated decision-making within the meaning of Article 22 GDPR, according to a decision by the DPA. This meant BOSCO itself made the decision to grant the assistance, and that there was no intervention from the public administration. The Court stated that the right to access to public information is not equivalent to the right to explainability of the logic behind automated decision-making. However, the obligation to provide the access code does not necessarily conflict with the GDPR. Finally, the Court dismissed the security concerns, and referred to the past access to apps developed by public administrations in the past (such as Radar COVID) that did not result in security incidents.
The Court upheld the appeal, and ordered the MITECO to provide Civio with the source code of BOSCO.
Comment
The DPA also concluded that the MITECO has violated Articles 13, 22 and 35 GDPR. According to the DPA, BOSCO was a tool for automated decision-making and not merely a consulting tool.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
JURISPRUDENCE
Roj: STS 3826/2025 - ECLI:ES:TS:2025:3826
Cendoj Id: 28079130032025100155
Author: Supreme Court. Contentious Division
Headquarters: Madrid
Section: 3
Date: 09/11/2025
Appeal No.: 7878/2024
Decision No.: 1119/2025
Procedure: Appeal
Rapporteur: JUAN PEDRO QUINTANA CARRETERO
Type of Decision: Judgment
Case decisions: SJCCA, no. 8, 12/30/2021 (rec. 18/2019),
SAN 2013/2024,
ATS 14188/2024,
STS 3826/2025
SUPREME COURT
Administrative Litigation Chamber
Third Section
Judgment No. 1,119/2025
Judgment Date: 09/11/2025
Type of Procedure: R. CASSATION
Proceeding Number: 7878/2024
Judgment/Agreement:
Voting and Judgment Date: 07/08/2025
Rapporteur: Mr. Juan Pedro Quintana Carretero
Origin: NATIONAL COURT, C/A. CHAMBER SECTION 7
Court Clerk: Section 003
Transcribed by: tmrf
Note:
CASATION RUMBLE No.: 7878/2024
Rapporteur: His Excellency Mr. Juan Pedro Quintana Carretero
Court Clerk: Section 003
SUPREME COURT
Administrative Litigation Division
Third Section
Judgment No. 1119/2025
Your Excellencies and Honors Gentlemen
Mr. José Manuel Bandrés Sánchez-Cruzat, President
1
JURISPRUDENCE
Mr. Eduardo Calvo Rojas
Mr. José Luis Gil Ibáñez
Ms. Berta María Santillán Pedrosa
Mr. Juan Pedro Quintana Carretero
In Madrid, on September 11, 2025.
This Court has heard appeal no. 7878/2024 filed by the entity Fundación Ciudadana Civio, represented by attorney Ms. Rocío Sampere Meneses and defended by attorney Mr. Javier de la Cueva González-Cotera, against the judgment of April 30, 2024, issued by the Seventh Section of the Administrative Litigation Division of the National Court, which dismisses appeal no. 51/2022, filed against the judgment of December 30, 2024. 2021, issued by the Central Administrative Court No. 8 in ordinary proceedings No. 18/2019, dismissing the administrative appeal filed against the resolution of the Transparency and Good Governance Council (CTBG) of February 18, 2019, partially upholding the claim filed against the Ministry of Ecological Transition (MITECO) regarding access to information related to the electronic application (BOSCO).
The State Administration, represented by the State Attorney, appeared as the respondent.
The rapporteur was Mr. Juan Pedro Quintana Carretero.
FACTS
FIRST.- The Central Administrative Litigation Court No. 8, in appeal number 18/2019, issued Judgment No. 143/2021, dated December 30, 2021, dismissing the administrative appeal filed by Attorney Ms. Rocío Sampere Meneses, on behalf of and representing Fundación Ciudadana Civio, against the resolution of the Transparency and Good Governance Council (CTBG) of February 18, 2019, issued in the procedure processed under No. R/0701/2018, partially upholding the claim filed on November 27, 2018, against the Ministry of Ecological Transition (MITECO), regarding access to information related to the computer application. (BOSCO), developed
to determine whether the requirements for social security benefits are met.
Against this ruling, the Civio Citizen Foundation filed an appeal, which was dismissed by the ruling of April 30, 2024, of the Seventh Section of the Administrative Litigation Division of the National Court, issued in appeal no. 51/2022, whose ruling reads verbatim:
"In light of the foregoing, this Court has decided: To dismiss the appeal filed by the Civio Citizen Foundation, represented by attorney Ms. Rocío Sempere Meneses, against the ruling of December 30, 2021, issued by the Central Administrative Litigation Court No. 8 of Madrid in appeal no. 18/2019. This ruling is upheld, with the costs of this appeal being imposed on the appellant in the terms and within the limits set forth in the final legal grounds of this ruling."
The Court of First Instance based its decision on the following legal considerations:
"FIRST. Facts relevant to the resolution of the appeal.
The appealed judgment dismisses the contentious-administrative appeal filed by Fundación Ciudadana Civio against the February 18, 2019, ruling by which the CTBG partially upheld the claim filed in a request for access to information from the MITECO (Ministry of Economic and Social Affairs) that supports the computer application developed and built for the automated management of applications for the social voucher (BOSCO) information system. This online application allows the marketer to verify that the social voucher applicant meets the requirements to be considered a vulnerable consumer.
The application was upheld with regard to the technical specification of the application; the results of the tests carried out to verify that the implemented application meets the functional specification; and any other deliverables that allow understanding the application's operation.
" However, it was denied insofar as the application's source code was requested.
2
CASE LAW
The appealed judgment upholds the Administration's view that providing the source code was inappropriate and cites a number of reasons: intellectual property, the protection of affected individuals and their personal data, citizen protection, the integrity of the information, and access control.
The judgment recalls the limits of the right of access that would be exceeded if the source code were provided, as indicated in Article 14.1 of Law 19/2013 on Transparency, Access to Public Information, and Good Governance (LTAIBG): d) public safety; g) administrative functions of surveillance, inspection, and control; i) economic and monetary policy; j) professional secrecy and intellectual and industrial property; and k) the guarantee of confidentiality or the secrecy required in decision-making processes. And it specifically points out that the
distribution of the source code would make the application susceptible to vulnerability attacks, and that the vulnerabilities could be used to access databases connected to the application, such as those of the AEAT (Tax Agency) and Social Security.
To guarantee its conclusion, the ruling refers to the report issued by the Deputy Director General of Information and Communications Technologies of the Ministry of Industry, Trade, and Tourism, which was subject to contradiction.
(...)
THIRD. The Court's opinion on the issues raised. Dismissal of the appeal: The source code is protected by the Intellectual Property Law; furthermore, the dissemination of the source code of the BOSCO application is likely to cause serious harm to them and violates the access limits contemplated in Article 14 of the Intellectual Property Law.
The argument that the appellant has been rendered defenseless because one of the responses to the claim argued the existence of new limits on the delivery of the source code of the BOSCO application and proposed evidence in this regard is not admissible.
In this regard, it should be noted that any relevant grounds may be raised in the responses, whether or not they have been raised before the Administration (Article 56.1 of the LJCA).
Thus, the MITECO is entitled to invoke all the grounds for dismissing the appeal and, where applicable, regarding the inadmissibility of providing access to the source code in light of the LTAIBG: therefore, all the grounds for inadmissibility of a request or limits on access to potentially relevant public information.
Furthermore, the plaintiff could have proposed counter-evidence, as authorized by Article 60.2 of the LJCA (Spanish Civil Code) and challenged the technical assessments regarding vulnerabilities expressed in the report by the Deputy Director General of Information and Communications Technologies of the Ministry of Industry, Trade, and Tourism.
In any case, the CTBG's resolution, in addition to deeming it inappropriate to provide the source code pursuant to Article 14.1 j) of the LTAIBG (Spanish Civil Code), relating to damages to intellectual property, to which the fifth legal ground is devoted, also refers to "the protection of affected individuals and their personal data, ensuring citizen protection, the integrity of this information, and the control of its access." Therefore, if the dissemination of the code could cause damage to these assets, the decision implicitly declares its provision inappropriate.
In any case, excluding the Administration from the right to intellectual property, and particularly to computer programs (96 of the TRLPI), is entirely unfounded. Article 7.2 of Law 33/2003 on Public Administration Assets attributes the consideration of intangible property rights to the Administration, whether acquired from individuals or generated by the Administration itself. And Article 157 of Law 40/2015, on the Legal Regime of the Public Sector, expressly refers to the intellectual property rights held by Public Administrations over applications developed by their services or contracted.
Finally, although this would be sufficient to dismiss the appeal, the appellant has not disproved that the provision of the BOSCO application source code would seriously jeopardize the rights of third parties and violate legal rights protected by the limits on the right of access to public information in Article 14.1, letters d), g), i), and k) of the LTAIBG.
Indeed, the disclosure of the code objectively increases the severity of the vulnerabilities of any computer application, even more so when handling classified or sensitive information. The Administration is not required to develop all applications using open source.
Quite the contrary, a computer system must be developed based on security guarantees
depending on the sensitivity of the information to which it provides access; in the case examined, there is a compromise of third-party interests and other legal assets, which could create vulnerabilities in accessing databases connected to the application that contain specially protected data, such as the applicant's disability or
status as a victim of gender-based violence, tax data from the AEAT (Tax Agency), Social Security, etc. This would jeopardize the confidentiality of tax information, making it possible to impersonate authorized users, falsify consent, etc.
The report of the Deputy Director General of Information Technology and Communications of the Ministry of Industry, Trade, and Tourism, the technical unit that manages the BOSCO information system for MITECO, is conclusive in reaching this conclusion. The report was submitted for review at a hearing between the parties, leaving no doubt that concealing the application's source code is a guarantee of protection against vulnerabilities, preventing a potential attacker from studying the code to discover a zero-day vulnerability. According to the report, revealing the source code could have the following consequences: The attack would be very difficult to detect by those responsible for the technical administration of the Ministry's information systems and the cybersecurity team, since said technical personnel would not be aware that their information systems were being attacked. - At the time of the attack, the Ministry would not have at its disposal the technical means
(antivirus, probes, security patches for operating system and middleware products) necessary
to mitigate the vulnerability, since the manufacturers supporting these products would also not be
aware of the vulnerability in their products, or that said vulnerability would be detected and eliminated by specific computer security products.
- Due to the above, the attacker would have sufficient time to achieve their objectives, which could include, for example, the following actions:
- Access or modify, evidently for illicit purposes, the data in the application's own database, which includes specially protected personal data of those involved in the procedures (income levels of individuals, family and employment status, or whether they are classified as victims of gender-based violence or terrorism, or whether the interested party suffers from any disability).
- Attempt to access and/or alter data stored in other databases, corresponding to other administrative procedures for which the Ministry of Industry, Trade, and Tourism is responsible.
- Using the Ministry's computing infrastructure for other purposes, such as cryptocurrency mining.
- Using the Ministry's image to carry out crimes based on social engineering (blackmail or phishing).
We are also forced to disagree here with the appellant's argument regarding a violation of Article 9.3 of the Spanish Constitution. The debate focuses on the right to access the source code of the application used to manage the social bonus. Determining whether the verification procedure for verifying vulnerable consumer status is legally compliant (Royal Decree 897/2017, which regulates the status of vulnerable consumer, the social bonus, and other protection measures for domestic electricity consumers, and ETU Order 943/2017, on the verification mechanism for the requirements for being a vulnerable consumer) is outside the scope of the debate.
As the State Attorney states, the computer application is nothing more than a tool integrated into an administrative procedure that will continue to produce an administrative act fully subject to the legal system, so that the review of the legality of administrative acts continues to be guaranteed: the legality (or lack thereof) of the administrative act is not justified by the use of the computer application, but by the compliance of the act produced with the legal system.
Finally, the appellant cannot modify her claim in conclusion, nor do there appear to be grounds to overturn the first instance costs award, as the legal issue resolved therein, based on the claims and arguments of the parties, did not present serious doubts of fact or law.
SECOND.- Upon notification of the aforementioned judgment to the parties, the legal representative of the Civio Citizen Foundation filed a brief stating her intention to file an appeal. The Court of First Instance, by order of October 24, 2024, considered the appeal to be prepared, with summons to this Chamber of the Supreme Court.
After the proceedings were received by this Chamber of the Supreme Court, the First Division (Admissions Division) issued an order on November 27, 2024, admissing the appeal for processing, which also ordered the referral of the proceedings to the Third Division.
In the operative part of the admission order, the following is agreed upon:
4
JURISPRUDENCE
"1.) To admit appeal No. 7878/2024, filed by the legal representative of the Civio Citizen Foundation, against the judgment issued by the Seventh Section of the Contentious-Administrative Division of the National Court dated April 30, 2024, dismissing appeal No. 51/2022.
2.) To declare that the issue raised in the appeal, which is of objective cassation interest for the formation of jurisprudence, consists of determining whether it is appropriate—or not—to provide the source code of the computer application to determine whether the requirements for social security benefits are met.
" 3) Identify the legal provisions that, in principle, will be subject to interpretation: Articles 14.1, 2, and 16 of Law 19/2013, of December 9, on transparency, access to public information, and good governance, without prejudice to the judgment being extended to other issues or provisions if the debate ultimately engaged in the appeal so requires.
THIRD.- Against the aforementioned judgment, the legal representative of the Civio Citizen Foundation lodged an appeal in cassation by means of a document dated January 29, 2025, in which, after setting forth the background of the case, it proceeds to develop the arguments for its appeal, which we will examine later; and ends the brief by requesting that this Court issue a judgment upholding the following claims:
"TO THE CHAMBER, I REQUEST: That, having submitted this brief, an APPEAL FOR CASSATION be deemed filed against the Judgment of April 30, 2024, issued by the Seventh Section of the Administrative Litigation Division of the National Court, and therefore, following the legal proceedings, a new ruling be issued in which, overturning the lower court ruling, the appellant's right to access the requested information is declared,
or, alternatively, partial access to the code consisting of the decision-making algorithm, with costs imposed on the opposing party."
FOURTH.- By order dated February 3, 2025, the appeal filed by the appellant was deemed to be filed, and the respondent was notified so that it could file its objection.
FIFTH.- After the written notice of the appeal was sent to the respondents—the Council for Transparency and Good Government and State Administration—by order of February 3, 2025, so that they could oppose the appeal, the Council for Transparency and Good Government withdrew as a respondent to the appeal.
The State Attorney formalized his opposition to the appeal in a letter dated March 20, 2024, in which, after developing the arguments on which he bases his opposition, which we will refer to later, he ends by requesting that a judgment be issued proceeding to:
"REQUESTS THE CHAMBER to consider this brief as filed, to consider it as a written opposition to the appeal filed, and to request that the doctrine be established in the terms indicated and that it be declared inadmissible."
SIXTH.- By order of Section 3 dated March 21, 2025, the Honorable Juan Pedro Quintana Carretero was appointed as the Reporting Judge; and by order of the same date, a public hearing was held on this appeal for July 8, 2025, the date on which the hearing took place. The parties presented the allegations they deemed appropriate and reiterated their requests. However, the appellant specified its subsidiary claim by requesting access to the part or line of the application code that makes the decision, in order to verify that the parameters included in the law are described in the computer code. Deliberation on the appeal for cassation for voting and ruling began on the date of the public hearing and continued until September 9, 2025, the date on which the voting and ruling took place. LEGAL BASIS
FIRST.- Purpose of the appeal.
