“LSA-CSA Feedback Report” documents

Johnny Ryan made this access to documents request to European Data Protection Board

Automatic anti-spam measures are in place for this older request. Please let us know if a further response is expected or if you are having trouble responding.

The request was successful.

Dear colleagues,

Under the right of access to documents in the EU treaties, as developed in Regulation 1049/2001, I am requesting documents which contain the following information:

REQUEST

Every “LSA-CSA Feedback Report” document from 25 May 2018-25 May 2022. These documents have the sub heading “Article 56 - Identification of LSA and CSA”. These documents do not identify the data controller involved, and should require no redaction. However, if these documents do identify individual people who are named on behalf of supervisory authorities, then we will understand the need to redact their names.

ALTERNATIVE REQUEST

We understand the burden that FOI requests place upon the EDPB. Therefore, we propose an alternative to the request above that may be easier for the EDPB to produce: we would be content with a record of the number of cases per LSA from 25 May 2018-25 May 2022, provided that
i) the record excludes IMI entries to which the Article 60 procedure does not apply (exclude cross-border entries that are Article 61, Article 64, Article 65, Article 66); and
ii) Article 62 joint operations are clearly marked if they are included.

Yours faithfully,

Johnny Ryan

Irish Council for Civil Liberties

European Data Protection Board

Dear Sir/Madam,
Thank you for your email.

The offices of the EDPB Secretariat are closed until and including the 29
May 2022 for the Ascension day.

Please note that your e-mail has not been forwarded.

We will respond to your message as soon as possible upon our return.

Kind regards,

The EDPB Secretariat

Dear colleagues,

For the avoidance of doubt, this request concerns only cross-border cases.

Yours faithfully,

Johnny Ryan

European Data Protection Board

Dear Mr. Ryan,

Thank you for your email, and also for providing us with two different options in relation to your request. Please accept our apologies for the delay in getting back to you.

Before registering any request, and to avoid any misunderstanding, we would like to first clarify that the EDPB is not involved in the cooperation procedure (under Art 56 and Chapter 7 – Section 1), and, as a result, it is generally not part to any exchanges between supervisory authorities in the context of this procedure. This means that the EDPB does not have access to the reports you refer to in the first part of your request. Further, these reports are generated by users upon individual action, they are therefore not pre-generated and available as documents.

As regards the second part of your request, the same principle applies. However, the EDPB Secretariat provides statistics which give an overview on which SA has initiated how many procedures, including case register entries. However, as the EDPB does not have a role in these procedures, the EDPB cannot verify whether for every entry the information has been entered accurately.

If we understand correctly, you are, however, not asking to access a list of the case registers with the LSA, unless this also contains the information in the second part of your request.

While you are not required to provide any reasoning for your request, it may be helpful if you could provide us with any information on your interest in obtaining the documents, insofar as this would help us to determine the documents in scope of your request.

Thank you very much in advance for your cooperation.

Kind regards

EDPB Secretariat

show quoted sections

Dear colleagues,

Thank you. I had not realised that. Thank you for informing me.

The reasoning of my request is to determine precisely how many Article 60 cross-border cases each supervisory authority is and has been the LSA for from 25 May 2018-25 May 2022. I would be grateful for your assistance.

Yours sincerely,

Johnny Ryan

European Data Protection Board

Dear Mr. Ryan,

Thank you very much for your reply.

As mentioned in our previous reply, the EDPB Secretariat provides statistics which give an overview on which SA has initiated how many procedures, including case register entries.

We do therefore have statistics for the list of case registers with an SA indicated as LSA. However, these statistics do not indicate which of these cases are cross border or for which an Art 60 procedure has or will be triggered. We can also provide an overview of all the Art 60 Draft Decision and informal consultation procedures and by which SA they have been initiated.

Could you please confirm whether this would address your request (list of case registers with an SA indicated as LSA)?

Thank you very much in advance for your cooperation.

