Schrems II Material and updated EEG expertise on third countries

The request was partially successful.

Dear European Data Protection Board,

Under the right of access to documents in the EU treaties, as developed in Regulation 1049/2001, I am requesting documents which contain the following information:

1) Any questionnaires, accompanying documents, minutes or other material issued by the EDPB or national data protection supervisory authorities related to the 'Schrems II' case concerning the compliance of data controllers and processors with the Chapter V provisions of the GDPR on international data transfers.

2) Any expert report, legal opinion, evaluation matrix, checklist or other document, of any origin, regardless of its finalization (draft or final), that is available to the Board and that addresses the issue of third country (non-EU/EEA) compliance with the 'European Essential Guarantees', as described in Working Paper 237 and most recently in Recommendations 02/2020.
This request relates in particular to
- the United Kingdom of Great Britain and Northern Ireland,
- the United States of America,
- the People's Republic of China,
- the Federal Republic of India,
and any other third country for which documents of the above type are already available.

Documents already disclosed in the request of November 13, 2020 under reference 2020/37 and in the request of January 20, 2021 under reference 2021/01 do not need to be provided again.

Yours faithfully,

Enrique Broenstein

European Data Protection Board

Thank you for your message and for your interest in data protection. We
will look into your request and get back to you within due time. 
 
Kind regards,
 
The EDPB Secretariat

European Data Protection Board

Dear Mr. Broenstein,

Thank you for your email. However, the broad description given in your request does not enable us to adequately identify the scope of your request and, as a result, the concrete documents you are seeking access to.

In accordance with Article 6(1) of Regulation 1049/2001, applications for access to a document shall be made in a sufficiently precise manner to enable the institution to identify the document.

Following a preliminary assessment based on your request, the EDPB would incur a disproportionate workload in order to carry out the preliminary research required to identify the documents potentially related to your request, based on the information you have provided in your message below. In this regard, we would like to draw your attention to the EU case law enabling the institution to not proceed the preliminary research when the request is not precise (F-121/07, Strack v Commission), or on the possibility to refuse to identify the documents falling under the scope of a request if the identification would lead to a disproportionate workload (T-653/16, Malta v Commission).

In order to be able to proceed with analysing your request, we would therefore ask you to provide us with more information, which would allow us to identify the documents in scope of your request. While you are not required to provide any reasoning for your request, it may be helpful if you could provide us with any information on your interest in obtaining the documents, insofar as this would help us to determine the documents in scope of your request.

Thank you for your cooperation.

Kind regards,
The EDPB Secretariat

-----Original Message-----
From: Enrique Broenstein <[FOI #10205 email]>
Sent: 11 November 2021 17:07
To: European Data Protection Board <[EDPB request email]>
Subject: access to documents request - Schrems II Material and updated EEG expertise on third countries

Dear European Data Protection Board,

Under the right of access to documents in the EU treaties, as developed in Regulation 1049/2001, I am requesting documents which contain the following information:

1) Any questionnaires, accompanying documents, minutes or other material issued by the EDPB or national data protection supervisory authorities related to the 'Schrems II' case concerning the compliance of data controllers and processors with the Chapter V provisions of the GDPR on international data transfers.

2) Any expert report, legal opinion, evaluation matrix, checklist or other document, of any origin, regardless of its finalization (draft or final), that is available to the Board and that addresses the issue of third country (non-EU/EEA) compliance with the 'European Essential Guarantees', as described in Working Paper 237 and most recently in Recommendations 02/2020.
This request relates in particular to
- the United Kingdom of Great Britain and Northern Ireland,
- the United States of America,
- the People's Republic of China,
- the Federal Republic of India,
and any other third country for which documents of the above type are already available.

Documents already disclosed in the request of November 13, 2020 under reference 2020/37 and in the request of January 20, 2021 under reference 2021/01 do not need to be provided again.

Yours faithfully,

Enrique Broenstein

-------------------------------------------------------------------

This is a request for access to information under Article 15 of the TFEU and, where applicable, Regulation 1049/2001 which has been sent via the AsktheEU.org website.

Please kindly use this email address for all replies to this request: [FOI #10205 email]

If [EDPB request email] is the wrong address for information requests to European Data Protection Board, please tell the AsktheEU.org team on email [email address]

This message and all replies from European Data Protection Board will be published on the AsktheEU.org website. For more information see our dedicated page for EU public officials at https://www.asktheeu.org/en/help/officers

Please note that in some cases publication of requests and responses will be delayed.