This appeal is filed by the representative of the Civio Citizen Foundation against the
Judgment of April 30, 2024, issued by the Seventh Section of the Administrative Litigation Division of the National Court, which dismisses appeal No. 51/2022, filed against the Judgment of December 30, 2021, issued by the Central Administrative Litigation Court No. 8 in ordinary procedure number 18/2019, which dismissed the administrative litigation appeal filed by the Civio Citizen Foundation against the resolution of the Transparency and Good Governance Council (CTBG) of February 18, 2019, issued in file R/0701/2018, which partially upheld the claim filed against the Ministry of Ecological Transition (MITECO) on access
5
CASE LAW
to information related to the online application (BOSCO), developed to determine compliance with the requirements to be a beneficiary of the social bonus.
For a proper analysis of the issues under discussion, we will begin by outlining the background to the case,
which we consider relevant and uncontroversial, extracted from the judicial proceedings followed
at first instance and at appeals:
1. On September 17, 2018, the Civio Citizen Foundation requested, through the Transparency Portal,
the following information regarding the "BOSCO" online application, which allows marketing companies
to verify that social voucher applicants meet the requirements to be considered vulnerable consumers.
The technical specifications of said application.
The results of the tests performed to verify that the implemented application meets the functional specifications.
The source code of the application currently in production.
Any other deliverables that provide insight into the application's operation.
2.- Understanding that the request had been rejected due to administrative silence, the Civio Citizen Foundation filed a complaint with the Transparency and Good Governance Council (CTBG). During the processing of the complaint, the Ministry for Economic Transition (MITECO) presented allegations based on a report from the Subdirectorate General of Information and Communications Technologies, which, in summary, consisted of: (i) based on technical grounds, access to the requested information should be denied pursuant to Article 14.1, letters a) (national security) and d) (public security) of the LTAIBG, given that the technical specifications of the programs include all the security requirements to protect the information against attacks and vulnerabilities; (ii) the source code is not public information pursuant to Article 13 of the LTAIBG, as it is neither "content" nor "documents," but rather computer programs; (iii) access to the information would jeopardize the protection and security of the personal data of the individuals affected and of the Administration itself, and would harm the Administration's intellectual property, since its unlicensed transfer could be used to replicate the application created and developed by the Administration itself (14.1.j) of the LTAIBG); (iv) an overriding public or private interest justifying access has not been demonstrated; and (v) the possibility of granting partial disclosure of the documentation has been examined, and it has been concluded that limited access to parts of this information is not possible, given its nature and content. 3.- The Transparency and Good Government Council (CTBG) resolution dated February 18, 2019, partially upheld the claim based on the following considerations:
- Regarding the limits of national security and public safety (FJ 4):
"In the case at hand, the Administration merely invokes the limits of national defense and public safety contained in Article 14.1, letters a) and d) without providing the slightest argument as to why they are applicable in its opinion. Thus, they consider that both National Security and Public Security would be harmed by access to the requested information, which, it should be remembered, refers to general information on the organization and structure of the computer application created to manage the verification of compliance with the conditions for eligibility for the social bonus.
" Considering the lack of arguments, the nature of the information requested, and the restrictions with which the Courts of Justice understand the limits on the right of access to information should be applied,
this Transparency Council does not agree that the aforementioned limits are applicable."
- Regarding the limit of intellectual property (FJ 5):
"This limit is related to the very nature of what is requested: the source code that supports the
telematic application that allows the reference marketer to verify that the applicant for the social voucher
meets the requirements to be considered a vulnerable consumer.
The source code is the file or set of files that have a set of very precise instructions,
based on a programming language, used to compile the different computer programs that use it and allow them to run without major problems. Users can use the software
without major concerns thanks to a simple graphical interface based on the development of the source code.
The user does not need to know the programming language used to develop a specific software.
" Software has been extraordinarily difficult to classify as a specific subject of intellectual property
because its dual nature poses particular problems for those trying to establish analogies
6
CASE LAW
with existing legal categories. This is why there have been attempts to classify it as a subject of copyright, patents, or trade secrets, and even as a sui generis software right. Since the source code is expressed in written form, it is logical to think that software can be protected by copyright as a literary work.
This is, in fact, the current approach to software protection in various international treaties.
Thus, for example, Article 4 of the WIPO Copyright Treaty (WCT), Article 10 of the World Trade Organization's TRIPS Agreement, and Article 1 of the European Council Directive (91/250/EEC) on the legal protection of computer programs equate software with literary works, protected by copyright. For the purposes of the Directive, the term "computer program" includes programs in any form, including those incorporated in hardware; this term also designates the preparatory work of design leading to the development of a computer program, provided that the nature of the preparatory work is such that it may later give rise to a computer program. This intellectual property right contemplated in the Directive does not, however, include the technical specifications of the program or the results of tests carried out to verify that the implemented application complies with the functional specification, which have also been requested. The former
may include aspects, among others, such as whether it is an open source operating system, how it stores data, its programming language, or whether it includes tools for memory debugging and software performance analysis. There are numerous technical specifications for computer programs publicly available on the Internet. The latter do not affect the protected hardware and, in our opinion, serve the purpose pursued by the LTAIBG of monitoring public action and the decision-making process.
- Regarding the protection of personal data and information security (FJ 6):
"In this regard, it must be argued that what is being requested is the structure or framework of the application used by the Administration, which is intended to verify the income data of individuals who have applied for the social bonus and any special circumstances, such as gender violence, terrorism, or disability.
" In no way does knowing the technical specifications of a computer application imply, either directly or indirectly, access to the personal data that will later be included in it.
The test results, which are also requested, must not, under any circumstances, include actual personal data, but simply statistics on the effectiveness of the system based on the intended purpose.
And, in its operative section, it resolved as follows:
"FIRST: PARTIALLY ACCEPT the claim filed by the CIVIO CITIZEN FOUNDATION, filed
on November 27, 2018, against the MINISTRY FOR ECOLOGICAL TRANSITION.
" SECOND: URGE the MINISTRY FOR ECOLOGICAL TRANSITION to send the claimant, within a maximum period of 10 business days, the following information regarding the online application that will allow the relevant marketer to verify that the social voucher applicant meets the requirements to be considered a vulnerable consumer:
- The technical specification of said application.
- The results of the tests carried out to verify that the implemented application meets the functional specification.
- Any other deliverables that allow understanding the operation of the application.
THIRD: URGE the MINISTRY FOR ECOLOGICAL TRANSITION to send this Transparency Council, within the same period, a copy of the information sent to the claimant.
In summary, the CTBG analyzed the limits contemplated in Article 14.1, letters a) and d) (national security and public safety) and rejected their application in the present case. On the contrary, it did consider that the source code was protected by intellectual property rights (limited by Article 14.1.j of the LTAIBG) and ultimately partially granted the claim.
4. In ordinary proceedings number 18/2019, brought in the first instance before the Central Administrative Court No. 8, the appellant requested a declaration of its right to access the requested information and an order for its delivery, which was limited to access to the source code, as access to the rest of the requested information had been granted by the Transparency and Good Governance Council (CTBG).
7
JURISPRUDENCE
The contentious-administrative appeal was dismissed by the judgment of December 30, 2021,
issued by the Central Administrative Court No. 8, based on the following
reasoning:
After transcribing Article 8 of Royal Decree 897/2017, of October 6, which regulates the status of the
vulnerable consumer, the social bonus, and other protection measures for domestic consumers of electricity, and Article 6 of Order ETU 943/2017, of October 6, on the mechanism for verifying the requirements to be a vulnerable consumer, the judgment of the Central Administrative Court No. 8 concludes the following:
"Applying the immediately transcribed provisions to the present case, we must consider that the
MINISTRY FOR THE TRANSITION ECOLOGY, upon recognizing the right to the social bonus, adjusts its actions to this regulation, issuing the corresponding administrative act. To do so, it uses a computer application, called the "BOSCO information system," which is part of a phase of the administrative procedure whose purpose is to verify compliance with the requirements previously established by the aforementioned regulations.
Considering the above, the administrative act cannot be considered to be issued by a computer application,
but rather by an administrative body, and if the recipient of said act disagrees with it,
they may challenge it through administrative and judicial channels.
Therefore, the legality of the administrative act is not justified by the computer application that
is instrumentally used in a phase of the corresponding administrative procedure, but by the regulations
that govern the matter. Next, after reproducing part of the report provided by the Ministry for Ecological Transition along with its response to the complaint, issued on December 4, 2019, by the Deputy Director General of Information and Communications Technologies of the Ministry of Industry, Trade, and Tourism regarding the security of the aforementioned software application, which was the subject of clarification and contradiction at the hearing held in court, the Court states that, in compliance with the contested ruling of February 18, 2019, two documents were delivered to the Civio Citizen Foundation. The first is the "Functional Analysis" document, which includes the technical specifications of the application and therefore details what the program does and how it does it. The second document is the "test cases" document, which includes the classification of the situations a potential beneficiary may encounter and how the algorithm would react to each of them. And it adds: "The above documents show how the computer system works, and whether it works correctly. Therefore, the appellant's claim regarding the existence of errors or calculation errors in the application, particularly for certain groups, is unfounded. And in cases of "impossibility of calculation," due to insufficient information about the applicant in the databases connected to the application, the applicant is required to provide documentation, and based on this, it is determined whether or not the applicant is entitled to the social bonus. These are cases in which automatic calculation is not possible through the application, but not cases of denial of the social bonus.
Based on the foregoing, it must be considered that the denial of access to the source code of the computer application does not constitute a violation of the principle of legality, since it can always be verified, ultimately, whether the applicant meets the requirements to be granted the social bonus."
Next, in order to justify that providing the applicant with the source code of the software application would violate the limits on the right of access to public information established by Article 14.1, letters d), g), i), j), and k) of the aforementioned Law 19/2013, the Court makes the following observations regarding the content of the aforementioned report and the clarifications made during the hearing:
"(...) providing the source code would make the application vulnerable to attacks via "zero-day" vulnerabilities or those that have yet to be discovered at the time the software product is built. It also added that these vulnerabilities could be used to access the databases connected to the application, which collect specially protected data, such as the applicant's disability or status as a victim of gender-based violence."
Likewise, from the content of the report issued by the National Cryptologic Center, it deduces that it was improper to provide the appellant entity with the source code, and transcribes the following:
"Ultimately, we can conclude that the disclosure of the source code objectively increases the severity of the vulnerabilities of any computer application. If it also handles classified or sensitive government information, knowledge of the source code increases the risk that the exploitation of the vulnerabilities could affect national security, public safety, or the security of those governed."
Finally, the Court's ruling concludes that:
"It must also be taken into account that the source code of the aforementioned computer application is not included in the intellectual property exclusions mentioned in Article 13 of Royal Legislative Decree 1/1996, of April 12, on intellectual property, a provision invoked by the appellant entity, since said code is not a rule or an administrative act.
" Nor can it be considered that, as alleged by the appellant, the provisions of
Article 31 bis of the aforementioned Royal Legislative Decree 1/1996 have been violated, since providing the source code of the aforementioned computer application does not serve a public safety purpose; on the contrary, public safety is affected by the provision of said code.
It must therefore be considered that there is no regulation requiring the Administration to develop
open source applications or acquire free software.
Finally, the judgment rejects the subsidiary claim made in its written conclusions by the
appellant, regarding being granted access to part of the source code—the part of the code that
is relevant to the decision-making process regarding who is entitled to the social security bonus—arguing that this is a
new claim, not formulated in the complaint.
In the first background, we outlined the reasons set forth in the judgment of April 30, 2024, issued by the Seventh Section of the Administrative Litigation Division of the National Court, as grounds for dismissing the appeal.
In summary, the judgment under appeal dismisses the appeal filed against the judgment of December 30, 2021, issued by the Central Administrative Litigation Court No. 8, which dismissed the administrative appeal filed against the resolution of the Transparency and Good Governance Council of February 18, 2019, considering it inadmissible to provide the source code
under Section 14.1 j) of the LTAIBG, relating to damages to intellectual property, recognizing the Administration's right to the intellectual property of the computer program.
To this end, the appellant adds that the appellant had not disproved that the provision of the source code for the BOSCO application would seriously jeopardize the rights of third parties and violate legal rights protected by the limitations on the right of access to public information in Article 14.1, letters d), g), i), and k) of the LTAIBG. Furthermore, it assumes that vulnerabilities could arise when accessing databases connected to the application, containing specially protected data, and that a guarantee of protection against vulnerabilities is the concealment of the application's source code, so as to prevent a potential attacker from studying the code to discover a zero-day vulnerability. This is supported by the report of the Deputy Director General of Information and Communications Technologies of the Ministry of Industry, Trade, and Tourism, the technical unit that manages the BOSCO information system for MITECO, which had been submitted for cross-examination after a hearing between the parties.
We must therefore proceed to examine the issues raised in the appeal.
SECOND.- Argument of the appellant.
The appellant's legal representative, Fundación Ciudadana Civio, puts forward the following arguments in support of its appeal:
A/ Regarding the interpretation of the limit on access to public information consisting of intellectual property contained in Article 14.1.j) of the LTAIBG and its application pursuant to Section 2 of said Article 14.
The Court of First Instance interprets Article 14.1.j) of the LTAIBG as contrary to the right of access recognized in Article 105.b) of the Spanish Constitution (EC), ignoring the provisions of Article 14.2 of said law. It considers this limit to be absolute, rather than proportionate to its object and purpose.
There is a public interest in accessing the source code to understand how the decision to grant or reject the social bonus is made and to verify whether there are errors in said decision. This must prevail over the limits, which becomes especially relevant when the owner of the intellectual property is a Public Administration. This expansive interpretation of the limit of Article 14.1.j) of the LTAIBG leads, in practice, to impeding the right of access to most of the Administration's documentary production, since, except for the limited scope of Article 13 of the TRLPI, the rest is always protected by intellectual property rights, particularly copyright (Articles 10 and 12 of the TRLPI).
9
CASE LAW
This consequence of the hypertrophy of the limit of Article 14.1.j) of the LTAIBG constitutes a detriment to various general interests: (i) it renders the right of access to a vast amount of informational production of those obliged to transparency inoperative; (ii) it unjustifiably and disproportionately limits freedom of thought due to a lack of access to relevant information "on which to reflect," the freedom to receive and request information, recognized in Article 19 of the Universal Declaration of Human Rights; (iii) it affects the right to participation in public affairs recognized in various national and international precepts (Articles 1 TEU, 42 CFREU, and 23.1 EC); (iv) it violates the right to legal certainty (Article 9.3 EC) of the persons covered by the system, since, when dealing with a rights allocation system such as the BOSCO application, without access to the source code, it is impossible, or at least extremely difficult, to have knowledge of the parameters used by the Administration to make its decision. Furthermore, the BOSCO program regulations do not contemplate any intervention by the Administration in the process of recognizing the legal status of vulnerable consumers, but rather the program itself makes the decision; and (v) it impedes legality control. of the actions of the Administration by the Courts and Tribunals (Article 106.1 CE).
In this regard, errors have been detected in the case of widows, where the application denied the social security bonus, and in the case of large families, where the application requested informed consent not provided for in the legal regulation. Accessing the code would allow us to verify whether there are any other errors in addition to these.