Kind regards

EDPB Secretariat

show quoted sections

Dear colleagues,

Thank you. To avoid any ambiguity, may I ask you to confirm the following.
Do I understand correctly that the EDPB has no current data, nor historical data, of the total number of cross-border Article 60 cases for each LSA?

Johnny

European Data Protection Board

Dear Mr. Ryan,

Thank you very much for your question.

The EDPB does have data on the total number of cross-border article 60 cases per LSA. It is important to determine, however, at what point in time can a cross-border case be considered as such. In that case, this is most clear at the moment a draft decision is issued by an LSA, because a decision must be issued for each cross-border case (please note, however, this does not mean it will result in a final decision). Please note as well that a cross-border case doesn't necessarily correspond to one complaint. In cases where complaints are very similar and the controller is the same, an LSA may opt, for reasons of efficiency and speed, to issue one single decision for several similar complaints against the same controller. Therefore, by providing an overview of the draft decisions, we can give you the best approximate estimate (for the previously explained reasons) of how many Art. 60 cross-border cases for each LSA are currently ongoing.

Could you please confirm whether this corresponds to the scope of your request (overview of the draft Art. 60 decisions per LSA)?

Thank you very much in advance for your cooperation.

Kind regards

EDPB Secretariat

show quoted sections

Dear colleagues,

To make sure that there is no shadow of ambiguity, allow me to ask you the following question.

Do I therefore understand correctly that the EDPB has no current data, nor historical data, of the total number of cross-border Article 60 cases (cases, not complaints) for each LSA before the point where an LSA issues a draft decision?

Johnny

European Data Protection Board

Dear Mr Ryan,

Thank you very much for your email and question.

We would like to kindly ask you if you would be available for a quick phone call this Friday. The purpose of the phone call would be to discuss your request in more detail in order to reach an understanding regarding the scope.

If you are available, we would like to propose a quick call period between 10:00 and 12:30 Brussels time, or between 14:00 and 17:30 Brussels time
Would any of these be suitable for you? If not, could we kindly ask you to suggest a suitable timing for you?

We would also be grateful if you could provide us with a direct email address or another way of communication, which we would use solely for the purpose of sending you the call details (any communication concerning your access to documents request will continue to be sent to this email address).

Many thanks in advance for your availability.

Best regards,

The EDPB Secretariat

show quoted sections

Dear colleagues,

I will be travelling (to the EDPS conference).

I also suggest for clarity and certainty, and for the avoidance of any ambiguity, that it would be best if you would reply in writing here.

Johnny

European Data Protection Board

Dear Mr. Ryan,

Thank you for your reply.

You have asked for the "total number of cross-border Article 60 cases (cases, not complaints) for each LSA before the point where an LSA issues a draft decision".

However, as explained in our message, and bearing mind that the IMI system, which is used for cooperation and on which we rely for statistics, was built to map the procedures prescribed by the GDPR; this number depends upon what you understand under the term "cross-border Article 60 cases." There is a possibly extensive period during which an SA is evaluating whether a specific issue is considered to concern cross border processing in the first place and therefore fall under Art 60 at all.

For example, when an SA considers that it may have a cross border case, it launches an Art. 56 procedure in order determine the potential LSA and potential CSAs. Once this has been done, the LSA creates a case file register entry (which is the number relied on to give an overview of cases register entries). However, as mentioned, due to the practice of bundling for efficiency reasons, one case file may contain several complaints. A case file can therefore lead to either one Art 60 decision (grouping the related complaints), or several different Art 60 decisions (e.g. if the LSA determines that the scope is not similar enough to handle them in one decision) or even none (e.g. if the complaint is withdrawn). This is without regard to situations where either the issue is handled by a CSA via the derogation to Art 60 provided by Art 56(2) and without regard to situations where, upon closer inspection, it is concluded that the matter indeed does not concern cross-border processing (as it does not concern multiple establishments nor are data subjects in multiple member states affected). The SAs may also engage in further exchanges, such as Informal Consultations, making use of case register entries for establishing the above mentioned information.

