Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

Heiko Roth made this access to documents request to European Data Protection Board

Automatic anti-spam measures are in place for this older request. Please let us know if a further response is expected or if you are having trouble responding.

The request was successful.

Dear European Data Protection Board,

Under the right of access to documents in the EU treaties, as developed in Regulation 1049/2001, I am requesting documents which contain the following information:

1 CONTEXT of my request

On 11/10/2020, the EDPB published the "Recommendations 02/2020 on the European Essential Guarantees for surveillance measures" as "adopted":

https://edpb.europa.eu/sites/default/fil...

Apparently, no public consultation was carried out before the publication of the final recommendation, as is usually the case. This is what my question refers to.

2 REQUEST itself

2.1 Documentation showing why there was no public consultation.

2.2 Documents containing information used to prepare Recommendations 02/2020 (e.g., legal opinions, third-party comments, own research).

Yours faithfully,
Heiko Roth

European Data Protection Board

Thank you for your message and for your interest in data protection. We
will look into your request and get back to you within due time.
The EDPB Secretariat

European Data Protection Board

Dear Mr. Roth,

Thank you for your message.

We are writing with reference to your recent requests for access to documents regarding the following topics:

1. DPA, SDPC and TIA for the use of the Confluence service by EDPB –registered as 2022-04 with deadline to reply 07/02
2. anonymized interview results (...) as referenced in the Annex 1 to the Final Report (..) – registered as 2022-05 with deadline to reply 08/02
3. EDPB-Taskforce documents regarding NOYB 101 complaints (...) – registered as 2022-06 with deadline to reply 09/02
4. Personal data processing services/software (e.g., as processor/data importer) located outside the EU/EEA registered as 2022-08 with deadline to reply 10/02
5. Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

While it is your right under Regulation 1049/2001 to request access to all those documents, at the moment the EDPB Secretariat does not have the resources to handle all of these requests at the same time (also taking into account other requests for access to documents submitted by other applicants), within the legal deadlines foreseen in Regulation 1049/2001.

Therefore, we will handle them in two phases: first, we will handle the four requests which have already been registered. As regards the other request, we will register it at a later stage, once we have handled your first four requests, in order to allow us sufficient time to identify and assess the documents in scope.

Please let us know if you oppose to this and whether you have any questions. We thank you in advance for your understanding and response to this request.

Best regards

EDPB Secretariat

show quoted sections

Dear EDPB Secretariat,

Thank you very much for taking care of my requests. You are welcome to proceed as suggested. I have absolute understanding for a resource-oriented approach.

Yours sincerely,
HR

European Data Protection Board

2 Attachments

Dear Mr. Roth,

 

Thank you for your message below and for accepting that we handle your
request regarding the Recommendations 02/2020 on the European Essential
Guarantees for surveillance measures once we have handled your previous
four registered requests.

 

We have noted that you have in the meantime sent two further requests, one
which concerns Working Documents for Guidelines regarding Art. 48 GDPR and
another which concerns the work of the EDPB expert subgroups and in
particular the expert subgroup for international transfers.

 

As mentioned in our email of 21 January below, at the moment the EDPB
Secretariat does not have the resources to handle all of these requests at
the same time (also taking into account other requests for access to
documents submitted by other applicants), within the legal deadlines
foreseen in Regulation 1049/2001.

 

Therefore, we will handle these three requests one by one at a later
stage, once we have handled your four registered requests.

 

Please note that we may still need to contact you prior to registering
these requests, in case clarification are needed regarding the scope.

 

Please let us know if you oppose to this and whether you have any
questions. We thank you in advance for your understanding.

 

Best regards,

 

EDPB Secretariat

 

 

+--------------------------------------------------------------------------------------------+
| |European Data Protection Board |
| | |
| |Postal address: Rue Wiertz 60, B-1047 Brussels |
|[1]cid:image001.png@01D42EFC.C1379A70| |
| |Office address: Rue Montoyer 30, B-1000 Brussels |
| | |
| |[2]cid:image003.png@01D42EFC.C1379A70[3]edpb.europa.eu|
+--------------------------------------------------------------------------------------------+

 

 

 

show quoted sections

European Data Protection Board

Dear Mr. Roth,

 

Thank you for your email.