Notwithstanding the foregoing, the software in question, developed by the Administration itself, complies with Article 13 of Royal Legislative Decree 1/1996, of April 12, approving the revised text of the Intellectual Property Law (TRLPI), which must be systematically interpreted with Article 14.1.j) of the LTAIBG, so this limitation cannot be applied. This is because the program—whose source code is sought to be accessed—is used to exercise administrative powers (recognition or denial of rights), and therefore constitutes a "formal administrative decision" by "translating" the current regulations into a formula written in computer language, acting as the authentic regulation that will apply specifically to each applicant for the social bonus.
B/ Regarding the interpretation of Article 16 of the LTAIBG, regarding the mandatory application of partial access to public information.
Partial access to public information, requested in the written conclusions and rejected, is not a new claim with respect to full access, so it was not necessary to request it as an accessory or subsidiary.
Partial access is an obligation imposed by Article 16 of the LTAIBG on the Administration when any limitation of Article 14 of the LTAIBG is applicable and does not affect all of the information, provided that the two exceptions provided for are not met: the information being distorted or meaningless.
Therefore, it is not possible to interpret Article 14.1 of the LTAIBG without taking into account Article 16. Partial access is included in the request for full access, and therefore, it is not necessary to make an ancillary request to obtain partial access, since doing so would constitute a formality contrary to the principles governing access to public information.
Furthermore, the burden of proof as to why the information cannot be provided partially rests with the Administration, in particular, justifying that it was not possible to provide the appellant with the part of the code consisting of the decision-making algorithm. This partial surrender was finalized in
the hearing of the appeal, as a subsidiary claim, for access to the part or line of the application code that makes the decision, in order to verify that the parameters included in the law are described in the computer code.
C/ Regarding the interpretation of the inclusion of the limits of Article 14 of the LTAIBG throughout the proceedings.
The resolution of the Transparency and Good Governance Council (CTBG) established the debate that will later be raised in the contentious-administrative appeal, and prior to said resolution, the Administration had the opportunity to present and demonstrate the facts and evidence of the limits of Article 14.1 of the LTAIBG.
However, the Administration introduced novel exceptions in court (sections d), g), i), and k) of Article 14.1 of the LTAIBG), a position that is contrary to Article 24.1 of the Spanish Constitution.
Consequently, this procedure must address only the limit of Article 14.1.j) of the LTAIBG and not any others.
THIRD.- Position of the respondent.
10
JURISPRUDENCE
The State Attorney's Office bases its opposition to the appeal on the following grounds:
A/ Regarding the consistency of the debate.
The Ministry formally invoked other limits before the CTBG, in addition to the limit relating to intellectual property, so its discussion was already included in the debate from that moment on.
The CTBG's resolution also analyzed the limits indicated in Article 14.1, letters a) and d) (national security and public safety), although it rejected their application in the present case, considering, on the contrary, that the limit relating to intellectual property rights in Article 14.1.j) of the LTAIBG was applicable and granted access to the requested information, except for the source code.
Furthermore, this debate was also heard before the Central Administrative Litigation Court and before the Administrative Litigation Division of the National Court.
Therefore, the appellant's claim that the appeal for cassation may only address the interpretation and scope of the limit relating to intellectual property, contemplated in Article 14.1.j) of the LTAIBG, to the exclusion of any other, is groundless, as these have been part of the debate both in the administrative and judicial channels.
B/ Regarding the admissibility of applying the limit of Article 14.1.d) of the LTAIBG, referring to public safety.
The assessment of the evidence carried out by the Central Court at first instance, upheld on appeal, is not subject to review in cassation and has led to the denial of access to the source code of the software application.
Particularly significant is the National Court's explanation, detailing the security risks that granting the requested access would entail. These include those that directly and immediately affect the Administration's own functioning and the security of its assets, and those that indirectly affect the particularly sensitive personal data of social voucher applicants. This requires that the provisions of Article 15 of the LTAIBG also be taken into account.
C/ Application of the limit relating to intellectual property in Article 14.1.j) of the LTAIBG.
The appellant's refusal to apply the limit relating to intellectual property is challenged by the following:
- that the application of the BOSCO clearly does not have the nature of an administrative act, much less a general provision of regulatory force. This is an instrumental application
to enable electricity marketing companies to verify, without impairing the consumer's right to privacy more than strictly necessary, whether the consumer meets the legal and regulatory requirements for being considered a vulnerable consumer;
- that, on the contrary, the BOSCO application is a computer program, specifically included among creations that may be subject to intellectual property (Articles 10.1.i) and 95 et seq.
of the TRLPI);
- that the requirements for being considered a "vulnerable consumer" are regulated and specified
in Article 45 of the Electricity Sector Law and in Articles 3 et seq. of Royal Decree 897/2017, not in the computer application;
- It is therefore not true that without access to the application's source code, it is impossible to know
the parameters used by the Administration to make its decision, nor can the courts exercise their jurisdictional function and review the legality of the administrative action. In cases where the interested party disagrees with the denial of recognition of vulnerable consumer status, they must prove that they meet the legally established requirements, comparing their duly accredited personal circumstances with the conditions regulated in the provisions just mentioned, not that the application has malfunctioned in their case; - that, contrary to what is stated in the appeal, the real, direct, and substantial risks that the disclosure of the application's source code may entail have been proven, not only for the program's operation and, consequently, for administrative action, but also for the applicants' particularly sensitive personal data that are subject to verification through the application (income level, family and employment status, status as a victim of gender-based violence or as a victim of terrorism, degree of disability, etc.); 11
CASE LAW
- that denying an individual access to the source code cannot be contrary to the provisions of Article 157 of Law 40/2015 because the reuse of systems and applications regulated by this provision is limited to the scope of relations between public administrations, and because the declaration of open source is viewed as a mere possibility, subject to the condition that it results in greater transparency in the functioning of the public administration or that it fosters the incorporation of citizens into the information society. In the present case, there is no such declaration, nor has the appellant justified the existence of any of the aforementioned circumstances.
D/ Regarding the interpretation of the meaning and scope of partial access referred to in Article 16 of the LTAIBG.
The appellant merely expresses its disagreement with the Central Court's decision (upheld by the
National Court) to reject its claim for partial access ab initio, having formulated it in the written conclusions, but offers no argument that would even allow for an assessment of whether, given the limits relating to public safety and intellectual property, it was possible to recognize in its favor a right of partial access.
The reasons of public safety and intellectual property are predicated on the application in its entirety,
without the appellant having offered any indication of which part or parts of it could be accessible without compromising the aforementioned limits.
For all these reasons, the judgment should declare the appeal inadmissible, confirming that the right of access to public information does not cover the disclosure of the source code of the BOSCO software application, due to reasons of public safety and intellectual property protection.
FOURTH.- Issue of cassation interest and applicable legal provisions. The regulatory framework and jurisprudence applicable to the resolution of the cassation appeal.
As we saw in the second background, the ruling of the First Section of this Court dated November 27, 2024, indicates that the issue of objective cassation interest for the formation of jurisprudence consists of determining whether it is appropriate—or not—to provide the source code of the software application to determine whether the requirements for eligibility for the social bonus are met.
The ruling identifies the legal provisions that must be interpreted: Articles 14.1 and 2, and 16 of Law 19/2013, of December 9, on transparency, access to public information, and good governance. This is without prejudice,
the ruling itself states, to the possibility that the judgment may be extended to other cases if the debate ultimately engaged in the appeal so requires, in accordance with the provisions of Article 90.4 of the Law Regulating Administrative Jurisdiction.
In this sense, the weighing of interests required by the application of limits on access to public information makes it necessary to also consider rules other than those indicated in the admission order, as is evident below.
Having raised the cassation debate in the terms just outlined, we set out below the applicable regulatory framework and jurisprudence.
A/ Regulatory Framework.
1. Regarding the right of access to public information.
The Charter of Fundamental Rights of the European Union recognizes the right of access to documents of the institutions of the European Union in the following terms:
"Article 42. Right of access to documents.
" Every citizen of the Union and every natural or legal person residing or having its registered office in a Member State has the right to access documents of the institutions, bodies, offices, and agencies of the Union, regardless of their medium.
Organic Law 1/2008, of July 30, authorizing Spain's ratification of the Lisbon Treaty, which amends the Treaty on European Union and the Treaty Establishing the European Community, signed in Lisbon on December 13, 2007, establishes the following:
"Article 2. Charter of Fundamental Rights of the European Union.
" Pursuant to the provisions of the second paragraph of Article 10 of the Spanish Constitution and paragraph 8 of Article 1 of the Lisbon Treaty, the rules relating to the fundamental rights and freedoms recognized by the Constitution shall also be interpreted in accordance with the provisions of the Charter of Fundamental Rights published in the Official Journal of the European Union on December 14, 2007, the full text of which is reproduced below: [...].
Article 105.b) of the Spanish Constitution provides:
"The law shall regulate:
(...)
b) Citizens' access to administrative archives and records, except for matters affecting the security and defense of the State, the investigation of crimes, and the privacy of individuals."
Law 19/2013, of December 9, on Transparency, Access to Public Information, and Good Governance (LTIPBG), which concerns us now, recognizes and guarantees access to information, based on the provision contained in Article 105.b) of our constitutional text, which is developed by it, in the following terms:
Article 13. Public Information.
Public information is understood to mean the content or documents, regardless of their format or medium,
that are in the possession of any of the subjects included within the scope of this title and that have been
prepared or acquired in the exercise of their functions.
Article 14. Limits to the right of access.
1. The right of access may be limited when accessing the information would be detrimental to:
a) National security.
b) Defense.
c) Foreign relations.
d) Public security.
e) The prevention, investigation, and punishment of criminal, administrative, or disciplinary offenses.
f) The equality of the parties in judicial proceedings and effective judicial protection.
g) The administrative functions of surveillance, inspection, and control.
h) Economic and commercial interests.
i) Economic and monetary policy.
j) Professional secrecy and intellectual and industrial property.
k) The guarantee of confidentiality or the required secrecy in decision-making processes.
l) Environmental protection.
2. The application of limits shall be justified and proportionate to their object and purpose of protection and shall take into account the circumstances of the specific case, especially the existence of an overriding public or private interest that justifies access.
3. Resolutions issued pursuant to this article pursuant to Section 2 shall be made public, subject to prior dissociation of the personal data they contain and without prejudice to the provisions of Section 3 of Article 20, once they have been notified to the interested parties.
Article 15. Protection of Personal Data.
1. If the requested information contains personal data that reveals ideology, union affiliation, religion, or beliefs, access may only be authorized with the express written consent of the data subject, unless the data subject has clearly made the data public prior to the request for access.
If the information includes personal data referring to racial origin, health, or sexual orientation,
includes genetic or biometric data, or contains data relating to the commission of criminal or administrative offenses that do not entail a public reprimand for the offender, access may only be authorized with the express consent of the affected party or if it is protected by a law.
2. As a general rule, and unless in the specific case the protection of personal data or other constitutionally protected rights prevail over the public interest in disclosure that prevents it, access to information containing merely identifying data related to the organization, operation, or public activity of the body will be granted.
13
JURISPRUDENCE
... 3. When the requested information does not contain specially protected data, the body to which the request is addressed shall grant access after sufficiently reasoned consideration of the public interest in the disclosure of the information and the rights of the data subjects whose data appear in the requested information, in particular their fundamental right to the protection of personal data.
In carrying out this consideration, the body shall specifically take into consideration the following criteria:
a) The least harm to the data subjects resulting from the passing of the time periods established in Article 57 of Law 16/1985, of June 25, on Spanish Historical Heritage.
b) The applicants' justification for their request is the exercise of a right or the fact that they are researchers and justify access for historical, scientific, or statistical purposes.
c) The least harm to the rights of the data subjects if the documents only contain data that merely identifies them.
d) The greatest possible guarantee of the rights of those affected if the data contained in the document
may affect their privacy or security, or relate to minors.
4. The provisions of the preceding paragraphs shall not apply if access is granted after dissociating the personal data in such a way as to prevent the identification of the affected individuals.
5. Personal data protection regulations shall apply to the subsequent processing of data obtained
through the exercise of the right of access.
Article 16. Partial access.
In cases where the application of any of the limits provided for in Article 14 does not affect all of the information, partial access shall be granted after omitting the information affected by the limit, unless this results in distorted or meaningless information. In this case, the applicant must be informed
that part of the information has been omitted.
2.- Regarding the social bonus.
In order to facilitate understanding of the issues we will address below in the resolution of the appeal, it is appropriate to make some general considerations regarding the social bonus,
for whose recognition the computer application subject to the access request (BOSCO) is used.
The regulation of the social bonus is found, substantially, in Articles 45 and 45 bis of Law 24/2013,
of December 26, on the Electricity Sector (LSE), in Articles 3 to 8 and the second transitional provision of Royal Decree 897/2017, of October 6, which regulates the status of the vulnerable consumer, the social bonus, and other protection measures for domestic electricity consumers, and in Order
ETU/943/2017, of October 6, which implements this Royal Decree.
This regulation provides consumer protection measures dedicated to vulnerable consumers and the fight against energy poverty.
Article 45 of Law 24/2013, of December 26, on the Electricity Sector (LSE) creates the category of "vulnerable consumers" and provides for the application of a discount on their electricity bill.
Referring to the regulatory development the definition of the categories and the requirements that must be met,
referring to social characteristics, consumption, and purchasing power, as well as limiting the possibility of discounts exclusively to individuals living in their primary residence.These vulnerable consumers are recognized as having the right to a reduced rate compared to the voluntary price for small consumers (PVPC)—known as the last resort tariff (TUR)—(Articles 17 and 45 of the LSE). Thus, the social bonus, considered a public service obligation—assumed by those involved in the electricity sector engaged in activities related to the supply of electricity, including the production, transportation, distribution, and marketing of electricity, and by direct consumers in the market—covers the difference between the value of the voluntary price for small consumers and the price that must be applied by the marketer to vulnerable consumers' bills. In addition, measures are established to ensure adequate protection for these consumers, establishing
the minimum vital supply, applicable to vulnerable consumers who have defaulted on their bills (Article 45 bis of the LSE), and limiting the possibilities of cutting off supply in homes
receiving the social bonus when they fail to pay their electricity bill (Article 52 of the LSE).
The regulatory implementation of these legal provisions was carried out by Royal Decree 897/2017, of October 6,
which regulates the status of the vulnerable consumer, the social bonus, and other protection measures for domestic electricity consumers.
This regulation establishes the requirements that vulnerable and severely vulnerable consumers must meet, taking into account their social characteristics, consumption, and income level, as well as the procedure for consumers to apply for the social bonus and for the reference marketer to verify compliance with these requirements through the corresponding electronic application—available on the website of the Ministry of Energy, Tourism, and Digital Agenda—with the aim of ensuring that the social bonus coverage effectively serves all consumers who truly need it—people at risk of energy poverty in Spain. Specifically, the aforementioned royal decree defines the vulnerable consumer as a specific income threshold referenced to the Public Indicator of Multiple Effects Income (IPREM), which takes into account, where applicable, the number of members in the family unit. This threshold may be increased if certain special circumstances affecting the consumer or one of the family unit members are proven (disability, victim of gender-based violence, victim of terrorism, dependency, sole parent caring for the child, and electrodependency).