Consequently, the number of case register entries does not necessarily correspond to the number of Art 60 cross border processing cases. Please note that this figure also includes complaints resolved via amicable settlements, although this is only consistently applied as of the EDPB Guidelines on amicable settlements.

In contrast to the stages referred to above, draft Art. 60 decisions do refer to a fixed point in the Art 60 process prescribed by Art 60(4) (i.e. not a case register entry) which is why we have said that an overview of the draft decisions, gives the best approximate estimate of how many "cases" related to cross-border processing for each LSA have reached this stage in the procedure provided in the GDPR.

In case this is not what you are looking for, please let us know for which stage in the above described process you are asking to receive statistics. "Total number of cross-border Article 60 cases" is not precise enough to enable us to identify any documents potentially in scope of your request.

Thank you in advance for your cooperation and response.

Best regards,

The EDPB Secretariat

show quoted sections

Dear colleagues,

Thank you. I note that you state “the number of case register entries does not necessarily correspond to the number of Art 60 cross border processing cases.”

In this case, does the EDPB have any current data of the total number of cross-border Article 60 cases (cases, not complaints) for which each LSA is currently responsible?

Johnny

European Data Protection Board

Dear Mr Ryan,

 

Thank you for your reply.

 

The statistics gathered from IMI map the different stages in the procedure
as prescribed by the GDPR.

 

As regards the One-Stop-Shop exchanges, the EDPB gathers statistics at the
following stages of the process:

 

1.           Number of case register entries

2.           Number of draft Art. 60 decisions per LSA

3.           Number of Revised draft decisions

4.           Number of Final decisions

 

The case register is a central point that can be used to initiate
communications relating to One-Stop-Shop but also for other types of
communications, such as Mutual Assistance request under Art. 61 GDPR or
joint operations under Art. 62 GDPR.

 

Therefore, as we have tried to explain in our previous message, the number
of case register entries (category 1 above) does not necessarily
correspond to the number of "Art 60 cross border processing cases". Please
note that there is no legal definition of the notion you refer to as
"cross border Art. 60 case" in the GDPR and by consequence, we do not have
statistics on this matter. The IMI Case register also includes, for
example, cases where complaints were withdrawn, cases where the issue is
handled by a CSA via the derogation to Art 60 provided by Art 56(2) and
cases, where, upon closer inspection, it is concluded that the matter does
not concern cross-border processing. It may also include Informal
Consultations, for which SAs make use of case register entries for
establishing the above mentioned information through these exchanges.

 

We understand from our exchange that you're interested in accessing cases
where an LSA is cooperating with the CSAs on specific cases – such
cooperation being limited to the stages described in Art 60(1), (2) and
(3) 1st sentence (i.e., before the draft decision's stage, as you
expressly requested). For the reasons set out above, providing you with
the number of case register entries will not give you an accurate idea of
how many cases are currently subject to a cooperation procedure between
LSA and CSAs on the basis of Art 60(1), (2), and (3) 1st sentence. The
case register has been designed as a starting point of different
communications, not only linked to Art. 60 GDPR. It is not a case file as
it can be understood for case file systems. The IMI system is a
communication system and was put in place to structure secured flows of
communications between data protection authorities for their cooperation
under GDPR.

 

Consequently, the EDPB does not specifically hold data on the total number
of cases being currently subject to a cooperation procedure between LSA
and CSAs on the basis of Art 60(1), (2), and (3) 1st sentence.

 

Please note that in relation to Art 60 (2), we do have statistics on the
number of Joint Operations and Mutual Assistance Procedures initiated by
each SA, but as the EDPB is not part of these procedures, we cannot access
their content and therefore say how many of these are related to Art. 60
draft decisions.

 

We can provide data on the categories 2, 3 and 4 listed above, in case
this is of interest.

 

In case of any further questions, we would like to restate our
availability for a phone call, in order to proceed with registering your
request as swiftly as possible. We can of course send you a summary of
this call afterwards, as we have done in previous cases.