 

As explained in our previous emails (most recently on 17/02), at the
moment the EDPB Secretariat does not have the resources to handle all of
your requests at the same time (also taking into account other requests
for access to documents submitted by other applicants), within the legal
deadlines foreseen in Regulation 1049/2001.

 

We have therefore informed you that your requests will be handled, one by
one, once we have responded to your three currently ongoing requests
(2022-04, 2022-06 and 2022-08). The respective deadlines for replying to
these three requests are, as already communicated to you, 28/02, 02/03 and
03/03.

 

Once the last of these three requests has been replied to, we will
register your next request in chronological order, unless you indicate a
different priority.

 

Please find below a list of your current pending requests, in
chronological order:

 

Received Request
Recommendations
02/2020 on the
European
Essential
Guarantees for
surveillance
measures. 1.
Documentation
showing why
there was no
19/01/2022 public
consultation.
2. Documents
containing
information
used to prepare
Recommendations
02/2020 (e.g.,
legal opinions,
third-party
comments, own
research).
1 All documents
(e.g.
statements,
expert
opinions, press
reports,
guidelines)
related to the
development of
the above
mentioned
29/01/2022 Guidelines on
Art. 48 GDPR.
2. An
indication of
what the
current
progress is in
the development
of the
above-mentioned
Guidelines on
Art. 48 GDPR
1. Current
overview of all
subgroups of
the EDPB with a
breakdown of
which
authorities of
which EU member
state are
represented in
which subgroup
2. Minutes,
opinions,
statements and
29/01/2022 other documents
that have been
used by the
members of the
ITS since
16.07.2020 in
the context of
the work of the
ITS. 3. 3
Indication of
the
relationship of
the subgroups
to the EDPB
(e.g. advisory
role only).
CEF. 1)
Information,
embodied in
particular in
documents such
as sample
questionnaires
or sampling
parameters,
which provide
information on
how contact and
exchange is or
will be made
with the
'public' bodies
mentioned in
the press
15/02/2022 release as part
of the
coordinated
audit on the
part of the
BfDI 2)
Information, in
particular
embodied in
documents,
which provide
information
about when
exactly the
audit mentioned
in the press
release was or
will be
started.
CEF: 1) )
information,
embodied in
particular in
documents,
indicating
which of the
European
regulators are
meant in both
PR that have
joined the
joint
coordinated
review of cloud
15/02/2022 services in the
public sector.
2) information,
embodied in
particular in
documents,
indicating How
the "75" public
bodies
mentioned in
PR2 were
selected and
which public
bodies they are
in detail (name
of the public
bodies).
Opinion 03/2022
on the draft
decision of the
French
Supervisory
Authority
regarding the
Processor
Binding
Corporate Rules
of the WEBHELP
Group - 1.
Documents
provided to the
EDPB by the
French
regulator or by
the WEBHELP
Group such that
the EDPB has
concluded, as
cited in 1
above, that the
BCRs of the
WEBHELP Group
contain
19/02/2022 "adequate
safeguards" as
defined above
(e.g.,
documents
comparable to a
'Transfer
Impact
Assessment').
2. Beyond the
documents in
2.1, such
documents that
provide
information on
how the EDPB
has arrived at
the assessment
by others that
WEBHELP Group's
BCRs contain
"appropriate
safeguards" as
defined above
(e.g., through
internal legal
opinions of the
EDPB).

 

The next request we intend to register is therefore the one you have sent
on 19/02, regarding European Essential Guarantees. In case you prefer to
have a different request handled first, please let us know this no later
than 2 March end of business.

 

Please note we will contact you separately, via the relevant ask-the-eu
email address regarding any of your requests which require clarifications.

 

We remain available in case of any questions.

