Documents relating to EDPB Statements 04/2021, 01/2019, Guidelines 02/2020, and Letter OUT2021-0119

La solicitud fue parcialmente exitosa.

Dear European Data Protection Board,

Under the right of access to documents in the EU treaties, as developed in Regulation 1049/2001, I am requesting all documents related to the the following artefacts produced by the EDPB:

* EDPB Statement 04/2021 on "International Agreements Including Transfers".
* EDPB Guidelines 02/2020 on "articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies"
* EDPB Statement 01/2019 on "the US Foreign Account Tax Compliance Act (FATCA)"
* EDPB Response to Dutch MEP Sophie in 't Veld dated 07 July 2021, with reference OUT2021-0119 and publicly available here: https://www.linkedin.com/posts/fabienleh...

Noting the recent EU Ombudsman decision 286/2021/AMF (available here: https://www.ombudsman.europa.eu/en/decis...), any opinions of the National Supervisory Authorities should be included in the response to this request, in an anonymised form if necessary.

Thank you,
Nicholas Lee

European Data Protection Board, Comité Europeo de Protección de Datos

Thank you for your message and for your interest in data protection. We
will look into your request and get back to you within due time. 
 
Kind regards,
 
The EDPB Secretariat

European Data Protection Board, Comité Europeo de Protección de Datos

Dear Mr. Lee,

Thank you for your email. However, the broad description given in your request does not enable us to adequately identify the scope of your request and, as a result, the concrete documents you are seeking access to.

We therefore invite you, in accordance with Article 6(2) of Regulation (EC) No 1049/2001 regarding public access to documents, to provide us with more precise information on the documents you request, such as references, topic, dates or periods during which the documents would have been drawn, persons or bodies who drafted the documents etc. If you need further assistance to define more clearly the documents you are seeking access to, please do not hesitate to let us know.

Thank you for your cooperation.

Kind regards,
The EDPB Secretariat

mostrar partes citadas

Dear European Data Protection Board,

With regards to "EDPB Statement 04/2021" and "OUT2021-0119":
* The time period in scope of this would likely begin around June or July 2020, when the CJEU issued the Schrems II ruling, and would continue until the present.
* Persons or bodies drafting the documents that are related to / influenced the statement & letter are likely to include:
- EDPB staff at subgroup & plenary level
- Representatives from supervisory authorities (e.g. Mr. Aleid Wolfsen, Netherlands Autoriteit Persoonsgegevens; Mr Prof. Ulrich Kelber, German BfDI; Ms Marie-Laure Denis, French CNIL; etc.)
- Correspondence between EDPB and the European Commission
- Correspondence between the EDPB and the PETI committee of the European Parliament
* Relevant topics could include, but would not be limited to: "Schrems", "Schrems II", "FATCA", "IGA", "Inter-Governmental Agreement", "United States", "CRS", "Common Reporting Standard", and "Privacy Shield"
* An additional relevant topic would be the lobbying discussed in this Politico article, which refers to lobbying by the Commission and member states in relation to statement 04/2021.
- [Article, Paywalled @ POLITICO Pro](https://t.co/TXlI5LIda7?amp=1)
- [Discussion thread by article author @ Twitter](https://twitter.com/vmanancourt/status/1...)

With regards to "EDPB Guidelines 02/2020":
* The time period in scope would likely begin around June or July 2020 and extend until the end of December 2020.
* This document likely is also referenced extensively from January 2021 onwards.
* Relevant terms would be similar to those for Statement 04/2021.
* Relevant persons or bodies would likewise be similar.

With regards to "EDPB Statement 01/2019":
* The time period concerned would begin around June 2018 and extends until the publication of the guidelines in January 2020.
- In this time period, relevant entities would be the European Parliament (such as members that communicated the 5 July 2018 resolution to EDPB), the Commission, the member states representatives, and the national DPAs themselves.
- Topics will be similar to those for 04/2021, minus the references to "Schrems II" and with a greater focus on the EU Parliament Resolution passed in 2018 concerning FATCA.