-------------------------------------------------------------------

hide quoted sections

Dear European Data Protection Board,

Thank you for your email.

It seems rather surprising that within a period of just over a year after the Schrems II decision, such a large number of documents would have to be searched by the Board that it would amount to a "disproportionate workload". I would like to refer to the possibility of creating an index and fulfilling the FOI request in phases to introduce greater transparency into the work of the Union institutions (as per Recital 3 of Regulation (EC) No 1049/2001).

To specify the scope of my request, I would ask you to limit the request as follows:

No. 1): Limited to questionnaires or or other documents addressed at controllers or processors by EU data protection supervisory authorities for the purpose of supervising compliance with GDPR Chapter V provisions.

No. 2): Limited to the United States of America and the People's Republic of China, with documents dating from 2020 or 2021.

Yours sincerely,

Enrique Broenstein

European Data Protection Board

Dear Mr. Broenstein,

Many thanks for clarifying the scope of your request. We confirm registration of your access to documents request and registered it today under reference 2021/36. Please use this reference for further correspondence.

We are currently assessing your request and will provide you with a reply within 15 working days (10/12/2021).

Please note that the EDPB specific privacy statement regarding the processing of personal data for the purposes of handling requests for access to documents is available on the EDPB website and can be viewed via this link: https://edpb.europa.eu/sites/edpb/files/...

Should you have any further queries, please do not hesitate to contact us.

Best regards,

The EDPB Secretariat

-----Original Message-----
From: Enrique Broenstein <[FOI #10205 email]>
Sent: 12 November 2021 13:12
To: European Data Protection Board <[EDPB request email]>
Subject: Re: Your access to documents request - Schrems II Material and updated EEG expertise on third countries: request for clarification

Dear European Data Protection Board,

Thank you for your email.

It seems rather surprising that within a period of just over a year after the Schrems II decision, such a large number of documents would have to be searched by the Board that it would amount to a "disproportionate workload". I would like to refer to the possibility of creating an index and fulfilling the FOI request in phases to introduce greater transparency into the work of the Union institutions (as per Recital 3 of Regulation (EC) No 1049/2001).

To specify the scope of my request, I would ask you to limit the request as follows:

No. 1): Limited to questionnaires or or other documents addressed at controllers or processors by EU data protection supervisory authorities for the purpose of supervising compliance with GDPR Chapter V provisions.

No. 2): Limited to the United States of America and the People's Republic of China, with documents dating from 2020 or 2021.

Yours sincerely,

Enrique Broenstein

-----Original Message-----

Dear Mr. Broenstein,

Thank you for your email. However, the broad description given in your request does not enable us to adequately identify the scope of your request and, as a result, the concrete documents you are seeking access to.

In accordance with Article 6(1) of Regulation 1049/2001, applications for access to a document shall be made in a sufficiently precise manner to enable the institution to identify the document.

Following a preliminary assessment based on your request, the EDPB would incur a disproportionate workload in order to carry out the preliminary research required to identify the documents potentially related to your request, based on the information you have provided in your message below. In this regard, we would like to draw your attention to the EU case law enabling the institution to not proceed the preliminary research when the request is not precise (F-121/07, Strack v Commission), or on the possibility to refuse to identify the documents falling under the scope of a request if the identification would lead to a disproportionate workload (T-653/16, Malta v Commission).

In order to be able to proceed with analysing your request, we would therefore ask you to provide us with more information, which would allow us to identify the documents in scope of your request. While you are not required to provide any reasoning for your request, it may be helpful if you could provide us with any information on your interest in obtaining the documents, insofar as this would help us to determine the documents in scope of your request.

Thank you for your cooperation.

Kind regards,
The EDPB Secretariat

-------------------------------------------------------------------
Please use this email address for all replies to this request:
[FOI #10205 email]

This message and all replies from European Data Protection Board will be published on the AsktheEU.org website. For more information see our dedicated page for EU public officials at https://www.asktheeu.org/en/help/officers

Please note that in some cases publication of requests and responses will be delayed.

-------------------------------------------------------------------

hide quoted sections

European Data Protection Board

Dear Mr. Broenstein,

We refer to your email dated 11/11/2021 in which you made a request for access to documents, registered on 19/11/2021 under reference number 2021/36.

Your application is currently being handled. However, we will not be in a position to complete the handling of your application within the time limit of 15 working days, which expires today (10/12/2021).

An extended time limit is needed, as your application covers a large amount of documents that need to be identified and assessed.