 

Best regards

 

EDPB Secretariat

 

 

show quoted sections

European Data Protection Board

Dear Mr. Roth,

 

In the absence of any reply to our email below of 28/02, we confirm
registration of your next access to documents request listed below
("Recommendations 02/2020 on the European Essential Guarantees for
surveillance measures") and registered it today under reference 2022/21.
Please use this reference for further correspondence.

 

We are currently assessing your request and will provide you with a reply
within 15 working days (24/03/2022).

 

Please note that the EDPB specific privacy statement regarding the
processing of personal data for the purposes of handling requests for
access to documents is available on the EDPB website and can be viewed via
this link:
[1]https://edpb.europa.eu/sites/edpb/files/...

 

As mentioned in our email below, once we have replied to this request, we
will proceed with registering your next request in the order it has been
received, i.e. the one related to guidelines on Article 48 GDPR.

 

Should you have any further queries, please do not hesitate to contact us.

 

Best regards,

 

The EDPB Secretariat

 

 

From: European Data Protection Board <[EDPB request email]>
Sent: 28 February 2022 15:33
To: Heiko Roth <[email address]>
Cc: European Data Protection Board <[EDPB request email]>;
[FOI #10565 email]
Subject: RE: access to documents request - Working Documents for
Guidelines regarding Art. 48 GDPR

 

Dear Mr. Roth,

 

Thank you for your email.

 

As explained in our previous emails (most recently on 17/02), at the
moment the EDPB Secretariat does not have the resources to handle all of
your requests at the same time (also taking into account other requests
for access to documents submitted by other applicants), within the legal
deadlines foreseen in Regulation 1049/2001.

 

We have therefore informed you that your requests will be handled, one by
one, once we have responded to your three currently ongoing requests
(2022-04, 2022-06 and 2022-08). The respective deadlines for replying to
these three requests are, as already communicated to you, 28/02, 02/03 and
03/03.

 

Once the last of these three requests has been replied to, we will
register your next request in chronological order, unless you indicate a
different priority.

 

Please find below a list of your current pending requests, in
chronological order:

 

Received Request
Recommendations
02/2020 on the
European
Essential
Guarantees for
surveillance
measures. 1.
Documentation
showing why
there was no
19/01/2022 public
consultation.
2. Documents
containing
information
used to prepare
Recommendations
02/2020 (e.g.,
legal opinions,
third-party
comments, own
research).
1 All documents
(e.g.
statements,
expert
opinions, press
reports,
guidelines)
related to the
development of
the above
mentioned
29/01/2022 Guidelines on
Art. 48 GDPR.
2. An
indication of
what the
current
progress is in
the development
of the
above-mentioned
Guidelines on
Art. 48 GDPR
1. Current
overview of all
subgroups of
the EDPB with a
breakdown of
which
authorities of
which EU member
state are
represented in
which subgroup
2. Minutes,
opinions,
statements and
29/01/2022 other documents
that have been
used by the
members of the
ITS since
16.07.2020 in
the context of
the work of the
ITS. 3. 3
Indication of
the
relationship of
the subgroups
to the EDPB
(e.g. advisory
role only).
CEF. 1)
Information,
embodied in
particular in
documents such
as sample
questionnaires
or sampling
parameters,
which provide
information on
how contact and
exchange is or
will be made
with the
'public' bodies
mentioned in
the press
15/02/2022 release as part
of the
coordinated
audit on the
part of the
BfDI 2)
Information, in
particular
embodied in
documents,
which provide
information
about when
exactly the
audit mentioned
in the press
release was or
will be
started.
CEF: 1) )
information,
embodied in
particular in
documents,
indicating
which of the
European
regulators are
meant in both
PR that have
joined the
joint
coordinated
review of cloud
15/02/2022 services in the
public sector.
2) information,
embodied in
particular in
documents,
indicating How
the "75" public
bodies
mentioned in
PR2 were
selected and
which public
bodies they are
in detail (name
of the public
bodies).
Opinion 03/2022
on the draft
decision of the
French
Supervisory
Authority
regarding the
Processor
Binding
Corporate Rules
of the WEBHELP
Group - 1.
Documents
provided to the
EDPB by the
French
regulator or by
the WEBHELP
Group such that
the EDPB has
concluded, as
cited in 1
above, that the
BCRs of the
WEBHELP Group
contain
19/02/2022 "adequate
safeguards" as
defined above
(e.g.,
documents
comparable to a
'Transfer
Impact
Assessment').
2. Beyond the
documents in
2.1, such
documents that
provide
information on
how the EDPB
has arrived at
the assessment
by others that
WEBHELP Group's
BCRs contain
"appropriate
safeguards" as
defined above
(e.g., through
internal legal
opinions of the
EDPB).