Additionally, certain groups are considered eligible to receive the social bonus, regardless of their income level, such as large families, Social Security pensioners due to retirement or permanent disability who receive the minimum pension, and beneficiaries of the Minimum Living Income.
Likewise, within the vulnerable category, a higher social bonus is established for severely vulnerable consumers (with a 35 percent discount applied to the PVPC energy bill for the former and a 50 percent discount for the latter), defined based on income thresholds lower than the general thresholds. Likewise, within severely vulnerable consumers, a new category of consumers at risk of social exclusion is created. These consumers are those who, while meeting the established income thresholds, due to their special characteristics, are being served by the social services of a regional or local government under the terms established in the Royal Decree. Royal Decree 897/2017 (Article 7) authorizes the Minister to detail, in order, the terms under which consumers who own supply points may apply for the social bonus, and in particular, to establish the social bonus application form that the consumer must submit to the reference marketer, the documentation proving compliance with the requirements, the criteria for calculating the income requirement, and the mechanisms for verifying the requirements established in the Royal Decree for being a vulnerable and severely vulnerable consumer and, therefore, receiving the social bonus. Furthermore, it provides for the creation of a computer platform available on the Ministry's electronic headquarters, through which the reference marketer must verify the data provided by the consumer in their application for the social bonus, and regulates the procedure to be followed, which culminates in the marketer notifying the applicant of the results of the checks carried out for the application of the social bonus (granting, denial, or non-admission). In this regard, it is stipulated that if there are discrepancies in both the accreditation of requirements and the application of the social bonus, consumers may file a complaint with the corresponding consumer services departments, under the terms established by consumer protection regulations (Article 8). Order ETU/943/2017, of October 6, develops Royal Decree 897/2017, of October 6, and specifies, among other aspects, the manner in which marketing companies must operate to use the computer application, as follows:
Article 6. Mechanism for verifying the requirements to be a vulnerable consumer.
1. Once the complete application has been received from the consumer, accompanied by the supporting documentation as provided in Article 2.7, the COR, within a maximum period of 5 business days, will enter the data corresponding to the consumer and, where applicable, the members of the household declared by the consumer into the online application available on the website of the Ministry for the Ecological Transition and the Demographic Challenge.
If the application is incomplete, the retailer will contact the consumer within a maximum period of 15 business days from receipt, indicating the missing portion of the application or the supporting documentation.
15
JURISPRUDENCE
After this period for correction has elapsed without any correction, and if there is no express consent from the owner or, where applicable, from all members of the household over the age of 14 and with legal capacity, as declared by the applicant, the application cannot be processed.
In this case, the applicant will be informed that their application has been rejected.
If this correction period has elapsed without any correction being made, if there are discrepancies between the information provided in the application and the data contained in the family record book(s) and/or birth certificate(s) and/or marriage certificate(s) and/or certificate proving registration as a de facto couple and/or a judicial or administrative ruling proving foster care provided by the applicant and in the registration certificate, the COR will reject the application and will expressly indicate the reason for such rejection in its communication to the interested party. If this correction period has elapsed without any correction being made, if there are discrepancies between the application and the supporting documentation in all other cases, provided that they do not prevent the application of the social bonus, even in other different modalities or with different income thresholds, the COR will process said application, informing the applicant of the type of social bonus applied and the uncorrected requirement.
In the event of discrepancies in both the accreditation of the requirements and the application of the social bonus, consumers may file a complaint with the corresponding consumer services departments, under the terms established by consumer protection regulations.
2. In the case of large families, the provisions of section 1 will be applied only in the case of verification of the requirements for severe vulnerability.
3. Likewise, if the application has declared, and if applicable, the certificate or other valid document proving this has been provided, that any of the special circumstances determined in Article 3.3 of Royal Decree 897/2017, of October 6, regulating the vulnerable consumer, the social bonus, and other protection measures for domestic electricity consumers are met, the COR will indicate this fact in the spaces provided in the application for this purpose. 4. Through the implemented online application, within a maximum period of 5 business days, the COR will view the results of the checks performed, both for the vulnerable and severely vulnerable consumer status. This will be displayed in a field indicating "MEETS THE REQUIREMENTS TO BE CONSIDERED A VULNERABLE/SEVERELY VULNERABLE CONSUMER" or "DOES NOT MEET THE REQUIREMENTS TO BE CONSIDERED A VULNERABLE/SEVERELY VULNERABLE CONSUMER."
The application will indicate, where applicable, the impossibility of performing this check. In this case, the COR will reject the application and expressly indicate the reason for the rejection in its communication to the interested party.
5. Once the COR has verified that the consumer meets the requirements for the social bonus, it will notify the interested party, indicating the date from which it will proceed to apply.
B/ Applicable Jurisprudence.
1.- The nature of the right of access to public information.
STC 164/2021, of October 4, on the content of Article 105.b) of the Spanish Constitution (Legal Judgment 3) states:
"Article 105 b) of the Spanish Constitution, framed within Title IV, "On the Government and the Administration," incorporates an objective principle governing the actions of public administrations (Article 103.1 of the Spanish Constitution), derived from the requirements of democracy and transparency, as well as a subjective right of individuals, exercisable against public administrations, with subjects, object, and limits defined in the constitutional provision itself, which was initially developed in Articles 35 h) and 37 of Law 30/1992, of November 26, on the legal regime of public administrations and common administrative procedure, and currently in Law 19/2013, of December 9, on transparency, access to public information, and good governance. This law complements the previous sectoral regulatory specifications, which include, in the penitentiary field, Article 15.2 of the LOGP and its implementing regulations [Articles 4.2 k) and 18.1 RP], constituting, in the words of STS (Third Chamber, Third Section) 66/2021, of January 25, legal basis 4.5, "the basic transversal regulation that governs this matter, while complementing the rest of the regulations" whose provisions "are displaced, acting in this case as supplementary, when another legal regulation has established its own specific legal regime for access to information," in accordance with the provisions of its first additional provision.
In view of the foregoing, it should be noted that access to information constitutes a subjective public right exercisable against the administration. While not absolute, it can only be limited for reasons predetermined by law, based on a prior weighing of the interests at stake. Thus, the possibility of limiting access to information does not constitute a discretionary power of the administration.
The Supreme Court ruling of May 29, 2024 (rec. 1262/2023), FJ 4.1, links the right of access to public information with the principle of administrative transparency and the right to good administration recognized in Article 41 of the Charter of Fundamental Rights of the European Union:
"1. The right of citizens to access administrative archives and records, as set forth in Article 105.b) of the Spanish Constitution, constitutes a manifestation of the principle of administrative transparency and, along with others, constitutes one of the so-called "latest generation rights," the right to good administration contained in Article 41 of the Charter of Fundamental Rights of the European Union. Paragraph 2 of the right to good administration includes, in particular: "b) the right of every person to access the file that concerns them, while respecting the legitimate interests of confidentiality and professional and commercial secrecy."
The Supreme Court ruling of November 14, 2000 (appeal 4618/1996) clearly states this: "FIFTH.- The right of access to administrative records and documents constitutes a right of citizens of the so-called third generation. It is rooted in the principle of administrative transparency, which responds to a new structuring of the relationship between the Administration and citizens. This right is recognized by the Constitution in Article 105.b), according to which: "The law shall regulate: a) The hearing of citizens, directly or through organizations and associations recognized by law, in the process of drafting administrative provisions that affect them [...]."
Although this provision could be thought to condition the application of this right to its legislative development, the Constitutional Court, considering its substantive value, has held, in application of the principle of the direct normative force of the Constitution, that this provision is directly applicable without the need to wait for its legislative development, which has been carried out basically in Article 37 of Law 30/1992, of November 26, on the Legal Regime of Public Administrations and the Common Administrative Procedure. Indeed, Constitutional Court ruling 18/1981, of June 8, states that "the reservation of law made on this point [the case contemplated refers to section c) of the article] by Article 105 of the Fundamental Law does not have the meaning of deferring the application of fundamental rights and public freedoms until a law subsequent to the Constitution is enacted, since in any case its principles are immediately applicable." It is, therefore, evident that, in direct application of the constitutional norm, this right requires, in order to respect its essential core, composed of the set of powers that make it recognizable and the effectiveness of the interests of the citizen to which it corresponds, that it be done to a reasonable degree accessible to Individuals,
overcoming the limitations arising from their position of material inferiority vis-à-vis public authorities,
to acquire knowledge of data and documents that may legitimately interest them, with no limitations other than those established in the constitutional provision itself ("with regard to matters affecting the security and defense of the State,
the investigation of crimes, and the privacy of individuals") and those derived from the general rules of procedure and the principles of proportionality, rationality, and good faith to which the exercise
of every right must be subject."
The Supreme Court of February 7, 2023 (rec. 8005/2021), FP 5, states the following regarding the nature of the right of access to public information:
"Article 105.b) of the Spanish Constitution, as previously stated, given its systematic characterization and location in the Constitution, does not recognize a fundamental right. It is a subjective right exercisable before the Public Administrations, pursuant to the implementing legal provision, which is Law 19/2013, which is why it does not have the status of an organic law. Article 14 of the aforementioned law establishes the limits that naturally apply in the case examined. This right, as previously stated, falls outside the scope of protection established by Article 53.2 of the Spanish Constitution.
This criterion is reiterated in the Supreme Court rulings of April 21, 2023 (Recital 350/2022) and May 29, 2023 (Recital 373/2022).
The Supreme Court ruling of June 6, 2005 (rec. 68/2002), LC 6, when the law that would develop this right had not yet been enacted, emphasizes that it is a constitutionally recognized right that has its own effective content: "[...] we must bear in mind that the appellant invokes a constitutionally recognized right. And that, although Article 105 b) of the Constitution defers its regulation to the Law, the normative force of the fundamental text, in the interpretation given to it from the outset by the Constitutional Court (STC 18/1981, of June 8) and subsequently clarified by this Supreme Court [Supreme Court rulings of October 25, 2002 (cassation 2166/1998); November 14, 2000 (cassation 4618/1996); May 12, 1999
17
CASE LAW
(cassation 4956/1993) March 30, 1999 (cassation 6563/1994); June 10, 1996 (appeal 7582/1991
)], has given it its own, effective content that the legislator, and much less the implementer of the law, cannot ignore.
The Supreme Court ruling of March 30, 1999 (rec. 6563/1994) on the relationship between the non-fundamental right of access and other fundamental rights (Legal Notice 3) states:
"THIRD.- Article 105.b of the Constitution provides that the law shall regulate, among other matters, 'Citizens' access to archives and administrative records, except as it affects the security and defense of the State, the investigation of crimes, and the privacy of individuals.' This constitutional provision expressly refers to the legal framework for the exercise of the right of access to archives and administrative records, as a non-fundamental right, although related to the right to political participation, the right to freedom of information, and the right to effective judicial protection. It reflects a conception of information held by public authorities that is in accordance with the principles inherent to the democratic state (insofar as access to public archives and records entails citizen participation and facilitates the exercise of criticism of those in power) and the rule of law (insofar as such access constitutes an indirect procedure for overseeing the administration's submission to the law and allowing more effective oversight of its actions by the contentious-administrative jurisdiction)."
Citing the above, the Supreme Court ruling of December 16, 2011 (rec. 4607/2009) also ruled in the same vein.
2. The limited nature of the right of access to public information: the justified and proportionate application of its limits.
The Supreme Court ruling of November 12, 2020 (rec. 5239/2019), FJ 4, states the following:
"6.- The right of access to public information is not an unlimited or absolute right, in the sense that it guarantees access to all public information on any subject matter to any person, but is subject to limits that are developed in the articles of the LTAIBG.
" In this regard, Article 14 of the LTAIBG details a list of limits on the right of access, which aim to protect the interests enumerated in the provision, which are the following: a) national security,
b) defense, c) foreign relations, d) public safety, e) the prevention, investigation, and punishment of criminal, administrative, or disciplinary offenses, f) the equality of the parties in judicial proceedings and effective judicial protection, g) administrative, surveillance, inspection, and control functions, h) economic and commercial interests, i) economic and monetary policy, j) professional secrecy and intellectual and industrial property,
k) the guarantee of confidentiality or the secrecy required in decision-making processes, and l) the protection of the environment.
In addition to the aforementioned limits on the right of access to public information, there are those derived from data protection regulations, referred to in Article 15 of the LTAIBG, and those contemplated by the first additional provision of the LTAIBG, which provides, on the one hand, for the application of the regulations governing the corresponding administrative procedure "to access by those who have the status of interested parties in an ongoing administrative procedure" to the documents included therein (section 1), and, on the other hand, for the application of the specific regulations for those matters that have a specific legal regime for access to information (section 2).
[...]
7.- It should also be considered in this appeal that Article 17.3 of the LTAIBG, like the 2009 Council of Europe Convention on Access to Public Documents, embraces the principle that it is not necessary for the applicant to justify the reasons for their request for access to public information. Thus, the
Council of Europe Convention provides in Article 4.1 that "An applicant may not be obliged to give his or her reasons for access to an official document" and, for its part, Article 17.3 of the LTAIBG establishes the following:
"The applicant is not obliged to justify his or her request for access to information. However, he or she may state the reasons for requesting the information, which may be taken into account when making the decision.
However, the lack of justification will not, in and of itself, be grounds for rejecting the application.
It is clear from the provision that the lack of justification or motivation cannot, in and of itself, be grounds for rejecting the application. It follows that the expression in the application of a justification based on "merely private" interests, such as those found in the contested judgment and the ruling of the CTBG in this case, cannot, in and of itself, be grounds for rejecting the application, unless other circumstances exist, such as, for example, the abusive nature of the application not justified for the purposes of transparency of the law, which, as previously stated, constitutes the grounds for inadmissibility under Article 18.3 of the LTAIBG.
The provision's reference to the possibility of stating the reasons for requesting the information must be understood for the purposes of the consideration that must be carried out when the right of access to public information conflicts with other protected rights and assets, such as those indicated in Articles 14 and 15 of the LTAIBG. In this case, it is not possible to assess such a conflict, since neither the contested judgment nor the CTBG resolution noted the presence of any of the rights and assets listed in Article 14 of the LTAIBG, nor did they assess the existence of personal data of third parties protected by the rules of Article 15 of the LTAIBG. This is clear in this case, since the information requested regarding correspondence sent and received only affects the data of the appellant himself. Similarly, and highlighting the importance of Article 16 of the LTAIBG, the Supreme Court ruling of January 25, 2021 (rec. 6387/2019), FJ 3, after reiterating the limited nature of the right of access to public information and the limits contemplated in Article 14 of the LTAIBG, states the following:
"In addition to the aforementioned limits on the right of access to public information, there are those derived from data protection regulations, referred to in Article 15 of the LTAIBG. Also regarding limits, Article 16 of the LTAIBG contemplates the possibility that the application of any of the limits listed in Article 14 may not affect all of the information, in which case partial access must be granted after omitting the information affected by the limit, and informing the applicant of the information that has been omitted.
" The application of limits to the right of access to information is subject to certain requirements and conditions. In this regard, Article 14.2 of the LTAIBG states the following:
2. The application of the limits shall be justified and proportionate to their object and purpose of protection and shall take into account the circumstances of the specific case, especially the existence of an overriding public or private interest that justifies access.