If we must summarise the scope of this request concisely, it concerns:
* Documents involved in the preparation (subgroup & plenary level) of the four EDPB documents I referenced (04/2021, 02/2020, 01/2019, and OUT2021-0119) and those created afterwards that reference the four documents.
* Documents containing national Data Protection Authority statements, questions, opinions, and concerns about the EDPB documents, created both before and after the publication of those Statements and Guidelines.
* The (anonymised) documents relating to member state views are particularly relevant, given the credible public reports that member states and the Commission attempted to influence Statement 04/2021.

Yours sincerely,
Nicholas Lee

European Data Protection Board, Comité Europeo de Protección de Datos

Dear Mr. Lee,

 

Thank you for your response.

 

From your email below, we understand that the scope of your request would
include:

 

•            preparatory documents containing national Data Protection
Authority statements, questions, opinions, and concerns, leading to the
adoption of EDPB documents identified as “04/2021”, “02/2020”, “01/2019”,
and “OUT2021-0119”  (we understand “preparatory documents” to mean: (i)
draft versions of the documents, as well as (ii) minutes of meetings where
the documents were discussed);

•            Any other documents containing national Data Protection
Authority statements, questions, opinions, and concerns that reference the
EDPB documents identified as “04/2021”, “02/2020”, “01/2019”, and
“OUT2021-0119”, but created after their adoption;

•            correspondence between the EDPB and the European Commission
regarding the specific documents you have mentioned ("EDPB Statement
04/2021" and "OUT2021-0119"), and

•            correspondence between the EDPB and the PETI Committee of the
European Parliament regarding the specific documents you have mentioned
("EDPB Statement 04/2021" and "OUT2021-0119").

 

In addition, you refer to other topics which could be included, but are
not limited to "Schrems", "Schrems II", "FATCA", "IGA",
"Inter-Governmental Agreement", "United States", "CRS", "Common Reporting
Standard", and "Privacy Shield".

 

Furthermore, in the summary at the end of your message, you refer to
preparatory documents for all four documents mentioned in your request
“and those created afterwards that reference the four documents.”

 

In accordance with Article 6(1) of Regulation 1049/2001, applications for
access to a document shall be made in a sufficiently precise manner to
enable the institution to identify the document.

 

Following a preliminary assessment based on your request as we understood
it above, the EDPB would incur a disproportionate workload in order to
carry out the preliminary research required to identify the documents
potentially related to your request, based on the information you have
provided in your email. In this regard, we would like to draw your
attention to the EU case law enabling the institution to not proceed the
preliminary research when the request is not precise ([1]F-121/07, Strack
v Commission), or on the possibility to refuse to identify the documents
falling under the scope of a request if the identification would lead to a
disproportionate workload ([2]T-653/16, Malta v Commission).

 

In order to be able to proceed with analysing your request, we would
therefore ask you to provide us with more information, which would allow
us to identify the documents in scope of your request. While you are not
required to provide any reasoning for your request, it may be helpful if
you could provide us with any information on your interest in obtaining
the documents, insofar as this would help us to determine the documents in
scope of your request.

 

Thank you for your cooperation.

 

Kind regards,

The EDPB Secretariat

 

mostrar partes citadas

Dear European Data Protection Board,

Thank you for your response.

For the purposes of providing a more precise scope of the request, please consider the request to be scoped to the following items, as quoted from your understanding:

"preparatory documents containing national Data Protection
Authority statements, questions, opinions, and concerns, leading to the
adoption of EDPB documents identified as “04/2021”, “02/2020”, “01/2019”,
and “OUT2021-0119” (we understand “preparatory documents” to mean: (i)
draft versions of the documents, as well as (ii) minutes of meetings where
the documents were discussed);"

Should it be relevant, I will raise a separate information request concerning the written correspondence and/or other documents.

The interest motivating this request is to see the development and the evolution of the Statements, Guidelines, and OUT2021-0119 letter from its inception until its publication. The secondary interest is to be made aware of the positions of the individual DPAs and/or the EU Commission on the topics discussed, albeit with identifying information removed so as to avoid undue pressure on any entity.

