LEONARDO CERVERA NAVAS
DIRECTOR
Dr Enrique BROENSTEIN
by email only: ask+request-8772-
xxxxxxxx@xxxxxxxx.xxx
Brussels, 14 January 2021
LCN/SP/TT/ktl/ D(2021)0071
C 2020-1092
Please use xxxx@xxxx.xxxxxx.xx for all
correspondence
Subject:
Your request for access to documents under Regulation (EC) 1049/2001
Dear Mr Broenstein,
On 19 November 2020, you sent an access to documents request to the EDPS on the basis of
Regulation (EC) 1049/2001, which was registered on the same day also mentioning the
extension of the deadline in accordance with Article 7(3) of Regulation (EC) 1049/2001.
You request
“to documents held by the EDPS that address the issue of third country (non-
EU/EEA) compliance with the European Essential Guarantees, regardless of their nature or
origin (see my initial request), especially as the EDPS itself asked EUIs to carry out case-by-
case Transfer Impact Assessments (TIAs) in its 'Strategy for Union institutions, offices, bodies
and agencies to comply with the ‘Schrems II’ Ruling' dated 29 October 2020.
In particular, the EDPS required EUIs to decide as to whether it is possible to continue the
transfers identified in the mapping exercise and report by 15 November 2020 at the latest, on
specific risks and gaps they identified during this mapping exercise (see, page 8 of the
abovementioned Strategy).
Furthermore, the EDPS expressly stated it "will provide a list of preliminary questions for EUI
controllers" on TIAs (loc. cit.).
I thus kindly request that any such list of questions, expert report, legal opinion, evaluation
matrix, checklist or other document on the matter of EEG compliance be provided within the
statutory term.
Postal address: rue Wiertz 60 - B-1047 Brussels
Offices: rue Montoyer 30 - B-1000 Brussels
E-mail: xxxx@xxxx.xxxxxx.xx - Website: www.edps.europa.eu
Tel.: 32 2-283 19 00 - Fax : 32 2-283 19 50
In your earlier communication to EDPS from 13 November 2020 you requested
“Any expert
report, legal opinion, evaluation matrix, checklist or other document, of any origin, regardless
of its finalization (draft or final), that is available to the Board and that addresses the issue of
third country (non-EU/EEA) compliance with the 'European Essential Guarantees', as
described in Working Paper 237 (by the former Art. 29 Working Party) and most recently in
EDPB Recommendation 02/2020. This request relates in particular to the United States of
America, the People's Republic of China, the Federal Republic of India, and any other third
country for which documents of the above type are already available.” Although it refers to
documents held by EDPB, which is separate and independent institution, we took into account
this request too.
We are pleased to inform you that partial access is granted in line with your request with the
exception of access to personal data in line with Article 4(1)(b) of Regulation (EC) 1049/2001
for 38 documents annexed to this letter.
If you would like to request access to the redacted personal data please provide the EDPS with
a legitimate justification or compelling argument to demonstrate the necessity for the personal
data to be disclosed1 (see below for information about the confirmatory application).
In addition with the exception of personal data in line with Article 4(1)(b) of Regulation (EC)
1049/2001, partial access is granted to some of these documents based on the following specific
reasons:
-
disclosure would undermine the protection of public interest as regards public security
Article 4(1)(a);
-
disclosure would undermine the protection of the purpose of inspections, investigations
and audits Article 4(2)(3rd paragraph).
Please be informed that transmission of the documents above to you may have to be done in
parts, given the volume of some of the documents.
With regards to your request related to “
Transfer Impact Assessments (TIAs) in its 'Strategy for
Union institutions, offices, bodies and agencies to comply with the ‘Schrems II’ Ruling'”, we
regret to inform you that we cannot provide you with access to any documents, as they are part
of ongoing procedure, where the decision is not yet taken by EDPS and thus fall within the
exceptions of art. 4(3) of Regulation 1049/2001.
Please note that pursuant to Article 7(2) of Regulation 1049/2001, you may make a
confirmatory application asking the EDPS to reconsider his position as regards to the refusal
and partial refusal of your request. Such a confirmatory application should be addressed within
15 working days upon receipt of this letter to the EDPS general e-mail: xxxx@xxxx.xxxxxx.xx.
Yours sincerely,
1 In accordance with Article 8(b) of Regulation 45/2001 (current Article 9 of Regulation 2018/1725) as interpreted
by the Court of Justice in Case C-28/08 P Bavarian Lager.
2
Annexes: 38 documents (zip file)
Data Protection Notice
According to Articles 15 and 16 of Regulation (EU) 2018/1725 on the protection of natural persons with
regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on
the free movement of such data, please be aware that your personal data will be processed by the EDPS,
where proportionate and necessary, for the purpose of answering your request. The legal base for this
processing operation is Regulation (EC) 1049/2001 and Article 52(4) of the Regulation (EU)
2018/1725. Subject to applicable rules under EU legislation, the personal data relating to you, as
provided in your request, are used solely for the purpose of replying to your request. EDPS staff
members dealing with the request will have access to the case file containing your personal data on a
need-to-know basis. Your personal data are not disclosed outside the EDPS. Your personal data will be
stored electronically for a maximum of ten years after the closure of the case, or as long as the EDPS
is under a legal obligation to do so. You have the right to access your personal data held by the EDPS
and to obtain the rectification thereof, if necessary. Any such request should be addressed to the EDPS
at xxxx@xxxx.xxxxxx.xx. You may contact the data protection officer of the EDPS (EDPS-
xxx@xxxx.xxxxxx.xx), if you have any remarks or complaints regarding the way we process your
personal data.
3