 

The next request we intend to register is therefore the one you have sent
on 19/02, regarding European Essential Guarantees. In case you prefer to
have a different request handled first, please let us know this no later
than 2 March end of business.

 

Please note we will contact you separately, via the relevant ask-the-eu
email address regarding any of your requests which require clarifications.

 

We remain available in case of any questions.

 

Best regards

 

EDPB Secretariat

 

 

show quoted sections

European Data Protection Board

Dear Mr. Roth,

 

We refer to your email dated 19/01/2022 in which you made a request for
access to documents, registered on 03/03/2022 under reference number
2022/21.

 

Your application is currently being handled. However, we will not be in a
position to complete the handling of your application within the time
limit of 15 working days, which expires today (24/03/2022).

 

An extended time limit is needed, as your application covers a large
amount of documents that need to be identified and assessed.

 

Therefore, we have to extend the time limit for another 15 working days in
accordance with Article 7(3) of Regulation (EC) No 1049/2001 regarding
public access to documents. The new deadline expires on 19/04/2022.

 

We apologise for this delay and for any inconvenience this may cause.

 

Finally, we take the opportunity to remind you that, in line with the
message sent to you on 17/02/2022 (copied below for your reference), once
the present request has been closed, we will proceed with registering the
next of your requests in chronological order. The next request is
therefore the one you have sent on 29/01/2022, regarding documents related
to the development of guidelines on Article 48 GDPR. In case you prefer to
have a different request handled first, please let us know this no later
than 7 April end of business.

 

 

Yours sincerely,

 

On behalf of

Ventsislav Karadjov, deputy chair of the EDPB

 

 

From: European Data Protection Board <[1][EDPB request email]>
Sent: 28 February 2022 15:33
To: Heiko Roth <[2][email address]>
Cc: European Data Protection Board <[3][EDPB request email]>;
[4][FOI #10565 email]
Subject: RE: access to documents request - Working Documents for
Guidelines regarding Art. 48 GDPR

 

Dear Mr. Roth,

 

Thank you for your email.

 

As explained in our previous emails (most recently on 17/02), at the
moment the EDPB Secretariat does not have the resources to handle all of
your requests at the same time (also taking into account other requests
for access to documents submitted by other applicants), within the legal
deadlines foreseen in Regulation 1049/2001.

 

We have therefore informed you that your requests will be handled, one by
one, once we have responded to your three currently ongoing requests
(2022-04, 2022-06 and 2022-08). The respective deadlines for replying to
these three requests are, as already communicated to you, 28/02, 02/03 and
03/03.

 

Once the last of these three requests has been replied to, we will
register your next request in chronological order, unless you indicate a
different priority.

 

Please find below a list of your current pending requests, in
chronological order:

 

