LEONARDO CERVERA NAVAS
DIRECTOR
Ms Nicole MAES
by email only: ask+request-8729-
xxxxxxxx@xxxxxxxx.xxx
Brussels, 14 January 2021
LCN/SP/TT/ktl/D(2021)0072
C 2020-1124
Please use xxxx@xxxx.xxxxxx.xx for all
correspondence
Subject: Your request for access to documents under Regulation (EC) 1049/2001
Dear Ms Maes,
On 2 December 2020, you sent an access to documents request to the European Data Protection
Supervisor (“EDPS”) on the basis of Regulation (EC) 1049/2001, which was registered on the
same day also mentioning the extension of the deadline in accordance with Article 7(3) of
Regulation (EC) 1049/2001.
You request
“ a) the mapping exercise that the EDPS has carried out following the Schrems II
judgment, including any related report detailing the outcome (the EDPS published a strategy
document requiring EU institutions to carry out such exercise . I expect that the EDPS must
have done one for itself).
b) If the EDPS uses any of the following tools: Microsoft Office365, Microsoft Teams, Zoom,
Cisco Webex, Skype, I request any privacy assessment or similar document (including DPIA)
done by the EDPS in view of adopting the use of such tools. Kindly note that I do not want
generic guidelines. Instead I seek specifically any privacy assessment that relates to the internal
use by the EDPS of any of the tools I listed.
For both categories of documents you can redact any personal data and any information that
would imperil the security of your IT systems.”.
We regret to inform you that we cannot provide you with access to the requested documents,
as they are part of ongoing procedure, where the decision is not yet taken by EDPS and thus
fall within the exceptions of art. 4(3) of Regulation 1049/2001. However, following our policy
Postal address: rue Wiertz 60 - B-1047 Brussels
Offices: rue Montoyer 30 - B-1000 Brussels
E-mail: xxxx@xxxx.xxxxxx.xx - Website: www.edps.europa.eu
Tel.: 32 2-283 19 00 - Fax : 32 2-283 19 50
of full transparency, we can confirm that EDPS had carried out a mapping exercise and prepared
the relevant report.
Please note that pursuant to Article 7(2) of Regulation 1049/2001, you may make a
confirmatory application asking the EDPS to reconsider his position as regards to the refusal
and partial refusal of your request. Such a confirmatory application should be addressed within
15 working days upon receipt of this letter to the EDPS general e-mail: xxxx@xxxx.xxxxxx.xx.
Yours sincerely,
Data Protection Notice
According to Articles 15 and 16 of Regulation (EU) 2018/1725 on the protection of natural persons with
regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on
the free movement of such data, please be aware that your personal data will be processed by the EDPS,
where proportionate and necessary, for the purpose of answering your request. The legal base for this
processing operation is Regulation (EC) 1049/2001 and Article 52(4) of the Regulation (EU)
2018/1725. Subject to applicable rules under EU legislation, the personal data relating to you, as
provided in your request, are used solely for the purpose of replying to your request. EDPS staff
members dealing with the request will have access to the case file containing your personal data on a
need-to-know basis. Your personal data are not disclosed outside the EDPS. Your personal data will be
stored electronically for a maximum of ten years after the closure of the case, or as long as the EDPS
is under a legal obligation to do so. You have the right to access your personal data held by the EDPS
and to obtain the rectification thereof, if necessary. Any such request should be addressed to the EDPS
at xxxx@xxxx.xxxxxx.xx. You may contact the data protection officer of the EDPS (EDPS-
xxx@xxxx.xxxxxx.xx), if you have any remarks or complaints regarding the way we process your
personal data.
2