 

Best regards

 

EDPB Secretariat

 

show quoted sections

Dear colleagues,

Thank you.

For the period from 25 May 2018 to the present date, 4 July 2022, I request the following
i. the number of cases for each LSA;
ii. the number of draft decisions from each LSA;
iii. the number of revised draft decisions from each LSA;
iv. the number of final decisions from each LSA;
v. the number of mutual assistance requests (Article 61) addressed to each LSA;
vi. the number of joint operations (Article 62) conducted by each supervisory authority;
vii. the number of cases where complaints are marked withdrawn by each LSA (we note supervisory authorities can mark cases closed or withdrawn, according to the IMI User Guide, page 8);
viii. the number of cases, where, upon closer inspection, it is concluded by the LSA that the matter does not concern cross-border processing;
ix. the number of the number of cases where the issue is handled by a CSA via the derogation to Art 60 provided by Art 56(2)
x. the number of cases that are informal consultations, for which SAs make use of case register entries for establishing the above mentioned information through these exchanges.

I would be grateful if these numbers could be broken down by month and year.

Faithfully,

Johnny Ryan

European Data Protection Board

Dear Mr. Ryan,

Thank you very much for your reply.

We confirm registration of your access to documents request and registered it today under reference 2022/48. Please use this reference for further correspondence.

We are currently assessing your request and will provide you with a reply within 15 working days (27/07/2022).

Please note that the EDPB specific privacy statement regarding the processing of personal data for the purposes of handling requests for access to documents is available on the EDPB website and can be viewed via this link: https://edpb.europa.eu/edpb-specific-pri....

Should you have any further queries, please do not hesitate to contact us.

Best regards,

The EDPB Secretariat

show quoted sections

Dear colleagues,

For clarity, let me add that part (v) of my request should include both "mutual assistance" and "voluntary mutual assistance".

Faithfully,

Johnny Ryan

European Data Protection Board

4 Attachments

Dear Mr. Ryan,

 

Please find enclosed the reply to your request for access to documents
(ref. 2022-48) signed by Mr. Ventsislav Karadjov, Vice-Chair of the EDPB.

 

Best regards,

 

The EDPB Secretariat

 

┌─────────────────────────────────────╥───────────────────────────────────────────────────────┐
│ ║European Data Protection Board │
│ ║ │
│ ║Postal address: Rue Wiertz 60, B-1047 Brussels │
│[1]cid:image001.png@01D42EFC.C1379A70║ │
│ ║Office address: Rue Montoyer 30, B-1000 Brussels │
│ ║ │
│ ║[2]cid:image003.png@01D42EFC.C1379A70 [3]edpb.europa.eu│
└─────────────────────────────────────╨───────────────────────────────────────────────────────┘

 

 

References

Visible links
3. https://www.edpb.europa.eu/

Dear Colleagues,

Thank you for this reply, and for the document you have disclosed to me. I have several questions that I would be grateful for you responses to.

First, the disclosed record does not include the table "Number of GDPR Notifications per LSA and per Procedure [Status: BROADCAST & CLOSED]", which the EDPB provided me in answer to a similar FOI request in 2021.
Is the table "Number of Initiated GDPR Notifications per Country [Status: Open & Closed"] that you have provided the same thing with a different title?
If it is not then please do include the table "Number of GDPR Notifications per LSA and per Procedure [Status: BROADCAST & CLOSED]".

Second, Why are there 303 (15% of the total) cases in the table titled "cases in the [case register] per LSA" assigned to no country "undefined"?

Third, I could not understand the reply to point vii in Mr Karadjov's letter. He notes that the EDPB holds statistics on the number of Article 56 procedures that are withdrawn. Therefore I do not understand the correction that he also makes regarding the IMI manual. I would be grateful for clarification to avoid any possibility of misunderstanding on our part.

Fourth, I would be grateful if you could clarify a question about the numbers in the "Numbers of Cases in the [Case Register] Per LSA" table. You note that these numbers are cumulative since 25 May 2018. To avoid any doubt, do these numbers include cases that are marked withdrawn in the IMI?