Received Request
Recommendations
02/2020 on the
European
Essential
Guarantees for
surveillance
measures. 1.
Documentation
showing why
there was no
19/01/2022 public
consultation.
2. Documents
containing
information
used to prepare
Recommendations
02/2020 (e.g.,
legal opinions,
third-party
comments, own
research).
1 All documents
(e.g.
statements,
expert
opinions, press
reports,
guidelines)
related to the
development of
the above
mentioned
29/01/2022 Guidelines on
Art. 48 GDPR.
2. An
indication of
what the
current
progress is in
the development
of the
above-mentioned
Guidelines on
Art. 48 GDPR
1. Current
overview of all
subgroups of
the EDPB with a
breakdown of
which
authorities of
which EU member
state are
represented in
which subgroup
2. Minutes,
opinions,
statements and
29/01/2022 other documents
that have been
used by the
members of the
ITS since
16.07.2020 in
the context of
the work of the
ITS. 3. 3
Indication of
the
relationship of
the subgroups
to the EDPB
(e.g. advisory
role only).
CEF. 1)
Information,
embodied in
particular in
documents such
as sample
questionnaires
or sampling
parameters,
which provide
information on
how contact and
exchange is or
will be made
with the
'public' bodies
mentioned in
the press
15/02/2022 release as part
of the
coordinated
audit on the
part of the
BfDI 2)
Information, in
particular
embodied in
documents,
which provide
information
about when
exactly the
audit mentioned
in the press
release was or
will be
started.
CEF: 1) )
information,
embodied in
particular in
documents,
indicating
which of the
European
regulators are
meant in both
PR that have
joined the
joint
coordinated
review of cloud
15/02/2022 services in the
public sector.
2) information,
embodied in
particular in
documents,
indicating How
the "75" public
bodies
mentioned in
PR2 were
selected and
which public
bodies they are
in detail (name
of the public
bodies).
Opinion 03/2022
on the draft
decision of the
French
Supervisory
Authority
regarding the
Processor
Binding
Corporate Rules
of the WEBHELP
Group - 1.
Documents
provided to the
EDPB by the
French
regulator or by
the WEBHELP
Group such that
the EDPB has
concluded, as
cited in 1
above, that the
BCRs of the
WEBHELP Group
contain
19/02/2022 "adequate
safeguards" as
defined above
(e.g.,
documents
comparable to a
'Transfer
Impact
Assessment').
2. Beyond the
documents in
2.1, such
documents that
provide
information on
how the EDPB
has arrived at
the assessment
by others that
WEBHELP Group's
BCRs contain
"appropriate
safeguards" as
defined above
(e.g., through
internal legal
opinions of the
EDPB).

 

The next request we intend to register is therefore the one you have sent
on 19/02, regarding European Essential Guarantees. In case you prefer to
have a different request handled first, please let us know this no later
than 2 March end of business.

 

Please note we will contact you separately, via the relevant ask-the-eu
email address regarding any of your requests which require clarifications.

 

We remain available in case of any questions.

 

Best regards

 

EDPB Secretariat

 

 

 

References

Visible links
1. mailto:[EDPB request email]
2. mailto:[email address]
3. mailto:[EDPB request email]
4. mailto:[FOI #10565 email]

European Data Protection Board

8 Attachments

Dear Mr Roth,

 

Please find attached the reply to your access to documents request
(2022-21), signed by Mr Ventsislav Karadjov, Vice-Chair of the EDPB.

 

Best regards,

The EDPB Secretariat

 

┌─────────────────────────────────────╥───────────────────────────────────────────────────────┐
│ ║European Data Protection Board │
│ ║ │
│ ║Postal address: Rue Wiertz 60, B-1047 Brussels │
│[1]cid:image001.png@01D42EFC.C1379A70║ │
│ ║Office address: Rue Montoyer 30, B-1000 Brussels │
│ ║ │
│ ║[2]cid:image003.png@01D42EFC.C1379A70 [3]edpb.europa.eu│
└─────────────────────────────────────╨───────────────────────────────────────────────────────┘

 

 

 

References

Visible links
3. https://www.edpb.europa.eu/

European Data Protection Board

4 Attachments

Dear Mr. Roth,

 

Please find enclosed the reply to your request for access to documents
(ref. 2022-40) signed by Mr. Ventsislav Karadjov, Vice-Chair of the EDPB.

 

You will receive the attachments in three separate emails due to the size
of the files (18 attachments in total).

 

Could you please acknowledge receipt of the files?