Therefore, we have to extend the time limit for another 15 working days in accordance with Article 7(3) of Regulation (EC) No 1049/2001 regarding public access to documents. The new deadline expires on 11/01/2021.

We apologise for this delay and for any inconvenience this may cause.

Yours sincerely,

On behalf of
Ventsislav Karadjov, deputy chair of the EDPB

-----Original Message-----
From: European Data Protection Board <[Dirección de correo del organismo CEPD]>
Sent: 19 November 2021 20:57
To: Enrique Broenstein <[Dirección de correo de la solicitud #10205]>
Cc: European Data Protection Board <[Dirección de correo del organismo CEPD]>
Subject: Case reference number 2021-36 - Request for access to documents - acknowledgment of receipt

Dear Mr. Broenstein,

Many thanks for clarifying the scope of your request. We confirm registration of your access to documents request and registered it today under reference 2021/36. Please use this reference for further correspondence.

We are currently assessing your request and will provide you with a reply within 15 working days (10/12/2021).

Please note that the EDPB specific privacy statement regarding the processing of personal data for the purposes of handling requests for access to documents is available on the EDPB website and can be viewed via this link: https://edpb.europa.eu/sites/edpb/files/...

Should you have any further queries, please do not hesitate to contact us.

Best regards,

The EDPB Secretariat

-----Original Message-----
From: Enrique Broenstein <[Dirección de correo de la solicitud #10205]>
Sent: 12 November 2021 13:12
To: European Data Protection Board <[Dirección de correo del organismo CEPD]>
Subject: Re: Your access to documents request - Schrems II Material and updated EEG expertise on third countries: request for clarification

Dear European Data Protection Board,

Thank you for your email.

It seems rather surprising that within a period of just over a year after the Schrems II decision, such a large number of documents would have to be searched by the Board that it would amount to a "disproportionate workload". I would like to refer to the possibility of creating an index and fulfilling the FOI request in phases to introduce greater transparency into the work of the Union institutions (as per Recital 3 of Regulation (EC) No 1049/2001).

To specify the scope of my request, I would ask you to limit the request as follows:

No. 1): Limited to questionnaires or or other documents addressed at controllers or processors by EU data protection supervisory authorities for the purpose of supervising compliance with GDPR Chapter V provisions.

No. 2): Limited to the United States of America and the People's Republic of China, with documents dating from 2020 or 2021.

Yours sincerely,

Enrique Broenstein

-----Original Message-----

Dear Mr. Broenstein,

Thank you for your email. However, the broad description given in your request does not enable us to adequately identify the scope of your request and, as a result, the concrete documents you are seeking access to.

In accordance with Article 6(1) of Regulation 1049/2001, applications for access to a document shall be made in a sufficiently precise manner to enable the institution to identify the document.

Following a preliminary assessment based on your request, the EDPB would incur a disproportionate workload in order to carry out the preliminary research required to identify the documents potentially related to your request, based on the information you have provided in your message below. In this regard, we would like to draw your attention to the EU case law enabling the institution to not proceed the preliminary research when the request is not precise (F-121/07, Strack v Commission), or on the possibility to refuse to identify the documents falling under the scope of a request if the identification would lead to a disproportionate workload (T-653/16, Malta v Commission).

In order to be able to proceed with analysing your request, we would therefore ask you to provide us with more information, which would allow us to identify the documents in scope of your request. While you are not required to provide any reasoning for your request, it may be helpful if you could provide us with any information on your interest in obtaining the documents, insofar as this would help us to determine the documents in scope of your request.

Thank you for your cooperation.

Kind regards,
The EDPB Secretariat

-------------------------------------------------------------------
Please use this email address for all replies to this request:
[Dirección de correo de la solicitud #10205]

This message and all replies from European Data Protection Board will be published on the AsktheEU.org website. For more information see our dedicated page for EU public officials at https://www.asktheeu.org/en/help/officers

Please note that in some cases publication of requests and responses will be delayed.

-------------------------------------------------------------------

hide quoted sections

European Data Protection Board

2 Attachments

Dear Mr. Broenstein,

Please find attached the answer from Mr. Karadjov, EDPB Deputy Chair, with regard to your access request.

Regarding document 25, please find hereafter, for your convenience, the hyperlink to the document (also included in the reply letter): https://edpb.europa.eu/system/files/2022...