Fifth, I would be grateful for clarification on what the columns in the table "Number of Initiated GDPR Notifications per Country [Status: Open & Closed]" precisely refer to. For example

Sixth, I would be grateful for clarification on what the table "Article 56 - Identification of LSA and CSA - withdrawn is about. Are these the numbers of cases withdrawn in the period since 25 May 2018? or the number of cases where a CSA assumed another SA was the lead but it was then found not to be? or do the numbers refer to something else?

Faithfully,

Johnny Ryan

Dear colleagues,

A further question, too.

Following Brexit, why is the UK marked as LSA for 117 cases in the table "Number of Cases in the [Case Register] Per LSA"? Is this the figure of cases that it was previously the LSA for, before Brexit, and is that number now to be added to the "undefined" category?

Johnny

Dear colleagues,

I would welcome your reply to these questions.

Faithfully,

Johnny Ryan

European Data Protection Board

Dear Mr. Ryan,

Thank you for your message.

We apologise for the delay in getting back to you. This is due to the fact that staff members in a position to reply to your questions are currently on leave. We hope to be able to reply during next week.

We have noticed that one of your questions seems to be incomplete:

" Fifth, I would be grateful for clarification on what the columns in the table "Number of Initiated GDPR Notifications per Country [Status: Open & Closed]" precisely refer to. For example"

Could you please clarify/complete so that we may understand your question?

Thank you very much in advance for your cooperation and patience.

Best regards

EDPB Secretariat

show quoted sections

Dear colleagues,

Thank you for letting me know.

Forgive me for the incomplete question. There were two examples that I wanted to highlight in that question.
i) What do the numbers in the column titled “Article 56 identification of LSA and CSA” refer to? Is it the number of times a country has identified other countries as an LSA or CSA?
ii) What do the numbers in the column titled “Article 61 - Voluntary Notification” refer to? Is it the number of such notifications received, or sent, or both?

Also, please allow me to ask two additional questions.
In your message on 17 June you noted that “A case file can therefore lead to either one Art 60 decision (grouping the related complaints), or several different Art 60 decisions (e.g. if the LSA determines that the scope is not similar enough to handle them in one decision) or even none (e.g. if the complaint is withdrawn).”
Do you have any data or insight of any type in to whether this has occurred ever, and if so, how often it has occurred for each Member State or on average?

I would also like to know whether the table “Article 56 - Identification of LSA and CSA - withdrawn” also includes instances where CSAs have handled the matter themselves per Article 56(2)? If not, do you have any data or insight of any type in to how often this occurs on average?

Yours faithfully,

Johnny

Dear colleagues,

I would be grateful for your reply.

Faithfully,

Johnny Ryan

European Data Protection Board

Dear Mr. Ryan,

 

Please find below in red the replies to your questions.

 

Best regards

 

EDPB Secretariat

 

First, the disclosed record does not include the table "Number of GDPR
Notifications per LSA and per Procedure [Status: BROADCAST & CLOSED]",
which the EDPB provided me in answer to a similar FOI request in 2021.

Is the table "Number of Initiated GDPR Notifications per Country [Status:
Open & Closed"] that you have provided the same thing with a different
title?

If it is not then please do include the table "Number of GDPR
Notifications per LSA and per Procedure [Status: BROADCAST & CLOSED]". 

It is the same table. The new title is more accurate (some procedures not
started by an SA in its role as LSA, Germany is not "one SA").

 

Second, Why are there 303 (15% of the total) cases in the table titled
"cases in the [case register] per LSA" assigned to no country "undefined"?

These are Case Register Entries where no LSA has been indicated by the
Authority creating the entry. This could be in instances where the matter
does not refer to cross-border processing.

 

Third, I could not understand the reply to point vii in Mr Karadjov's
letter. He notes that the EDPB holds statistics on the number of Article
56 procedures that are withdrawn. Therefore I do not understand the
correction that he also makes regarding the IMI manual. I would be
grateful for clarification to avoid any possibility of misunderstanding on
our part.