Therefore, the legal provision does not allow a generic application of the limitations as a justification for a denial of access to public information, valid for all proceedings in a specific area, for example, the protection of foreign relations or the protection of the investigation and punishment of criminal offenses in extradition proceedings. Rather, it requires a justified and proportionate application of the limitations in relation to the specific case, and a weighing of the interests at stake must be made: that of access to public information, on the one hand, and that protected by the limitation in question. Along these same lines, the Supreme Court ruling of December 16, 2019 (rec. 316/2018) states that the limits on the right of access to public information established in Articles 14 and 15 of the LTAIBG do not constitute grounds for exclusion from access, but rather justified and proportionate limitations on the right to access, provided that they entail harm to the legal interests or rights it expresses.
In this regard, the Supreme Court ruling of April 8, 2024 (rec. 681/2022), LF 4, states:
"This Court has issued various rulings in which we have established a series of principles or rules of interpretation, in relation to the grounds for inadmissibility or the limits contemplated in the LTAIGB.
" The criterion established by this Court in applying the limits applicable to the right of access under Article 14 of the LTAIBG is its restrictive interpretation, so as not to undermine the right of access broadly regulated in the aforementioned provision, as indicated in the Supreme Court ruling of October 16, 2017 (appeal 75/2017), a criterion subsequently reiterated in the judgments of March 10, 2020 (appeal 8193/2018), June 11, 2020 (appeal 577/2019), November 19, 2020 (appeal 4614/2019), and December 29, 2020 (appeal 7045/2019). We stated at the time:
"[...] The broad formulation in the recognition and legal regulation of the right of access to information requires a strict, if not restrictive, interpretation of both the limitations to that right contemplated in Article 14.1 of Law 19/2013 and the grounds for inadmissibility of information requests listed in Article 18.1. Limitations that constitute an unjustified and disproportionate impairment of the right of access to information cannot be accepted."
The judgment now challenged in cassation refers to our jurisprudential criteria regarding the interpretative guidelines for applying the limits of the right of access. However, it must be specified that any definition of the limits must take into consideration the specific circumstances of the case and adequately weigh the various competing interests.
" The Supreme Court ruling of May 29, 2023 (rec. 373/2022), FJ 4, denies the discretionary nature of the possibility of limiting access:
19
JURISPRUDENCE
"This Court has repeatedly held that the limitations contemplated in Article 14 of Law 19/2013, as well as the grounds for inadmissibility of information requests listed in Article 18, must be interpreted strictly and based on the premise that the right of access to information appears broadly formulated in our legal system, such that only limitations that are justified and proportionate are acceptable. This is clearly stated in Article 14.2 of Law 19/2013 when it states: "(...) 2. The application of the limits shall be justified and proportionate to its object and purpose of protection and shall take into account the circumstances of the specific case, especially the existence of a superior public or private interest that justifies access." Therefore, the possibility of limiting the right of access to information does not constitute a discretionary power of the Administration, since we have seen that it is a broadly recognized right and may only be limited in the cases and under the terms provided for by law. In this regard, see judgments of this Court 1547/2017, of October 16 (cassation 75/2017, F.J. 5), 66/2021, of January 25 (cassation 6387/2019, F.J. 4), among others. FIFTH.- The Court's opinion on the inclusion of limits on access to information during the judicial proceedings that were not appreciated by the Transparency and Good Governance Council.
Altering the order followed by the appellant in the presentation of its arguments in the cassation appeal ruling, we will begin by addressing the issue regarding the inclusion by the defendant Administration during the judicial proceedings of limits on access to information that were not appreciated by the Transparency and Good Governance Council (CTBG) in the administrative resolution appealed at the first instance.
The appellant foundation maintains that in the judicial proceedings, limits on access to information, provided for in Article 14 of the LTAIBG, cannot be incorporated into the debate, as the Transparency and Good Governance Council did not appreciate their existence, as they are contrary to Article 24.1 of the Spanish Constitution.
Based on this allegation, the Court claims that the appeal for cassation may only address the interpretation and scope of the limit relating to intellectual property, contemplated in Article 14.1.j) of the LTAIBG and assessed by the Transparency and Good Governance Council, to the exclusion of any other, even if they have been part of the debate both in the administrative and judicial channels.
The State Attorney's Office is right when it asserts that this claim is unfounded for the reasons set out below.
First, it should be noted that both administratively, before the Transparency Council, and judicially, before the Central Administrative Litigation Court and the Administrative Litigation Chamber of the National Court, the debate about the limits on access to public information applicable to this case focused not only on the provisions of Article 14, paragraph 1, letter j) of the LTAIBG (intellectual property), but also on those provisions of letters a) and d) (national security and public security). Secondly, Article 56 of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction (LJCA), by providing that: "The facts, legal grounds, and claims raised shall be recorded in due separation in the complaint and defense briefs, and any relevant grounds may be raised in support of these briefs, whether or not they have been raised before the Administration." This law authorizes the parties to incorporate into the procedural debate any grounds for challenging or defending the legality of the administrative action that may be appropriate, regardless of whether they were invoked in the administrative proceedings. Third, this legal provision is consistent with the provisions of Article 60.2 of the LJCA, which allows the appellant to request the admission of evidence and state the means of evidence they intend to request, when the response to the complaint reveals new facts of relevance to the resolution of the lawsuit, within five days of the day on which it is served, in order to safeguard their right to defense.
This also applies to the power granted to the Judge or Court to submit to the parties the existence of grounds
that could justify the appeal or opposition, not alleged by the parties, thus incorporating them into the procedural debate, a power contemplated in Articles 33.2 and 65.2 of the LJCA.
Therefore, generally speaking, the fact that the defendant in a contentious-administrative proceeding raises new grounds in its response to the complaint to oppose the plaintiff's claim, even if they are also based on new facts, does not constitute a violation of the procedural rules provided for in the Jurisdictional Law, nor, consequently, does it harm the plaintiff's right to defense or effective judicial protection. In such cases, the parties have the opportunity to formulate any allegations they deem appropriate regarding their existence and to propose any evidence they deem relevant in defense of their rights and legitimate interests.
20
CASE LAW
This consideration is not undermined by the fact that the CTBG did not accept or rejected one or more of the limits alleged by the State Attorney's Office regarding access to public information requested by the Civio Citizen Foundation through administrative proceedings. The CTBG resolution, which partially granted the appellant foundation's access claim, constitutes the administrative act subsequently challenged in contentious-administrative proceedings, where the legality review to which it is subject by this jurisdiction cannot be constrained by the limits on access to public information established in the administrative resolution and may apply to other measures whose application was rejected in administrative proceedings. In this regard, we ruled in the judgment of this Chamber of the Supreme Court of May 26, 2011 (rec. 5991/2007), FJ 2, when, in connection with the allegation of procedural deviation from the decision made in the administrative proceedings due to the judicial confirmation of the administrative resolution based on reasons that do not coincide with those adduced at the time by the Administration, we stated that such deviation only "occurs when, in court, the plaintiff raises claims that he did not raise in the administrative proceedings, or when the Administration seeks a different and more burdensome ruling than the one it itself made in its ruling." And we argued that if the Procedural Law, in the interpretation "directly inspired by the legislator's will as stated in the Statement of Reasons for the Law, allows the plaintiff to raise arguments and issues in the proceedings that it had not raised in the administrative proceedings, overcoming the traditional and restricted conception of the contentious-administrative appeal as a merely reviewing instance must also lead to the Administration being able to support its actions with reasons other than those it presented in the administrative proceedings." We added in the Supreme Court ruling of May 6, 2013 (rec. 3953/2010), FJ 4, that no inconsistency can be found in the judicial decision: "when the court resolves the appeal within the terms of the debate raised by the parties, both in the complaint and in the response, even when the legal allegations or arguments are different from those used in the administrative proceedings, either to establish the illegality of the administrative decision or to uphold its legal conformity. As we stated in our Supreme Court ruling, Third Chamber, Sixth Section, dated February 7, 2013 (3846/2010), "the possibility of hearing in a court of law grounds not raised in the administrative proceedings is a consequence of overcoming the reviewing nature of the contentious-administrative jurisdiction, which prevented new issues from being raised before it.
In this way, just as the appellant may base his claim in the court of law on new grounds,
different from those adduced in the administrative proceedings, the Administration may also allege new arguments in support of the legality of the administrative action without being strictly bound by the reasons on which it based the administrative resolution. Therefore, Article 56.1 of the Law regulating this Jurisdiction establishes that "in the written statement of claim and the written statement of defense, the facts, the legal grounds, and the claims that are brought, in support of which any appropriate grounds may be alleged, whether or not they have been raised before the Administration." From this we conclude that it is possible to incorporate new allegations, arguments, or grounds into the complaint and the response, provided that the claim is not altered. This conclusion is consistent with the doctrine of the Constitutional Court, which has ruled on the full nature of contentious-administrative jurisdiction and the lack of strict connection to the grounds alleged in the administrative procedure if the right to effective judicial protection is to be respected. Furthermore, we have declared that this does not violate the prohibition of pejorative reform that is part of the right to effective judicial protection (STC 28/2003, of February 10, FJ 3) since this "occurs when the appellant, by virtue of its own appeal, sees the legal situation created or declared by the contested resolution worsened or aggravated, such that obtained with the judicial decision resolving the appeal produces
an effect contrary to that intended by the appellant, which was precisely to eliminate or reduce the burden suffered
by the decision being challenged" [see STS of March 11, 2016 (rec. 2242/2014), FJ 1]. Therefore, "the determination of whether or not there is reformatio in peius must be made by comparing the pronouncements
of the administrative decision and the judgment, not their grounds" [see STS of May 26, 2011 (rec. 5991/2007), FJ 2] such that: "it does not exist when a judicial decision confirms the challenged administrative decision without altering the pre-existing situation of the appellant in relation to the claim being exercised,"
as is the case here, resulting in the fact that "[i]t cannot be understood [...] that a judgment confirming an administrative decision worsens the legal situation that this party had before filing the appeal. The fact that The fact that the judgment used a different argumentative approach than that employed by [the Administration] to reach the same solution does not change the fact that its claim for compensation was rejected both administratively and judicially, and therefore its situation has not worsened [see Supreme Court Judgment of May 6, 2013 (rec. 3953/2010), 3rd Judgment]. Having established the above and turning to the specific case at hand, this Court concludes, contrary to the arguments of the appellant foundation, that there is no obstacle to the judicial debate on the limits applicable to the right of access to public information focusing on those limits that were rejected by the appealed administrative resolution and on those others incorporated into the judicial dispute by the defendant Administration in the proceedings followed at the instance level. It should be noted in this regard that the State Attorney's Office's opposition to the appeal does not introduce into the procedural debate the possible
limits to access to public information that had not been previously raised in the administrative and/or judicial proceedings.
For all these reasons, this Court considers that the allegation in the judicial proceedings—at first instance—of legal limits to access to public information, not accepted by the administrative body that issued the appealed administrative resolution—the Transparency and Good Governance Council—does not in any way undermine the appellant's right of defense.
Consequently, it is not appropriate to limit, as the appellant foundation claims, the cassation debate to the existence of the access limit provided for in Article 14.1.j)—intellectual property—of the LTAIBG, which must also address the other limits alleged by the State Attorney's Office at first instance, reiterated in this cassation appeal.
SIXTH.- The right of access to public information in relation to the computer systems or applications of Public Administrations.
In In resolving the issues raised in the appeal, this Court must begin with the considerations expressed below regarding the constitutional and legal configuration of the right of access to public information and its limits, largely drawn from our constitutional doctrine and jurisprudence, nuanced by the peculiarities implied by the fact that its purpose is a computer application for automated decisions by the public administration and the uniqueness of its purpose being to recognize social rights.
A/ The constitutional configuration of the right of access to public information.
1. General considerations.
The right of access to public information is primarily recognized in Article 105.b) of the Spanish Constitution, which not only incorporates an objective principle governing the actions of public administrations, derived from the requirements of democracy and transparency, but also a subjective right of individuals, exercisable against public administrations, with subjects, object, and limits defined in the constitutional provision itself (see STC). 164/2021, of October 4, FJ 3).
Although we have noted that this is not a fundamental right, given its characterization and systematic location in the Constitution [see Supreme Court rulings of February 7, 2023 (rec. 8005/2021), FJ 5; of April 21, 2023 (rec. 350/2022), FJ 3; and of May 29, 2023 (rec. 373/2022), FJ 3], it is nevertheless configured as a constitutional right, with its own effective content that neither the legislator nor the implementer of the law can ignore [see STC 18/1981, of June 8, FJ 5, and Supreme Court ruling of June 6, 2005 (rec. 68/2002). [FJ 6th], the exercise of which cannot be deferred or mediated by referring to the exercise of procedural actions (see STC 164/2021, of October 4, FJ 3rd), and which is closely linked to the full effectiveness of other constitutional principles and rights.Indeed, the constitutional recognition of this right reflects a conception of information held by public authorities in accordance with the principles inherent to a democratic state, insofar as access to public archives and records entails the power of citizen participation and facilitates criticism of those in power. This right is also consistent with the rule of law, insofar as such access constitutes an indirect procedure for overseeing the administration's submission to the law and allowing for more effective oversight of its actions by the contentious-administrative jurisdiction [see Supreme Court rulings of March 30, 1999 (rec. 6563/1994) and December 16, 2011 (rec. 4607/2009)].
At the same time, constitutional jurisprudence considers it, along with other precepts of the Constitution (Articles 9.2, 23.1, 27, paragraphs 5 and 7, 48, 125, and 129 of the Spanish Constitution), one of the various manifestations contemplated in the constitutional text of the citizen participation phenomenon in today's democracies, and to which our constituent assembly has been particularly sensitive (see Constitutional Court Judgments 119/1995, of July 17, Legislative Decree 4, and 175/2021, of October 25, Legislative Decree 4).
Truly, the right of access to public information transcends its status as an objective principle
guiding the actions of public administrations to constitute an exercisable constitutional right,
as a subjective right, vis-à-vis the public authorities, derived from the demands of democracy and transparency, and
inseparably linked to the democratic rule of law enshrined in Article 1 of our Constitution.
Furthermore, it is also a subjective constitutional right that is closely connected to
fundamental rights and public freedoms, to the extent that its exercise may affect their full
22
CASE LAW
effectiveness, such as the right to political participation (Article 23 of the Spanish Constitution), the right to freedom of information (Article 20 of the Spanish Constitution), and the right to effective judicial protection (Article 24 of the Spanish Constitution). This
close connection is also evident with the principle of legality, embodied in the submission
of public administrations to the law and the law, and its safeguarding through the control that the courts exercise over their actions, as it favors their effective oversight by the contentious-administrative jurisdiction. And, in the field of international law, which operates as an interpretive guideline in accordance with Article 10.2 of the EC, it is worth noting both the express recognition of the right of access to public information as a fundamental right in itself, as is the case in Article 42 of the Charter of Fundamental Rights of the European Union, which provides that: "Every citizen of the Union and every natural or legal person residing or having its registered office in a Member State has the right of access to documents of the institutions, bodies, offices and agencies of the Union, whatever their medium," and its connection and instrumental understanding of the right to freedom of expression and information, as is the case with Article 19.2 of the International Covenant on Civil and Political Rights, signed in New York on December 19, 1966, according to General Comment CCPR/C/GC/34 of the United Nations Human Rights Committee, since that provision that recognizes the right to freedom of expression "enunciates a right of access to "information held by public bodies" (see paragraph 18), and with Article 10 of the European Convention on Human Rights, which recognizes the right to freedom of expression, in accordance with the jurisprudence of the European Court of Human Rights that interprets it, to which we will refer later.