Sincerely,

The EDPB Secretariat

-----Original Message-----
From: European Data Protection Board <[EDPB request email]>
Sent: 10 December 2021 11:30
To: Enrique Broenstein <[FOI #10205 email]>
Cc: European Data Protection Board <[EDPB request email]>
Subject: Reference number (2021/36) - Request for access to documents - Extension of deadline

Dear Mr. Broenstein,

We refer to your email dated 11/11/2021 in which you made a request for access to documents, registered on 19/11/2021 under reference number 2021/36.

Your application is currently being handled. However, we will not be in a position to complete the handling of your application within the time limit of 15 working days, which expires today (10/12/2021).

An extended time limit is needed, as your application covers a large amount of documents that need to be identified and assessed.

Therefore, we have to extend the time limit for another 15 working days in accordance with Article 7(3) of Regulation (EC) No 1049/2001 regarding public access to documents. The new deadline expires on 11/01/2021.

We apologise for this delay and for any inconvenience this may cause.

Yours sincerely,

On behalf of
Ventsislav Karadjov, deputy chair of the EDPB

-----Original Message-----
From: European Data Protection Board <[EDPB request email]>
Sent: 19 November 2021 20:57
To: Enrique Broenstein <[FOI #10205 email]>
Cc: European Data Protection Board <[EDPB request email]>
Subject: Case reference number 2021-36 - Request for access to documents - acknowledgment of receipt

Dear Mr. Broenstein,

Many thanks for clarifying the scope of your request. We confirm registration of your access to documents request and registered it today under reference 2021/36. Please use this reference for further correspondence.

We are currently assessing your request and will provide you with a reply within 15 working days (10/12/2021).

Please note that the EDPB specific privacy statement regarding the processing of personal data for the purposes of handling requests for access to documents is available on the EDPB website and can be viewed via this link: https://edpb.europa.eu/sites/edpb/files/...

Should you have any further queries, please do not hesitate to contact us.

Best regards,

The EDPB Secretariat

-----Original Message-----
From: Enrique Broenstein <[FOI #10205 email]>
Sent: 12 November 2021 13:12
To: European Data Protection Board <[EDPB request email]>
Subject: Re: Your access to documents request - Schrems II Material and updated EEG expertise on third countries: request for clarification

Dear European Data Protection Board,

Thank you for your email.

It seems rather surprising that within a period of just over a year after the Schrems II decision, such a large number of documents would have to be searched by the Board that it would amount to a "disproportionate workload". I would like to refer to the possibility of creating an index and fulfilling the FOI request in phases to introduce greater transparency into the work of the Union institutions (as per Recital 3 of Regulation (EC) No 1049/2001).

To specify the scope of my request, I would ask you to limit the request as follows:

No. 1): Limited to questionnaires or or other documents addressed at controllers or processors by EU data protection supervisory authorities for the purpose of supervising compliance with GDPR Chapter V provisions.

No. 2): Limited to the United States of America and the People's Republic of China, with documents dating from 2020 or 2021.

Yours sincerely,

Enrique Broenstein

-----Original Message-----

Dear Mr. Broenstein,

Thank you for your email. However, the broad description given in your request does not enable us to adequately identify the scope of your request and, as a result, the concrete documents you are seeking access to.

In accordance with Article 6(1) of Regulation 1049/2001, applications for access to a document shall be made in a sufficiently precise manner to enable the institution to identify the document.

Following a preliminary assessment based on your request, the EDPB would incur a disproportionate workload in order to carry out the preliminary research required to identify the documents potentially related to your request, based on the information you have provided in your message below. In this regard, we would like to draw your attention to the EU case law enabling the institution to not proceed the preliminary research when the request is not precise (F-121/07, Strack v Commission), or on the possibility to refuse to identify the documents falling under the scope of a request if the identification would lead to a disproportionate workload (T-653/16, Malta v Commission).

In order to be able to proceed with analysing your request, we would therefore ask you to provide us with more information, which would allow us to identify the documents in scope of your request. While you are not required to provide any reasoning for your request, it may be helpful if you could provide us with any information on your interest in obtaining the documents, insofar as this would help us to determine the documents in scope of your request.

Thank you for your cooperation.

Kind regards,
The EDPB Secretariat

-------------------------------------------------------------------
Please use this email address for all replies to this request:
[FOI #10205 email]

This message and all replies from European Data Protection Board will be published on the AsktheEU.org website. For more information see our dedicated page for EU public officials at https://www.asktheeu.org/en/help/officers

Please note that in some cases publication of requests and responses will be delayed.

-------------------------------------------------------------------

hide quoted sections