Firstly, this overview was created manually to answer the question in your
request. It is as such not a document the EDPB holds readily available or
creates by default in the context of the statistics.

The withdrawal referenced in this case though will mean that the technical
process of sharing information and requesting a response from other SAs
has been withdrawn, i.e. it is no longer possible for the other SAs to
react to it. A reason for such a technical withdrawal could be, e.g. that
there was an error in the information given, information was missing, the
need for the procedure vanished, it was an accidental duplication, etc. It
does not refer, as such, to e.g. a legal withdrawal of a complaint.

 

Fourth, I would be grateful if you could clarify a question about the
numbers in the "Numbers of Cases in the [Case Register] Per LSA" table.
You note that these numbers are cumulative since 25 May 2018. To avoid any
doubt, do these numbers include cases that are marked withdrawn in the
IMI?Cases cannot be marked as "withdrawn" but "inactive" – the number of
inactive cases are not included in the statistics.

 

Fifth, I would be grateful for clarification on what the columns in the
table "Number of Initiated GDPR Notifications per Country [Status: Open &
Closed]" precisely refer to.  For example i) What do the numbers in the
column titled “Article 56 identification of LSA and CSA” refer to? Is it
the number of times a country has identified other countries as an LSA or
CSA?

It refers to the number of procedures that were started by the respective
SA or Member State with the aim of identifying or confirming the LSA of
the relevant cross-border processing and the supervisory authorities
concerned.

 

Sixth, I would be grateful for clarification on what the table "Article 56
- Identification of LSA and CSA - withdrawn is about. Are these the
numbers of cases withdrawn in the period since 25 May 2018? or the number
of cases where a CSA assumed another SA was the lead but it was then found
not to be? or do the numbers refer to something else?

 

This refers to all the withdrawn Art 56 – Identification of LSA and CSAs
procedures. As explained above, the reasons can be manifold. 

 

Following Brexit, why is the UK marked as LSA for 117 cases in the table
"Number of Cases in the [Case Register] Per LSA"?  Is this the figure of
cases that it was previously the LSA for, before Brexit, and is that
number now to be added to the "undefined" category?

 

These are case register entries for which previously the UK SA had
indicated itself as LSA. The information is retained for now, for internal
reference, separately to case register entries that are not assigned to an
SA.

 

ii) What do the numbers in the column titled “Article 61 - Voluntary
Notification” refer to? Is it the number of such notifications received,
or sent, or both?

There is no "Article 61 – Voluntary Notification" column. We assume you
refer to "Article 61 Voluntary Mutual Assistance Notification" – in any
case, it refers to the procedures initiated by that country.

 

In your message on 17 June you noted that “A case file can therefore lead
to either one Art 60 decision (grouping the related complaints), or
several different Art 60 decisions (e.g. if the LSA determines that the
scope is not similar enough to handle them in one decision) or even none
(e.g. if the complaint is withdrawn).”

Do you have any data or insight of any type in to whether this has
occurred ever, and if so, how often it has occurred for each Member State
or on average?

We do not collect statistics on this.

 

I would also like to know whether the table “Article 56 - Identification
of LSA and CSA - withdrawn” also includes instances where CSAs have
handled the matter themselves per Article 56(2)? If not, do you have any
data or insight of any type in to how often this occurs on average? 

There is no direct relationship between a withdrawn "Article 56 –
Identification of LSA and CSA" procedure. For Article 56(2) to apply,
first an LSA needs to be established. In the table "Number of Requests
sent by SA" and respectively "Number of Requests received by SA" the
column "Article 56 – local case" indicates in how many cases an SA has
asked/has been asked to apply Article 56(2). We do not have information on
whether these individual requests were granted or not.

 

 

show quoted sections

Dear Colleagues,

Thank you for these answers, for which I am most grateful.

Best wishes,

Johnny