 

Best regards,

The EDPB Secretariat

 

┌─────────────────────────────────────╥───────────────────────────────────────────────────────┐
│ ║European Data Protection Board │
│ ║ │
│ ║Postal address: Rue Wiertz 60, B-1047 Brussels │
│[1]cid:image001.png@01D42EFC.C1379A70║ │
│ ║Office address: Rue Montoyer 30, B-1000 Brussels │
│ ║ │
│ ║[2]cid:image003.png@01D42EFC.C1379A70 [3]edpb.europa.eu│
└─────────────────────────────────────╨───────────────────────────────────────────────────────┘

 

References

Visible links
3. https://www.edpb.europa.eu/

European Data Protection Board

3 Attachments

Dear Mr. Roth,

 

Please find attached the second part of the attachments.

 

Best regards,

The EDPB Secretariat

 

 

From: European Data Protection Board <[EDPB request email]>
Sent: 04 July 2022 11:35
To: [FOI #10565 email]
Cc: European Data Protection Board <[EDPB request email]>
Subject: Case 2022/40 - Reply to request for access to documents

 

Dear Mr. Roth,

 

Please find enclosed the reply to your request for access to documents
(ref. 2022-40) signed by Mr. Ventsislav Karadjov, Vice-Chair of the EDPB.

 

You will receive the attachments in three separate emails due to the size
of the files (18 attachments in total).

 

Could you please acknowledge receipt of the files?

 

Best regards,

The EDPB Secretariat

 

┌─────────────────────────────────────╥───────────────────────────────────────────────────────┐
│ ║European Data Protection Board │
│ ║ │
│ ║Postal address: Rue Wiertz 60, B-1047 Brussels │
│[1]cid:image001.png@01D42EFC.C1379A70║ │
│ ║Office address: Rue Montoyer 30, B-1000 Brussels │
│ ║ │
│ ║[2]cid:image003.png@01D42EFC.C1379A70 [3]edpb.europa.eu│
└─────────────────────────────────────╨───────────────────────────────────────────────────────┘

 

References

Visible links
3. https://www.edpb.europa.eu/

European Data Protection Board

3 Attachments

Dear Mr. Roth,

 

Please find attached the last attachment.

 

Best regards,

The EDPB Secretariat

 

 

From: European Data Protection Board <[EDPB request email]>
Sent: 04 July 2022 11:37
To: [FOI #10565 email]
Cc: European Data Protection Board <[EDPB request email]>
Subject: RE: Case 2022/40 - Reply to request for access to documents

 

Dear Mr. Roth,

 

Please find attached the second part of the attachments.

 

Best regards,

The EDPB Secretariat

 

 

From: European Data Protection Board <[1][EDPB request email]>
Sent: 04 July 2022 11:35
To: [2][FOI #10565 email]
Cc: European Data Protection Board <[3][EDPB request email]>
Subject: Case 2022/40 - Reply to request for access to documents

 

Dear Mr. Roth,

 

Please find enclosed the reply to your request for access to documents
(ref. 2022-40) signed by Mr. Ventsislav Karadjov, Vice-Chair of the EDPB.

 

You will receive the attachments in three separate emails due to the size
of the files (18 attachments in total).

 

Could you please acknowledge receipt of the files?

 

Best regards,

The EDPB Secretariat

 

┌─────────────────────────────────────╥───────────────────────────────────────────────────────┐
│ ║European Data Protection Board │
│ ║ │
│ ║Postal address: Rue Wiertz 60, B-1047 Brussels │
│[4]cid:image001.png@01D42EFC.C1379A70║ │
│ ║Office address: Rue Montoyer 30, B-1000 Brussels │
│ ║ │
│ ║[5]cid:image003.png@01D42EFC.C1379A70 [6]edpb.europa.eu│
└─────────────────────────────────────╨───────────────────────────────────────────────────────┘

 

References

Visible links
1. mailto:[EDPB request email]
2. mailto:[FOI #10565 email]
3. mailto:[EDPB request email]
6. https://www.edpb.europa.eu/