Yours sincerely,
Nicholas Lee

European Data Protection Board, Comité Europeo de Protección de Datos

Dear Mr. Lee,

Thank you for your response.

We confirm registration of your access to documents request and registered it today under reference 2021/33. Please use this reference for further correspondence.

We are currently assessing your request and will provide you with a reply within 15 working days (22/11/2021).

Please note that the EDPB specific privacy statement regarding the processing of personal data for the purposes of handling request for access to documents is available on the EDPB website and can be viewed via this link: https://edpb.europa.eu/sites/edpb/files/...

Should you have any further queries, please do not hesitate to contact us.

Best regards,

The EDPB Secretariat

mostrar partes citadas

European Data Protection Board, Comité Europeo de Protección de Datos

2 Adjuntos

Dear Mr. Lee,

 

We refer to your email dated 14/10/2021 in which you made a request for
access to documents, registered on 28/10/2021 under reference number
2021/33.

 

Your application is currently being handled. However, we will not be in a
position to complete the handling of your application within the time
limit of 15 working days, which expires today (22/11/2021).

 

An extended time limit is needed, as your application covers a large
amount of documents that need to be identified and assessed.

 

Therefore, we have to extend the time limit for another 15 working days in
accordance with Article 7(3) of Regulation (EC) No 1049/2001 regarding
public access to documents. The new deadline expires on 13/12/2021.

 

We apologise for this delay and for any inconvenience this may cause.

 

Yours faithfully,

 

On behalf of

Ventsislav Karadjov, deputy chair of the EDPB

 

 

+--------------------------------------------------------------------------------------------+
| |European Data Protection Board |
| | |
| |Postal address: Rue Wiertz 60, B-1047 Brussels |
|[1]cid:image001.png@01D42EFC.C1379A70| |
| |Office address: Rue Montoyer 30, B-1000 Brussels |
| | |
| |[2]cid:image003.png@01D42EFC.C1379A70[3]edpb.europa.eu|
+--------------------------------------------------------------------------------------------+

 

 

mostrar partes citadas

European Data Protection Board, Comité Europeo de Protección de Datos

5 Adjuntos

Dear Mr. Lee,

 

Please find enclosed the reply to your request for access to documents
(ref. 2021-33) signed by Mr Ventsislav Karadjov, Vice-Chair of the EDPB.

 

Please note that due to the number and size of the attachments, you will
receive the files in several emails (20 files in total, not including the
reply letter).

 

We kindly ask you to acknowledge receipt of the files.

 

Best regards,

The EDPB Secretariat

 

European Data Protection Board, Comité Europeo de Protección de Datos

8 Adjuntos

Dear Mr. Lee,

 

Please find the second part of the files.

 

We kindly ask you to acknowledge receipt of the files.

 

Best regards,

The EDPB Secretariat

 

 

From: European Data Protection Board <[EDPB request email]>
Sent: 13 December 2021 11:36
To: '[FOI #10088 email]'
<[FOI #10088 email]>
Cc: European Data Protection Board <[EDPB request email]>
Subject: Case reference 2021-33: Your request for access to documents

 

Dear Mr. Lee,

 

Please find enclosed the reply to your request for access to documents
(ref. 2021-33) signed by Mr Ventsislav Karadjov, Vice-Chair of the EDPB.

 

Please note that due to the number and size of the attachments, you will
receive the files in several emails (20 files in total, not including the
reply letter).

 

We kindly ask you to acknowledge receipt of the files.

 

Best regards,

The EDPB Secretariat

 

European Data Protection Board, Comité Europeo de Protección de Datos

7 Adjuntos

Dear Mr. Lee,

 

Please find the third part of the files.

 

We kindly ask you to acknowledge receipt of the files.