2.- Observations regarding the automated activity of the Public Administration: Principle of algorithmic transparency.
Based on this constitutional and jurisprudential configuration that we have just outlined and will develop further below, we must address the interpretation and application of the legal regulation of the right of access to public information, paying special attention to the novel and complex nuances that the issue raised in this appeal raises, relating to the automated activity of the Administration through computer applications, since, as the Constitutional Court has pointed out on several occasions, "[g]iven that our constitutional text does not enshrine merely theoretical or illusory rights, but rather real and effective ones (STC 12/1994, of January 17, FJ 6), it is essential to ensure their protection not only against traditional interference, but also against the risks that may arise in a technologically advanced society" (see STC 16/2004, of February 23, FJ 3).
The configuration of the right of access to public information that we have outlined takes on special relevance given the risks involved in the use of new technologies in the exercise of public powers or the provision of public services, as is the case with the use of automated decision-making systems in the activities of public administrations, especially when, as is the case here, they are intended to recognize citizens' subjective rights and, even more so, when they involve social rights, attributable to the most disadvantaged citizens or those in need of protection. Of course, the appropriateness of public administrations resorting to automated decision-making systems for the effective performance of their functions or the adequate provision of public services cannot be questioned. However, this must entail demands for transparency in the computerized processes used in such actions, in order to provide citizens with the information necessary for their understanding and knowledge of the basic characteristics of their operation, which may require access to their source code.
Thus, in connection with automated administrative activity, the so-called principle of "algorithmic transparency" arises, which imposes public information obligations on public administrations to facilitate citizens' access, to a greater or lesser extent, to the fundamental characteristics of the algorithms used in decision-making or their source code, as a manifestation of the principle of transparency, enshrined in the Constitution (Article 105.b) of the Spanish Constitution).
Closely related to this principle is a broader concept: "digital or electronic democracy." It emerged as a consequence of the use of digital technologies by governments and citizens, and its development aims to strengthen traditional democratic practices. Digital democracy is not only
a technological extension of representative democracy, but is also the result of a true
structural transformation in the democratic functioning of public authorities, characterized by the
relevance of the principles of transparency, participation, and accountability in a digital environment, where
access to public information and algorithmic transparency play an essential role in guaranteeing it.
23
CASE LAW
In this new digital democratic context, public authorities are required, among other things, to
explain in a comprehensible manner the operation of the algorithms used in decision-making
that affect citizens, allowing them to understand, oversee, and participate in public management.
Before continuing, to facilitate the examination of this matter, it is useful to approach these technical concepts, which are not always easy to understand, by outlining their fundamental features. Let's see:
1. Automated administrative procedures should be understood as "any act or procedure carried out entirely through electronic means by a Public Administration within the framework of an administrative procedure and in which a public employee has not directly intervened," as defined in Article 41.1 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector.
2. Algorithms incorporated into computer applications or programs, according to the Dictionary of the Royal Spanish Academy, are an "ordered and finite set of operations that allow the solution to a problem to be found," that is, a finite group of operations organized in a logical and orderly manner that allow the solution to a specific problem to be reached or a specific task to be performed using a computer. Therefore, they operate through a chain of pre-established instructions that determine the follow-up of certain programmed steps until the intended result is achieved. 3.- The algorithm's source code expresses those operations described in the programming language; that is, it is the specific translation of an algorithm into a programming language that can be understood and executed by a computer. Thus, it constitutes the written representation of the algorithm in a programming language, without prejudice to the fact that the operations described in this way can be translated into human language.
In other words, using the Transparency Council's terms, the source code is the file or set of files that contain a set of very precise instructions, based on a programming language, which is used to compile the various computer programs that use it and allow them to be executed without major problems.
B/ The legal regulation of the right of access to public information and its limits. Special reference to the automated actions of the Public Administration.
The current legal framework for the right of access to public information, as provided for in Article 105.b) of the Spanish Constitution, is contained in Articles 12 to 24 of Law 19/2013, of December 9, on transparency, access to public information, and good governance (LTAIBG), which constitutes the basic cross-cutting legislation governing this matter, while complementing the other regulations. It is superseded, acting in this case as a supplementary provision, when another legal provision has established a specific legal regime for access to information, in accordance with the provisions of the first additional provision, section two, of the LTAIBG (see Supreme Court ruling of January 25, 2021 (rec. 6387/2019), FJ 4.5).
Article 12 of the LTAIBG recognizes the right of all persons to access public information,
understanding this, in accordance with Article 13, as "the contents or documents, regardless of
their format or medium, held by any of the subjects included within the scope of this title and that have been prepared or acquired in the exercise of their functions." We have emphasized that the subjective delimitation of the right is carried out by the Law in very broad terms, recognizing it as "all persons" without further distinctions (see STS of March 25, 2021 (rec. 2578/2020), FJ 3º.4), without the need to justify the request (see STS of November 12, 2020 (rec. 5239/2019), FJ 4º.7), and without, in any case, excluding requests for access based on the private interest that motivates them (see STS of June 2, 2022 (rec. 4116/2020), FJ 2º.1).
This does not mean that it is an unlimited or absolute right, but it can only be limited for the reasons predetermined by law, as found in Articles 14 and 15 of the LTAIBG (see STC 164/2021, of October 4, FJ 3).
The first provision mentioned details a list of limits on the right of access, which are intended to protect the interests enumerated in the article, which are the following: a) national security, b) defense, c) foreign relations, d) public safety, e) the prevention, investigation, and punishment of criminal, administrative, or disciplinary offenses, f) the equality of the parties in judicial proceedings and effective judicial protection, g) administrative, surveillance, inspection, and control functions, h) economic and commercial interests, i) economic and monetary policy, j) professional secrecy and intellectual and industrial property, k) the guarantee of confidentiality or the secrecy required in decision-making processes, and l) environmental protection. 24
JURISPRUDENCE
Section 2 of Article 14 of the LTAIBG specifies that the application of such limits, where appropriate, must be justified and proportionate to their objective and the purpose of protection, taking into account the circumstances of the specific case and, especially, the existence of an overriding public or private interest that justifies access. It follows, as we have had the opportunity to clarify, that the limits contemplated in this provision do not constitute grounds for exclusion (see STS of December 16, 2019 (rec. 316/2018), FJ 4º.C)
nor is the assessment of their existence a discretionary power of the Administration (see STS of May 29, 2023 (rec. 373/2022), FJ 4º), nor is their generic application possible. Rather, they require a weighing of the interests at stake: that of access to public information, on the one hand, and that protected by the limitation in question (see STS of January 25, 2021 (rec. 6387/2019), FJ 4º.8). The aforementioned limits must be interpreted restrictively, so as not to undermine the right of access. Broadly regulated by law (see STS of April 8, 2024 (rec. 681/2022), LF 4).
The principle of good administration also leads to a broad and expansive interpretation of this constitutional right, which entails a restrictive interpretation of the limits applicable to access to public information, regardless of whether its application is justified and proportionate, as we will examine later.
This principle was addressed in our judgment of April 30, 2025 (rec. 1100/2022) in the terms summarized below. It is inferred from Articles 9.3 (which proclaims the constitutional guarantee of
the prohibition of arbitrariness of public powers), 103 (the Public Administration objectively serves
the general interests and acts in accordance with the principles of efficiency, hierarchy, decentralization,
deconcentration, and coordination, with full submission to the law and the law), and 106 of the Spanish Constitution (the Courts
control the legality of administrative action, as well as its subjection to the purposes that justify it). These constitutional mandates are reflected in Article 3.1 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector, according to which Public Administrations objectively serve the general interests and act in accordance with the principles of efficiency, hierarchy, decentralization, deconcentration, and coordination, in full compliance with the Constitution, the Law, and the law. They must respect, in their actions and relations, among others, the principles of good faith, legitimate trust, and institutional loyalty.
Furthermore, Article 41 of the Charter of Fundamental Rights of the European Union, proclaimed by the European Parliament, the Council of the European Union, and the European Commission on December 7, 2000, in Nice (OJEU No. 83, of March 30, 2010), has enshrined the right to good administration as a fundamental right of the European Union.
Finally, the principle of good administration has been the subject of jurisprudential consideration in various
judgments of this Chamber of the Supreme Court, of which we highlight Judgment No. 1752/2022, of December 23, 2022 (Recital 1763/2021), which cites many other jurisprudential precedents. We have emphasized its effectiveness, insofar as it provides a series of citizens' rights with effective implementation. We have also specified that it is not, therefore, a mere formula devoid of content, but is imposed on public administrations such that these rights are followed by a corresponding list of duties that are required of them, among which are, of course, transparency and access to public information. Along these broad recognitions of the right of access, Article 16 of the LTAIBG provides for partial access to information when any of the limits of the previous Article 14 apply, but this does not affect all of the information, unless this results in distorted or meaningless information. For its part, Article 15 of the LTAIBG contemplates another series of limits derived from the protection of personal data that the requested information may eventually contain, distinguishing between cases involving specially protected data (section 1), merely identifying data related to the organization, operation, or activity of the body (section 2), and non-specially protected personal data (section 3), and establishing specific rules for each of them, unless prior dissociation of the personal data has been carried out, preventing the identification of the affected individuals (section 4), in which case those limits do not apply. Turning to the case at hand, there is no doubt that computer applications or programs (software) fall within the material scope of the LTAIBG, as they constitute public information for this purpose. Their technical characteristics (format) or the material on which they are recorded (support) are irrelevant; this issue is not controversial.
25
JURISPRUDENCE
Well, as we have stated, when Public Administrations use computer systems for automated decision-making in the exercise of public powers, affecting the rights of citizens, access to their source code is one of the mechanisms through which the algorithmic transparency required for the full exercise of the right to public information is guaranteed.
However, it must be recognized that authorizing such access may entail risks to other rights or interests worthy of protection, which must be considered and balanced within the legal framework of the limits on the right of access to public information and maximizing this access.
In this weighing of rights and interests, the security risks that third-party access to the source code of the computer system's algorithm could generate due to the vulnerabilities it entails cannot be ignored. However, it cannot be overlooked that these risks can generally be anticipated, which makes it possible to design the application or computer program, strengthening the security of the system and thus minimizing it.
On the other hand, the interpretation and assessment of the limits of the right of access to public information,
particularly regarding a computer application for automated decision-making, which this Court will carry out below, is conditioned by the fact that this automated operation serves as a support for the recognition or denial of social rights, yielding a positive or negative result, without externalizing the reasons for said result.
Furthermore, in these cases, the transparency of the computer applications or the technological process followed by the computer system takes on particular relevance to guarantee adequate oversight of public management, by providing citizens with the necessary information about the decision-making process for their understanding, as well as to verify its compliance with the standards whose application must govern its operation.
Having made the above general considerations, we are now in a position to address the assessment of the interests related to the alleged limits on access to public information.
SEVENTH.- The Court's opinion on the assessment of the limit on access to public information requested,
consisting of the intellectual property rights of Article 14.1.j) of Law 19/2013, of December 9, on transparency, access to public information, and good governance.
The appellant argues that the limit of Article 14.1.j) of the LTAIBG is inapplicable, firstly, based on the application of Article 13 of Royal Legislative Decree 1/1996, of April 12, approving the revised text of the Intellectual Property Law (TRLPI). This provision states the following:
"Legal or regulatory provisions and their corresponding drafts, resolutions of judicial bodies, and acts, agreements, deliberations, and opinions of public bodies, as well as official translations of all the above texts, are not subject to intellectual property."The State Attorney's Office is right when it denies that the BOSCO application is in the nature of an administrative act or a general regulatory provision, as it is an instrumental application that allows electricity marketing companies to verify whether the consumer meets the legal and regulatory requirements for being considered a vulnerable consumer. Indeed, the BOSCO application is a computer program, specifically included among creations that are subject to intellectual property (Articles 10.1.i) and 95 et seq. of the TRLPI). Its source code is specifically protected by copyright to the extent that it constitutes a form of expression of the computer program, in accordance with the case law of the Court of Justice of the European Union, interpreting Article 1 of Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs, and its precedents (see the Court of Justice of the European Union of 22 December 2010 (Case C-393/09), paragraphs 34 and 35; of 6 October 2021 (Case C-13/20), paragraphs 35 and 36; and of 17 October 2024 (Case C-159/23), paragraphs 37 and 38).
Having said this, and before continuing, it is appropriate to briefly describe the characteristics and operation of the BOSCO software application.
1.- Features and operation of the BOSCO application.
This is an online application, implemented by Resolution of November 15, 2017, of the State Secretariat for Energy, which allows the reference marketer to verify that the applicant for the social bonus meets the requirements to be considered a vulnerable consumer.
26
JURISPRUDENCE
It constitutes an information system whose function was to provide the then Ministry of Energy, Tourism, and Digital Agenda with a tool to verify compliance with the conditions for assigning the social bonus to vulnerable consumers. To fulfill this mission, it allows reference marketers to perform queries to verify the conditions for compliance with the social bonus by consumers and carries out said verification in a secure and automated manner, without the latter having access to certain specific consumer data.
Therefore, the BOSCO application, as stated in the aforementioned regulations on the social bonus, is the IT tool—a computer platform available on the Ministry's website—that electricity marketing companies must use to determine which consumers, among those applying for the social bonus, meet the legal and regulatory requirements to be considered vulnerable or severely vulnerable consumers and, consequently, receive the social bonus. These companies, as provided by Order ETU/943/2017, of October 6, which specifies, among other aspects,
the manner in which CORs must operate to use the computer application, are limited to entering into the electronic application the data corresponding to the consumer and, where applicable, the members of the household declared by the consumer, once any defects or contradictions noted in the documentation provided by the consumer have been corrected. The implemented application then allows the results of the checks carried out by the company to be viewed, both for vulnerable and severely vulnerable consumers (Article 6).
Thus, the use of the BOSCO application by marketing companies automatically determines whether a given consumer is entitled to the social bonus, and if the consumer concerned does not agree with the result of the online transaction, they can lodge a complaint with the corresponding consumer services departments, under the terms established by consumer protection regulations, as provided for in Article 8 of Royal Decree 897/2017, of October 6.
Indeed, once the reference marketing companies (COR) have entered the data into the BOSCO system, said system acts automatically and issues a result as described (green flag or red flag), which determines whether or not the consumer who submitted the application will be a beneficiary of the social bonus, since the CORs are limited to consulting the issued result, which they must follow, and then forwarding it to the applicant. It is worth highlighting here that the AEPD resolution dated November 6, 2024 (ref. PS-00324-2023) classifies the BOSCO program as an automated individual decision regulated in Article 22.1 of the GDPR, understanding that it is not a mere consultation tool, but rather adopts a decision on whether the social bonus application submitted meets the regulatory requirements for the applicant to be considered a vulnerable consumer in its various degrees, with a clear impact on citizens' rights for the specific purposes of data protection regulations.
2. Weighing the conflicting interests: the limit of intellectual property.
Having explained the nature and operation of the BOSCO system, we must clarify that the appellant itself admitted, in the public hearing, the applicability of copyright to the contentious software program, an issue that had been disputed, which relieves us of the need to elaborate further on this matter.
