Redaction of data controller in Irish "amicable resolution" cases in the EDPB Final Decision Register.
Dear European Data Protection Board,
Under the right of access to documents in the EU treaties, as developed in Regulation 1049/2001, I request documents that contain the following information:
1. The names of the data controller in each of the 46 "amicable resolution" final decisions registered as final decisions by the Irish Data Protection Commission in the EDPB Final One Stop Shop Decisions Register for the year 2022.
2. Reason for redaction.
I also request any document that explains why the information was redacted in cases where the DPC concluded a case by amicable resolution. I note that all other (4) final decisions registered by the Irish DPC were not concluded by way of amicable resolution. In those cases, the name of the data controller was not redacted.
Faithfully,
Johnny Ryan
Dear Sir/Madam,
Thank you for your message and for your interest in data protection. We
will look into your request and get back to you within due time.
Kind regards,
The EDPB Secretariat
Dear Mr. Ryan,
Thank you for your email.
As regards the reasoning for redacting information from the final
decisions before publishing on the EDPB website, please note when the
members decided to publish a register on Art 60 decisions, they agreed
that it should include the maximum information possible taking into
consideration the national limitations, i.e., the final decisions adopted
and the summaries, in principle not anonymised (names of the controllers
and processors), except if necessary in accordance with the national law.
Please be mindful that the Art 60 register itself is not based on a legal
obligation and the EDPB provides it voluntarily on the basis of the
general task to inform the public. While doing this, we need to make sure
that no confidential information is disclosed and follow the instructions
provided by the SAs in that regard.
In the case of Ireland, it means that decisions from the DPC do not
include data of physical or legal persons, as explained on our [1]website,
unless such data has been made public by the DPC itself. This was
situation in the four cases referred to in your request, where the DPC
itself published the decisions in full.
Please let us know, if in light of these explanations, you would still
like to maintain your request for access to documents. If this is the
case, could you please confirm whether you agree to limit the scope to the
final decisions? We are asking this because the names of the controllers
also appear in the IMI reports for each of the final decisions, and may
also appear in the emails sent fby the EDPB Secretariat to the Irish SA.
Thank you in advance for your reply.
Best regards
EDPB Secretariat
Dear colleagues,
Thank you for your reply.
Yes, I would like to maintain my request for access to documents.
I would also be happy to limit my request to the final decisions, provided that the controllers are no longer redacted.
There is no cause in Irish law of which I am aware for the data controllers to be anonymous.
Yours sincerely,
Johnny Ryan
Dear Mr. Ryan,
Thank you for your reply.
Since we cannot predict the outcome of our assessment before we start it, we will also include the relevant IMI reports and the emails sent by the Secretariat to the Irish SA in scope of your request.
We confirm registration of your access to documents request and registered it today under reference 2023/09. Please use this reference for further correspondence.
We are currently assessing your request and will provide you with a reply within 15 working days (03/04/2023).
Please note that the EDPB specific privacy statement regarding the processing of personal data for the purposes of handling requests for access to documents is available on the EDPB website and can be viewed via this link: https://edpb.europa.eu/edpb-specific-pri....
Should you have any further queries, please do not hesitate to contact us.
Best regards,
The EDPB Secretariat
Dear Mr Ryan,
We refer to your email dated 07/03/2023 in which you made a request for access to documents, registered on 13/03/2023 under reference number 2023/09.
Your application is currently being handled. However, we will not be in a position to complete the handling of your application within the time limit of 15 working days, which expires today (03/04/2023).
An extended time limit is needed, as your application covers a large amount of documents. Therefore, we have to extend the time limit for another 15 working days in accordance with Article 7(3) of Regulation (EC) No 1049/2001 regarding public access to documents. The new deadline expires on 26/04/2023.
We apologise for this delay and for any inconvenience this may cause.
Yours sincerely,
On behalf of
Ventsislav Karadjov, deputy chair of the EDPB
Dear Mr. Ryan,
Please find enclosed the reply to your request for access to documents (ref. 2023-09) signed by Mr Ventsislav Karadjov, Vice-Chair of the EDPB.
Best regards,
The EDPB Secretariat