 

Best regards,

The EDPB Secretariat

 

 

From: European Data Protection Board <[EDPB request email]>
Sent: 13 December 2021 11:38
To: '[FOI #10088 email]'
<[FOI #10088 email]>
Cc: European Data Protection Board <[EDPB request email]>
Subject: RE: Case reference 2021-33: Your request for access to documents
(part 2)

 

Dear Mr. Lee,

 

Please find the second part of the files.

 

We kindly ask you to acknowledge receipt of the files.

 

Best regards,

The EDPB Secretariat

 

 

From: European Data Protection Board <[1][EDPB request email]>
Sent: 13 December 2021 11:36
To: '[FOI #10088 email]'
<[2][FOI #10088 email]>
Cc: European Data Protection Board <[3][EDPB request email]>
Subject: Case reference 2021-33: Your request for access to documents

 

Dear Mr. Lee,

 

Please find enclosed the reply to your request for access to documents
(ref. 2021-33) signed by Mr Ventsislav Karadjov, Vice-Chair of the EDPB.

 

Please note that due to the number and size of the attachments, you will
receive the files in several emails (20 files in total, not including the
reply letter).

 

We kindly ask you to acknowledge receipt of the files.

 

Best regards,

The EDPB Secretariat

 

References

Visible links
1. mailto:[EDPB request email]
2. mailto:[FOI #10088 email]
3. mailto:[EDPB request email]

European Data Protection Board, Comité Europeo de Protección de Datos

1 Adjuntos

Dear Mr. Lee,

 

Please find the last file, sent separately, due to the size.

 

We kindly ask you to acknowledge receipt of the files.

 

Best regards,

The EDPB Secretariat

 

From: European Data Protection Board <[EDPB request email]>
Sent: 13 December 2021 11:41
To: '[FOI #10088 email]'
<[FOI #10088 email]>
Cc: European Data Protection Board <[EDPB request email]>
Subject: RE: Case reference 2021-33: Your request for access to documents
(part 3)

 

Dear Mr. Lee,

 

Please find the third part of the files.

 

We kindly ask you to acknowledge receipt of the files.

 

Best regards,

The EDPB Secretariat

 

 

From: European Data Protection Board <[1][EDPB request email]>
Sent: 13 December 2021 11:38
To: '[FOI #10088 email]'
<[2][FOI #10088 email]>
Cc: European Data Protection Board <[3][EDPB request email]>
Subject: RE: Case reference 2021-33: Your request for access to documents
(part 2)

 

Dear Mr. Lee,

 

Please find the second part of the files.

 

We kindly ask you to acknowledge receipt of the files.

 

Best regards,

The EDPB Secretariat

 

 

From: European Data Protection Board <[4][EDPB request email]>
Sent: 13 December 2021 11:36
To: '[FOI #10088 email]'
<[5][FOI #10088 email]>
Cc: European Data Protection Board <[6][EDPB request email]>
Subject: Case reference 2021-33: Your request for access to documents

 

Dear Mr. Lee,

 

Please find enclosed the reply to your request for access to documents
(ref. 2021-33) signed by Mr Ventsislav Karadjov, Vice-Chair of the EDPB.

 

Please note that due to the number and size of the attachments, you will
receive the files in several emails (20 files in total, not including the
reply letter).

 

We kindly ask you to acknowledge receipt of the files.

 

Best regards,

The EDPB Secretariat

 

References

Visible links
1. mailto:[EDPB request email]
2. mailto:[FOI #10088 email]
3. mailto:[EDPB request email]
4. mailto:[EDPB request email]
5. mailto:[FOI #10088 email]
6. mailto:[EDPB request email]

Dear European Data Protection Board,

Thank you for your response to the information request, in which 20 out of 101 responsive documents were fully or partially disclosed. I can confirm the receipt of the disclosed documents, and I thank you for your detailed and organised response that includes document reference numbers.

Please pass this on to the person who reviews confirmatory applications.

I am filing the following confirmatory application with regards to my access to documents request 'Documents relating to EDPB Statements 04/2021, 01/2019, Guidelines 02/2020, and Letter OUT2021-0119'.