Now, having established the State Administration's intellectual property rights over the BOSCO application, this
Court must decide whether, in the specific circumstances of the case, the limit on access to public information,
provided for in letter j) of section 1 of Article 14 of the LTAIBG (intellectual property), justifies denying access to the source code requested by the appellant foundation.
In this regard, let us recall, as our jurisprudence states, that while it is true that the right of access
to public information is neither unlimited nor absolute, being subject to the limits contained in Articles
14 and 15 of the LTAIBG, it is no less true that such limits must be applied in a justified and proportionate manner,
pursuant to Article 14.2 of the LTAIBG, through an appropriate weighing of the interests at stake: that of access to public information, on the one hand, and that protected by the limitation in question, on the other, taking into account
the specific circumstances of the case.
Likewise, we must remember, as we have argued, that the grounds for inadmissibility and the limits to the
right of access contemplated in the LTAIBG must be interpreted restrictively.
In other words, the existence of a subjective right or legitimate interest in invoking a limit
of those provided for in the LTAIBG is not mechanically equivalent to the denial of access to public information.
27
CASE LAW
The specific harm to the right must be considered and the interests at stake must be duly weighed, assuming that the limitations contemplated in the LTAIBG must be interpreted restrictively and based on the premise that the right of access to information is formulated broadly in our legal system, such that only limitations that are justified and proportionate are acceptable.
Well, based on what has been stated so far, and even if the limit of Article 14.1.j) of the LTAIBG (intellectual property) is deemed enforceable, we reach a preliminary conclusion: the mere risk of potential harm to the Administration holding the intellectual property right in question due to its unauthorized use or exploitation, as a result of access to public information, does not, in itself, constitute grounds for exclusion of the right of access, as it lacks the necessary relevance to operate with such a limiting effect. Once the application of this limit is affirmed, its effectiveness in hindering access will depend on the weighing of the competing interests and on whether it is justified and proportionate to its object and purpose of protection. Addressing the weighing of interests at stake and focusing on the interest that justifies access in the present case, we note that the plaintiff asserts a public interest in accessing the source code of the BOSCO application to understand how the decision to grant or reject the social bonus is made and to verify whether there are errors in that decision. This interest is related to the right to legal certainty (Article 9.3 of the Spanish Constitution) of the persons served, since the BOSCO application is used to recognize consumer rights. This party asserts that without access to the source code, it is impossible, or at least extremely difficult, to understand the parameters used to recognize those rights. This is especially relevant given the fact that the BOSCO program does not contemplate any intervention by the Administration in the process of recognizing the legal status of a vulnerable consumer; rather, it is the program itself that makes the decision. This reflection ties in with the assertion of having detected errors
in the denial of granting this status to widows, and in the requirement, in the case of large families, for informed consent not provided for in the regulations.
The BOSCO application, whose features and operation have been extensively explained, comprises
an algorithm or source code intended to be a translation into computer language of the regulatory provisions
that govern the requirements that consumers must meet to be granted
the social bonus for holding the legal status of vulnerable consumer. The source code supports
the online application and allows the reference marketer (COR) to verify that the applicant for the
social bonus meets the requirements to be considered a vulnerable consumer.
In this regard, it is important to consider that the social bonus, which takes the form of a discount on the electricity bill, is one of the measures provided for by Law 24/2013, of December 26, on the Electricity Sector (Articles 45 and 45 bis) to protect vulnerable consumers and combat energy poverty.
Given the above, the Court considers the characteristics and function attributed to the BOSCO application, as well as the purpose it serves, to be significant when assessing the public relevance of the information to which the Civio Citizen Foundation seeks access. This is an independent, non-profit organization whose activity involves monitoring the functioning of public institutions and the management of public resources they carry out, as well as promoting citizen information about their functioning, for which it seeks to foster transparency.
The public relevance of the information requested by the appellant foundation is closely linked to the characteristics and operation of the BOSCO application, as the source code of said application must comply with the regulatory provisions that govern the requirements that consumers must meet to be recognized as eligible for the social bonus for holding the legal status of vulnerable consumers. These standards are translated into computer language to enable full compliance when verifying that consumers applying for the social bonus meet these requirements.
The appellant foundation's legitimate interest in accessing the source code of the computer application lies in verifying the correct operation of the BOSCO online application, ensuring that the online application complies with the regulatory provisions that establish the requirements necessary to be considered a vulnerable consumer.
On the other hand, in the weighing of the interests at stake, the interest of the appellant foundation acquires particular significance, given the public relevance of the information subject to the access request—the source code of the BOSCO application—to the extent that its proper functioning and compliance with the requirements established by law to obtain vulnerable consumer status are decisive for the recognition of the social bonus, whose public impact is of undeniable magnitude, given its purpose: the protection of consumers in a more vulnerable social and economic situation and the fight against energy poverty. Furthermore, the information subject to access provides transparency regarding public affairs and is relevant to society as a whole, or at least to a particularly vulnerable segment of society, which demonstrates its public interest, regardless of whether the Civio Citizen Foundation is a private entity. Thus, in light of the foregoing considerations, based on the fact that the limit set forth in Article 14.1.j) of the LTAIBG (intellectual property) on access to public information, given the State Administration's intellectual property rights over the BOSCO application, could only prevent access to public information when justified and proportionate to its object and purpose, after weighing the conflicting interests, and given that the right of access to information is formulated broadly in our legal system, to the point of justifying a restrictive interpretation of such a limit, this Court concludes that it cannot be considered as effectively impeding access to the requested public information (the source code of the BOSCO online application). Indeed, in the circumstances described above and weighing the conflicting interests, the mere risk of
potential harm to the intellectual property rights of public administrations due to
unauthorized use or exploitation, as a result of access to the source code, cannot, in itself,
constitute grounds for exclusion of the right of access.
In relation to the jurisprudence of the European Court of Human Rights on this right, we emphasize
that the Civio Citizen Foundation performs social oversight functions associated with the protection and safeguarding
of the rule of law and, therefore, of democracy, to the extent that it seeks to ensure the proper
functioning of public institutions and promote citizen information about themselves
and the management of public resources.
This meets the requirements set forth by the European Court of Human Rights for recognizing the right of access to public information, as set forth in its Judgment 18030/11 of November 8, 2016 (Maygar Helsinki Bizottság v. Hungary): (i) the purpose of access—the intended purpose must generate public debate or contribute to the oversight of public authorities; (ii) the nature of the information—the information must be of public interest, that is, it must provide transparency regarding public affairs or be relevant to society as a whole; (iii) the role of the applicant - it must be an
applicant who performs social oversight functions associated with the protection and safeguarding of democracy
(the ECtHR understands that these conditions are met by the media and journalists, but also by non-governmental organizations, academic researchers, writers on matters of public interest, bloggers, influencers, etc.) - and (iv) the existence and availability of the information - the information must be available, without the need to undertake compilation work.
Note that the LTAIBG recognizes the right of access to public information more broadly than the ECHR, as it also does so based on requests based on legitimate private interests. Therefore, it does not negatively delimit the subjective scope of the right of access based on the private interest that motivates it, nor does it require proof of a specific interest, as can be deduced from its Article 12 and recognized by our jurisprudence [Supreme Court judgments of November 12, 2020 (rec. 5239/2019) and of June 2, 2022 (rec. 4116/2020)], regardless of whether it can be taken into consideration in the weighing of the legal interests involved. Considering the unique nature of the public information to which access is sought, this Chamber shares the reflections of the Transparency Council that have led to its change of approach regarding access to algorithms in telematic applications, contrary to that held in the administrative resolution appealed in this instance (for all, Transparency Council resolutions No. 46/2024, of January 16, and No. 1071/2024, of September 24, and those cited therein). Certainly, the progressive development and implementation of e-government and the increasing use of computer applications for the management of public services, with evident implications for citizens' rights, to the extent that they determine or determine the recognition or denial of rights and public benefits, that is, they operate as a source of automated decisions, means that the configuration and use of algorithms in these applications acquire decisive relevance and require transparency.
Logically, the explainability of computer applications, as well as the algorithms that support them, used by public administrations, is the subject of growing citizen demand, as an essential condition for preserving accountability and oversight of decisions by public authorities and, ultimately, as an effective guarantee against arbitrariness or discriminatory bias in fully or partially automated decision-making. Indeed, in the case of automated administrative actions, access to the source code makes it possible to
verify the algorithmic system's compliance with the regulatory provisions it must apply,
since the parameterized motivation of the administrative decision that is made resides in the design of the parameters that determine that source code. This observation takes on particular importance given that the motivation requirements for administrative acts also apply to automated administrative actions, pursuant to Article 35 of Law 39/2015, of October 1,
on the Common Administrative Procedure of Public Administrations.
Therefore, in these circumstances, avoiding the opacity of the algorithm or the source code is inherent to the democratic rule of law, subject to the principle of transparency, and strengthens public confidence in the proper functioning of public administrations.
These last reflections take on special importance in a regulatory scenario such as the current one, where
there are no independent supervisory authorities to guarantee the proper functioning of such
telematic applications. This, leaving aside the possibility of legal action, significantly reduces
the possibilities of their oversight by citizens, in general, or by those affected by
their results, making their effectiveness dependent on access to the application's algorithm or source code.
Finally, it cannot be ignored that the legal protection provided by intellectual property—as opposed
to limiting access by the State Attorney's Office—and, particularly, the property rights that comprise
copyright, is essentially justified by the need to defend and compensate the work and added value
contributed by the creator, as well as the investment of resources of various kinds made for this purpose,
granting a monopoly on temporary disposition and exploitation that allows for the recovery of costs incurred
and incentivizes its continuation as a fundamental element of cultural and technical progress. However, these purposes are noticeably attenuated when, as is the case here, the computer program has been created by the Public Administration itself, which is the owner of the intellectual property, pursuant to the regulations of the electricity sector for the exercise of public powers and intended to serve equally public interests. Consequently, it is not integrated—or at least not primarily—into the competitive logic of the market where intellectual property exploitation rights are projected with special significance.
For all the above reasons, in this Court's weighing of the interests at stake, priority is given to the
interest in accessing the source code of the BOSCO telematic application over the State Administration's intellectual property rights and any potential damages that could arise from such access as a result of unauthorized exploitation by third parties; these damages can easily be minimized by subjecting access to certain safeguards, such as, for example, a prohibition on the dissemination or use of the source code for other purposes without the express authorization of the Administration, an express warning of the liability that the access applicant may incur for failure to comply with this prohibition, the signing of a commitment to limited use of the information received, or the imposition of a duty of confidentiality or secrecy regarding the information consulted.
EIGHTH.- The Court's criterion on the assessment of the limit on access to public information consisting
of public security under Article 14.1.d) of Law 19/2013, of December 9, on transparency, access to public information, and good governance.
In addition to intellectual property as a limit on access to the public information requested by the appellant, the State Attorney's Office also raises public security, pursuant to Article 14.1.d) of the LTAIBG.
1.- The limits assessed in the appealed judgment and their insufficient justification.
The State Attorney's Office argues that the assessment of the evidence in the judgments issued at first and second instance, by the Central Administrative Litigation Court and the Administrative Litigation Division of the National Court, respectively, leads to the finding that access to the source code entails risks of vulnerability and that these vulnerabilities could be used to access personal data, including some specially protected data, such as the disability or status of the applicant for the social security benefit as a victim of gender-based violence. Indeed, the assessment by the Court of First Instance and the Appeals Chamber of the report of the Deputy Director General of Information and Communications Technologies of the Ministry of Industry, Commerce, and Tourism, the technical unit that manages the BOSCO information system for MITECO, and of the report issued by the National Cryptologic Center, led to this factual assessment, which is not subject to review in the cassation court, given the exclusion of this appeal from questions of fact, pursuant to Article 87 bis of the LJCA. However, this statement in no way prevents the conclusion drawn from this fact by the appealed judgment from being brought to trial, namely that providing the appellant entity with the source code of the computer application would violate the limits on the right of access to public information established by Article 14.1, letters d), g), i), and k) of the LTAIBG (public security, the administrative functions of surveillance, inspection, and control, economic and monetary policy, and the guarantee of confidentiality or the secrecy required in decision-making processes).
However, this Court's assessment of this conclusion must be based on the lack of proportionality and the weighing of the interests at stake in the reasoning of the appealed judgment, which omits any reasoning on this matter, which violates Article 14.2 of the LTAIBG and deprives of any justification the importance given by that judgment to the risks of vulnerability.
On the other hand, in the mandatory weighing of interests that must be made to evaluate the validity of these limits on access to public information, one aspect of the algorithm's vulnerabilities must be considered, highlighted by the report issued by the National Cryptologic Center, partially transcribed in the ruling issued by the Central Administrative Litigation Court, which we reproduce below: "In short, we can conclude that the disclosure of the source code objectively increases the severity of the vulnerabilities of any computer application. If it also handles classified or sensitive government information, knowledge of the source code increases the risk that the exploitation of the vulnerabilities could affect national security, public safety, or the security of those governed."
Consequently, according to the report, the disclosure of the source code objectively increases the severity of the vulnerabilities of any computer application; that is, it is a risk inherent to accessing the source code in general. This statement precludes considering that the risk of vulnerability inherent in accessing the source code can be directly opposed to the right of access to public information entailed by the algorithm. To understand otherwise would render the right of access meaningless in relation to telematic applications when the source code is involved, and would imply attributing an absolute nature to the "public security" limitation provided for in Article 14.1.d) of the LTAIBG, undoubtedly not foreseen by the legislator.
Furthermore, assessing the aforementioned risk of cyber vulnerability as an obstacle to access to the source code, in general terms, would be contrary to the very requirement of proportionality and weighing of the interests at stake required by the LTAIBG. Thus, the public security limitation can only prevent access to public information when it is justified and proportionate to its object and purpose, after weighing the conflicting interests, pursuant to Article 14.2 of the LTAIBG.
Regardless of the foregoing, the appealed judgment's generic invocation of the limits provided for in
letters g), i), and k) of Article 14.1 of the LTAIBG—the administrative functions of surveillance, inspection, and control,
economic and monetary policy, and the guarantee of confidentiality or secrecy required in decision-making processes—is devoid of any reasoning to justify its mere presence in this case, so its assessment as a limit on access is inconsistent and unfounded.
2.- Weighing the conflicting interests: public safety and its risks.
Therefore, this Court concludes that the debate focuses on the consideration of the limits of public security and, as a consequence, indirectly, on the limits of the right to the protection of specially protected personal data that, as a result of the vulnerabilities generated by access to the source code of the BOSCO application, could be compromised or made accessible to third parties. This was discussed by the State Attorney's Office in detail during the public hearing. However, regarding the protection of the right to personal data, it should be noted that the limit provided for in Article 15 of the LTAIBG specifically contemplates the circumstance that the information requested by the person seeking to exercise the right of access to public information contains or includes personal data, whether specially protected or not. However, we note that in the case at hand, the public information to which access has been requested—the source code of the BOSCO software application—does not contain or include personal data of the citizens applying for the social bonus, as it is completely excluded from the access to public information sought by the Civio Citizen Foundation, as this party reiterated and explained in detail at the public hearing.
31
CASE LAW
Consequently, it is not possible to assess the limit on access to public information related to the protection of personal data, without prejudice to the fact that the assessment of risks to public security may also consider the potential risk of fraudulent access to data of this nature.
It therefore remains to weigh the risks to public safety posed by access to the algorithm against the Civio Citizen Foundation's interest in the requested access. This weighing takes into account the degree of vulnerability inherent in that access and the danger that unauthorized access could pose to the personal data of social security bonus applicants, on the one hand, and the public relevance of the information and the foundation's legitimate interest in access, on the other. In this weighing, we refer, to avoid unnecessary repetition, to the considerations made in the previous legal basis to demonstrate the prevalence of the interests that justify access to public information. To all of this, we must add that, although in the abstract, access to a program's source code could potentially increase some risks to the application's computer security, it can also be argued, on the contrary, that transparency about the source code can contribute, in equally potential terms, to improving the code and strengthening its security. This is because, on the one hand, it encourages the Administration to take extreme security precautions in the design and control of the computer program itself. Its scrutiny by diverse and independent actors allows initially unnoticed vulnerabilities to surface and enables their early correction. In fact, the availability of software applications through open source licenses is not uncommon these days, and particularly in the field of applications developed by Public Administrations for the exercise of their powers, there are examples of source code publication. Among them, due to their relevance and notoriety, we can mention those developed in the context of the COVID-19 health crisis for tracking infected individuals and, in the specific case of Spain, the "Radar COVID" application (available at https://github.com/RadarCOVID), although it was not understood that the risks inherent in knowing the source code or the nature of the information involved would completely prevent its publication.
Furthermore, even though there are clear interests and rights related to confidentiality, personal data protection, and computer security that should be protected preferentially when the
specific circumstances of each case so advise, it is noticeable that, both in European Union and domestic regulations, there are mandates and principles favorable to the transparency of public algorithms that lead to ruling out the concealment of source code as a general and categorical principle of computer system security.
In this regard, Regulation (EU) 2024/903 of the European Parliament and of the Council of 13 March 2024 laying down measures to ensure a high level of interoperability in the public sector throughout the Union (Interoperable Europe Regulation) is noteworthy. Recitals 26 and 36 of this Regulation highlight the following:
(26) When public administrations share their solutions with other public administrations or with the public, they act in the public interest. This is even more relevant in the case of innovative technologies. For example, open source makes algorithms transparent and allows for independent audits and replicable modules. The exchange of interoperability solutions between public administrations should lay the foundation for creating an open ecosystem of digital technologies for the public sector that can deliver multiple benefits.
[...]
(36) Since open source allows users to actively assess and inspect the interoperability and security of solutions, it is important that it supports the deployment of interoperability solutions. In this context, and to improve legal clarity and mutual recognition of licenses in Member States, the use of open source licenses should be encouraged. With the European Union Public License (EUPL), the Commission already offers a solution for this type of licensing. Portals in Member States hosting open source solutions linked to the Interoperable Europe Portal should allow the use of the EUPL, although the possibility that such portals may allow the use of other open source licenses is not excluded.
And in its Article 5, relating to general principles, it provides:
"1. The Commission shall publish the Interoperable Europe solutions and the European Interoperability Framework on the Interoperable Europe portal by electronic means, in open, machine-readable formats, accessible to persons with disabilities in accordance with Directives (EU) 2016/2102 (19) and (EU) 2019/882 (20) of the European Parliament and of the Council, easily discoverable and reusable, where appropriate, together with their documented source code and metadata. Translated versions of the Interoperable Europe solutions shall be automatically published on the Interoperable Europe portal in all official languages of the Union institutions. Regarding reuse, Article 157.2 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector, contemplates the opportunity to declare certain public administration applications as open sources to increase transparency in their operation or promote the incorporation of citizens into the Information Society.
For its part, data protection regulations impose certain information and transparency requirements on the logic used when processing personal data that involves the adoption of automated individual decisions, that is, decisions based solely on automated processing, including profiling, that produce legal effects on the data subject or similarly significantly affect them.
In these cases, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), provides for the right of the data subject to obtain, both at the time the data is collected (Article 13.2.f and 14.2.g) and when exercising the right of access (Article 15.1.h), "meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject." It should be noted that this GDPR requirement for "explainability" of the logic of automated decisions cannot be equated with the obligation to provide access to the source code, but it is not, in any case, excluded from, nor does it necessarily conflict with, the security of the processing of personal data, as evidenced by the recommendations adopted by the European Data Protection Board in its Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 pandemic, adopted on April 21, 2020, which stated that: "37. To ensure their fairness, accountability, and, more generally, their compliance with the law, algorithms must be auditable and regularly reviewed by independent experts. The source code of the application must be made public for the broadest possible scrutiny." "GEN-3 The source code of the application and its final server must be open, and the technical specifications must be made public, so that any interested party can audit the code and, where appropriate, contribute to its improvement, correcting possible errors and ensuring transparency in the processing of personal data."
In the same vein, it is worth mentioning Article 23 of Law 15/2022, of July 12, on comprehensive equal treatment and non-discrimination, which, in order to protect the right to equality, also contains principles favorable to the transparency of algorithms used in decision-making by Public Administrations, in the following terms:
"1. Within the framework of the National Artificial Intelligence Strategy, the Digital Charter of Rights, and the European initiatives on Artificial Intelligence, public administrations will promote the implementation of mechanisms so that the algorithms involved in decision-making used in public administrations take into account criteria for minimizing bias, transparency, and accountability, whenever technically feasible. These mechanisms will include their design and training data, and will address their potential discriminatory impact. To achieve this goal, the implementation of impact assessments to determine potential discriminatory bias will be promoted.
" 2. Public administrations, within the framework of their powers regarding the algorithms involved in decision-making processes, will prioritize transparency in the design and implementation and the ability to interpret the decisions made by them. [...]".
What has been said so far demonstrates that the mere claim that the disclosure of source code objectively increases the severity of the vulnerabilities of any computer application is, in itself, insufficient to exclude access to it. Aside from the fact that such access may also contribute, in the opposite sense, to strengthening security, there are other interests of high legal significance related to participation in decision-making, the strengthening of democracy, the effectiveness of other constitutional rights, the generation of trust in public institutions, and the increase in the efficiency and effectiveness of public action that must also be protected and taken into account in the weighting required by law. At this point, it is appropriate to reiterate the considerations, already developed in the previous legal basis, regarding the public and social relevance of the electricity social bonus, as an instrument for the protection of consumers who are in a more vulnerable social and economic situation in the face of energy poverty. Based on this, it should be noted once again that the BOSCO program represents an automated action by the Administration in the exercise of its powers, through which a decision is made with a clear impact on citizens' rights. This is directly reflected in its regulation, which provides that verification of vulnerable and severely vulnerable consumer status in order to receive the social bonus must be carried out by the corresponding marketing company through the online application offered by the Ministry. Thus, once the applicant's data has been entered, the application returns the result of whether or not the requirements are met or, where applicable, whether the verification could not be carried out, indicating, in this case, the reason for the rejection (Article 6 of Order ETU/943/2017, of October 6). Furthermore, not only does the program make a decision that conditions access to the social electricity discount, but this decision, except in cases where verification cannot be carried out, is not accompanied by an expression of the specific reasons that support this conclusion, especially when it is determined that the requirements are not met. This circumstance can be considered reasonable given the process designed, in which a retailer intervenes and does not require any more information than that strictly necessary to apply or not apply the social discount. However, interested parties are also not offered a mechanism to independently ascertain this reasoning. This lack of transparency in the program's decision-making process, in addition to the obstacles it may pose to the effectiveness of the complaint to be filed with consumer services, as provided for in the regulations examined, makes it difficult to detect potential errors in the program's operations, which, by virtue of their automatic nature, have a clear multiplier effect.
In the opinion of this Court, all these circumstances justify the prevalence in this case of the public interest
argued by the foundation requesting access to the software source code over the limitation
of Article 14.1.d) of the LTAIBG (Spanish Civil Code) opposed by the respondent Administration, given that the security risks, in addition to not being sufficiently characterized, would in any case be limited to a
particularly limited IT operation (that of the application of the social electricity discount) - which, in fact, the
State Attorney's Office describes as merely auxiliary in nature - while the interests related to the control of the Administration's actions, connected with the significant purpose for which the BOSCO program is used, and, therefore, the proper functioning of the software, serve, in this case, the effectiveness of relevant legal rights such as the principles of legality and equality and other constitutional rights, participation in decision-making, the strengthening of democracy, and the generation of trust in public institutions.
As a result of everything stated above, this Court considers that the transparency required in the operation of the BOSCO online application, which has a clear and significant impact on citizens' social rights, is not guaranteed by a mere functional explanation provided by the Administration that owns the application. It also requires access to its algorithm, as otherwise it would not be possible to accurately and thoroughly verify its operation and, therefore, ensure that the orders or instructions in computer language it contains comply with the legal and regulatory provisions regarding the requirements for obtaining the social bonus.
Having considered the foregoing, we are now in a position to respond to the question of cassational interest raised.
NINTH. - Response to the question of cassational interest regarding the appropriateness of providing the source code of the computer application to determine whether the requirements for being a beneficiary of the social bonus are met.
In accordance with the considerations set forth in the preceding sections, this Court, responding to
the question of cassation interest raised in this appeal, which is of cassation interest for the formation of jurisprudence, in the interpretation and application of Articles 14 and 16 of Law 19/2013, of December 9, on transparency, access to public information, and good governance, in light of Article 42 of the Charter of Fundamental Rights of the European Union and Article 105.b) of the Spanish Constitution,
declares the following:
1. The right of access to public information transcends its status as an objective principle governing
the actions of public administrations to constitute an exercisable constitutional right,
as a subjective right, vis-à-vis public administrations, derived from the requirements of democracy and transparency, and inseparably linked to the democratic and legal state.
2.- The right of access to public information takes on special relevance given the risks involved in the use of new technologies in the exercise of public powers or the provision of public services, as is the case with the use of automated decision-making computer systems in the activities of public administrations, especially when their purpose is to recognize social rights. In these cases, this must entail requirements for transparency in the computer processes followed in such actions, in order to provide citizens with the information necessary for their understanding and knowledge of their operation. This may sometimes require access to their source code to enable verification of the algorithmic system's compliance with the regulatory provisions it must apply. 3.- The Civio Citizen Foundation has the right to access the source code of the BOSCO software application,
developed so that leading electricity marketing companies can verify whether applicants for the social bonus meet the legal and regulatory requirements for being considered vulnerable consumers and, therefore, eligible for the social bonus. This will allow the Foundation to understand the transactions designed for granting the social bonus and verify that they comply
with the applicable regulatory framework.
TENTH.- Resolution of the appeal.
For the reasons set forth, and in accordance with the doctrine expressed in the previous section, it is appropriate
to declare admissible the appeal filed by the Civio Citizen Foundation against the
Judgment of April 30, 2024, issued by the Seventh Section of the Contentious-Administrative Chamber of the National Court, which dismissed appeal No. 51/2022, filed against the Judgment
of December 30, 2021, issued by the Central Court of Contentious-Administrative Court No. 8 in ordinary procedure No. 18/2019, which dismissed the contentious-administrative appeal filed against the resolution of the Transparency and Good Governance Council (CTBG) of February 18, 2019, partially upholding the claim filed against the Ministry of Ecological Transition (MITECO). regarding access to information related to the online application (BOSCO), which should be annulled and void.
Furthermore, in accordance with the considerations made in the previous legal grounds, this Chamber
of the Supreme Court finds the administrative resolution of the Transparency and Good Governance Council (CTBG) of February 18, 2019, under appeal, to be contrary to law, as access to the source code
of the BOSCO computer application is appropriate. This application was developed so that leading electricity marketing companies can verify whether applicants for the social bonus meet the legal and regulatory requirements for being considered vulnerable consumers and, therefore, are eligible for the social bonus. This is so that the Civio Citizen Foundation can understand the operations designed to make the decision to grant or reject the social bonus and verify that they comply with the applicable regulatory framework. Consequently, the State Administration is obliged
to provide the Foundation with access to the source code of the BOSCO computer application.
Therefore, appeal No. 51/2022 filed before the Administrative Litigation Division of the National Court is upheld against the judgment of December 30, 2021, issued by the
Central Administrative Litigation Court No. 8 in ordinary procedure No. 18/2019, which dismissed the administrative appeal filed against the resolution of the Transparency and Good Governance Council (CTBG) of February 18, 2019, and which is revoked and rendered null and void.
And, consequently, the contentious-administrative appeal filed against the
resolution of the Transparency and Good Governance Council (CTBG) of February 18, 2019, which partially upheld the claim filed against the Ministry of Ecological Transition (MITECO) regarding access to information related to the online application (BOSCO), is hereby granted. This resolution should be annulled for being unlawful and the Civio Citizen Foundation's right to access the source code of the BOSCO computer application, as requested, should be declared, with the consequent ordering of the State Administration to provide it.
ELEVENTH.- Procedural costs.
In accordance with the provisions of Article 93.4 of the Law regulating this Jurisdiction, we understand that neither party should be charged with the costs arising from the appeal, and that each party should pay the costs incurred at its own request and the joint costs in half.
Nor is it appropriate to award costs arising from the first-instance proceedings and the appeal,
pursuant to Article 139.1 of the LJCA, since the dispute raised legal doubts
sufficient to consider the award of costs inadmissible, as indicated by the differing opinions
expressed in the first-instance judgment and in this judgment resolving the appeal, with each party
requiring to pay the costs incurred at its instance and the joint costs in equal parts.
35
JURISPRUDENCE
RULING
For all the above, in the name of the King and by the authority conferred upon it by the Constitution, this Court has decided, in accordance with the interpretation of the rules established in the ninth legal ground:
1. To declare admissible the appeal for cassation filed by the legal representative of the Civio Citizen Foundation against the Judgment of April 30, 2024, issued by the Seventh Section of the Contentious-Administrative Chamber of the National Court, which dismisses appeal No. 51/2022, filed against the Judgment of December 30, 2021, issued by the Central Contentious-Administrative Court No. 8 in ordinary procedure No. 18/2019, which dismissed the contentious-administrative appeal filed against the resolution. of the Council for Transparency and Good Governance (CTBG), dated February 18, 2019, partially upholding the complaint filed against the Ministry of Ecological Transition (MITECO) regarding access to information related to the online application (BOSCO), which should be annulled and void. 2. To uphold appeal No. 51/2022 filed before the Administrative Litigation Division of the National Court against the judgment of December 30, 2021, issued by the Central Administrative Litigation Court No. 8 in ordinary procedure No. 18/2019, which dismissed the administrative litigation appeal filed against the resolution of the Transparency and Good Governance Council (CTBG) of February 18, 2019, and the appeal shall be revoked and rendered null and void. 3. To uphold the contentious-administrative appeal filed against the resolution of the Transparency and Good Governance Council (CTBG) of February 18, 2019, partially upholding the claim filed against the Ministry of Ecological Transition (MITECO) regarding access to information related to the online application (BOSCO), and consequently:
A. We annul the appealed administrative resolution for being contrary to law.
B. We declare the right of the Civio Citizen Foundation to access the source code of the BOSCO computer application, ordering the defendant Administration to provide it.
4. We expressly waive the imposition of the procedural costs incurred in this appeal, nor those incurred in the appeal and in the first instance.
Notify the parties of this resolution and insert it in the legislative collection.
It is so agreed and signed.
36