Regarding the documents that could not be disclosed, I seek confirmation regarding the following grounds for redaction or full non-disclosure:

1.2. Exception 4(3), 2nd Paragraph

While the EDPB has asserted that disclosure of the discussed documents (1-3, 5-12, 22-27, 29, 30, 32-37, 40, 45, 47-74, 77, 78, 80, 83, 85, 86, 88, 89, 93, 94, 96, 97) would seriously undermine the decision making process by curtailing "space to think", the refusal to disclose draft revisions of documents appears contrary to the public interest.

This overriding public interest can be elaborated on in multiple respects:

* There have been credible public reports of pressure by the EU Commission on the independent EDPB; the public has a clear interest in understanding what that pressure was, why it was applied, and what changes resulted.
* The Commission has been directly criticised by the European Parliament for its inaction areas relating to international data exchanges; the serious concerns expressed in texts adopted by the European Parliament demonstrate the public interest and warrant additional public visibility into the decision making process.
* While discussed later in my confirmatory application and acknowledging that it is not directly precedential, I refer back to the Ombudsman's expressed views that there is a clear public interest in the public "knowing how an authoritative interpretation of its provisions was decided", and favouring the "widest possible public access". Particularly if information is anonymised and it is generally accepted by the public that in any body disagreement and discussion occur, it is unclear how "space to think" is severely curtailed unless maladministration is involved.

2.2 / 2.3 ("court proceedings and legal advice" / "purpose of investigation" / Document 41)

I refer to the aforementioned overriding public interests, also noting that there is a clear interest for the public to know that an investigation is occurring if the subject of the investigation involves a public body and the public body is aware that the investigation is taking place; numerous SAs already make public the existence of investigations into both public and private entities.

Similarly, the existence of court cases is typically public record. As such, it is unclear how proceeds are harmed by a high level update noting a recent national development that correlates information that is likely already public.

2.4. Exception 4(3), 2nd Paragraph

This concerns documents 15, 16, 19, 20, 21, 82, 98, and 101. I refer to the aforementioned overriding public interests.

Demonstrating that the "space to think" claim may be overly broad, I refer to Document 101, where some suggestions concerning the wording of a paragraph are redacted; wording related changes are unlikely to result in undue external pressure; particularly if anonymisation is employed.

I additionally note that public interests apply even if a document may be revisited in the future; in such circumstances, the public interest in it is arguably stronger due to the document possibly providing context on why a decision must be revisited.

3. The note that the Ombudsman decision is non-precedential

While it is true that Ombudsman decisions are not precedential, they are indicative of prevailing views from the Ombudsman's office, and are worth taking into account when weighing the ever-present public interest in disclosure against possible exceptions from disclosure.

From the response to the letter, it is especially unclear how national situations could be compromised, individual SAs subject to undue external pressure, or "space to think" curtailed if comments submitted to a body with meaningfully large membership are anonymised.

When the confirmatory application is processed, I ask that this suggestion for a workable means of broad disclosure be re-considered.

A full history of my request and all correspondence is available on the Internet at this address: https://www.asktheeu.org/en/request/docu...

Thank you, and best regards,
Nicholas Lee

European Data Protection Board, Comité Europeo de Protección de Datos

Dear Mr Lee,

We acknowledge receipt of your confirmatory request sent in relation to your request 2021-33, on 13 December 2021.

It was been registered today under reference 2021-33-C. Please use this reference for further correspondence.

We are currently assessing your confirmatory request and will provide you with a reply within 15 working days (deadline: 14/01/2022).

Should you have any further queries, please do not hesitate to contact us.

Best regards,

The EDPB Secretariat

mostrar partes citadas

European Data Protection Board, Comité Europeo de Protección de Datos

6 Adjuntos

Dear Mr. Lee,

 

Please find attached the answer from Ms. Andrea Jelinek, EDPB Chair, with
regard to your confirmatory application.

 

Regarding document 103, please find hereafter, for your convenience, the
hyperlink to the document (also included in the reply letter):
https://edpb.europa.eu/system/files/2021...

 

Sincerely,

 

The EDPB Secretariat