Dear European Data Protection Board,

Under the right of access to documents in the EU treaties, as developed in Regulation 1049/2001, I am requesting documents which contain the following information:

1) Indication of whether, which and for what purpose personal data processing services / software of organizations (e.g., as processor / data importer) located outside the EU/EEA are used acutally by the EDPB. Exception: Confluence - for the use of this software runs a parallel request from 12.01.2021.

2) Indication of whether, which and for what purpose such personal data processing services of organizations located within the EU/EEA, but with subcontractors outside the EU/EEA, are actually used by the EDPB.

3) Per individual of these services with the aforementioned third country references:

a) I request an indication as to whether and which transfers pursuant to Art. 44 et seq. GDPR are triggered by the use of these services.

b) I ask for all contracts concluded with the providers of these services in this respect, which are necessary under data protection law, or for a missing indication if there are no such contracts. In particular, namely: contract for commissioned processing according to Art. 28 DSGVO as well as standard data protection clauses according to Art. 46 GDPR.

c) I request the provision of the documented "Transfer Impact Assessment" required according to clause 14 of the current standard data protection clause sets of the EU Commission or the documented "Transfer Impact Assessment" required according to Art. 46 (1) GDPR in conjunction with the principles from ECJ judgment "Schrems II" regarding the data transfers associated with the use of such services.

It should be possible to find the above information without major effort, in particular by means of corresponding information and links in the official processing directory pursuant to Art. 30 GDPR.

Best regards
Heiko Roth

European Data Protection Board, Comité Europeo de Protección de Datos

Thank you for your message and for your interest in data protection. We
will look into your request and get back to you within due time.
The EDPB Secretariat

European Data Protection Board, Comité Europeo de Protección de Datos

Dear Mr. Roth,

We confirm registration of your access to documents request and registered it today under reference 2022/08. Please use this reference for further correspondence.

We are currently assessing your request and will provide you with a reply within 15 working days (10/02/2022).

Please note that the EDPB specific privacy statement regarding the processing of personal data for the purposes of handling requests for access to documents is available on the EDPB website and can be viewed via this link: https://edpb.europa.eu/sites/edpb/files/...

Should you have any further queries, please do not hesitate to contact us.

Best regards,

The EDPB Secretariat

mostrar partes citadas

European Data Protection Board, Comité Europeo de Protección de Datos

2 Adjuntos

Dear Mr Roth,

 

We are contacting you concerning your request registered under reference
2022/08.

 

We are currently conducting the assessment of your request and, as result
of this assessment, we have a priori identified hundreds of documents
falling within the scope of your request, including documents which, based
on your request, may not necessarily be of interest to you (e.g. IT
service tickets or service logs). In addition, due to the very broad
formulation of your request, in particular of concepts such as "personal
data processing services / software", this is currently creating a
significant increase in the demand of our services, at a time where we are
dealing with several other access to documents requests.

 

As a result, we would like to kindly suggest one of the two following
options:

 

(1)    Since the current request for access to documents is very broad, we
would kindly request that you narrow it down to the documents you are
specifically looking for, in particular regarding the notion of
"processing of personal data services / software". Please note that the
term software, in particular, is very broad and covers any set of
instructions that can be interpreted by a computer, including  e.g.
firmware and operating systems. Please note that we will in any case have
to extend the deadline for replying to this access to documents request.
We will contact you regarding this on the 10 February 2022.  

 

(2)    Alternatively, we can address your request as a request for
information, and address your questions directly, provided that the
information is available / can be provided, instead of through specific
documents containing the requested information. In such case, your access
to documents request would be currently withdrawn, but you would have the
possibility of launching a new one at any point in time. Please note that
requests for information are not subject to the requirements of Regulation
1049/2001, in particular regarding deadlines.  

 

We would be grateful if you could reply to us by this Thursday, 10
February, so that we can proceed with the assessment of your request.

 

Many thanks in advance,

The EDPB Secretariat

 

+---------------------------------------------------------------------------------------------+
| |European Data Protection Board |
| | |
| |Postal address: Rue Wiertz 60, B-1047 Brussels |
|[1]cid:image001.png@01D42EFC.C1379A70| |
| |Office address: Rue Montoyer 30, B-1000 Brussels |
| | |
| |[2]cid:image003.png@01D42EFC.C1379A70 [3]edpb.europa.eu|
+---------------------------------------------------------------------------------------------+

 

 

 

 

 

References

Visible links
3. https://www.edpb.europa.eu/

European Data Protection Board, Comité Europeo de Protección de Datos

2 Adjuntos

Dear Mr Roth,

 

We refer to your email dated 13/01/2022 in which you made a request for
access to documents, registered on 20/01/2022 under reference number
2022/08.

 

Your application is currently being handled. However, we will not be in a
position to complete the handling of your application within the time
limit of 15 working days, which expires today (10/02/2022).

 

An extended time limit is needed, as your application is very broad and
covers a large amount of documents that need to be identified and
assessed. Furthermore, the request involves a considerable number of
documents for whose identification and assessment we need more time, due
to the high amount of cases currently being dealt with by our team.

 

Therefore, we have to extend the time limit for another 15 working days in
accordance with Article 7(3) of Regulation (EC) No 1049/2001 regarding
public access to documents. The new deadline expires on 03/03/2022.

 

We apologize for this delay and for any inconvenience this may cause.

 

Yours sincerely,

 

On behalf of

Ventsislav Karadjov, deputy chair of the EDPB

 

 

┌─────────────────────────────────────╥───────────────────────────────────────────────────────┐
│ ║European Data Protection Board │
│ ║ │
│ ║Postal address: Rue Wiertz 60, B-1047 Brussels │
│[1]cid:image001.png@01D42EFC.C1379A70║ │
│ ║Office address: Rue Montoyer 30, B-1000 Brussels │
│ ║ │
│ ║[2]cid:image003.png@01D42EFC.C1379A70 [3]edpb.europa.eu│
└─────────────────────────────────────╨───────────────────────────────────────────────────────┘

 

 

 

References

Visible links
3. https://www.edpb.europa.eu/

European Data Protection Board, Comité Europeo de Protección de Datos

7 Adjuntos

Dear Mr Roth,

 

Please find enclosed the reply to your request for access to documents
(ref. 2022-08) signed by Mr Ventsislav Karadjov, Vice-Chair of the EDPB.

 

Best regards,

 

The EDPB Secretariat

 

┌─────────────────────────────────────╥───────────────────────────────────────────────────────┐
│ ║European Data Protection Board │
│ ║ │
│ ║Postal address: Rue Wiertz 60, B-1047 Brussels │
│[1]cid:image001.png@01D42EFC.C1379A70║ │
│ ║Office address: Rue Montoyer 30, B-1000 Brussels │
│ ║ │
│ ║[2]cid:image003.png@01D42EFC.C1379A70 [3]edpb.europa.eu│
└─────────────────────────────────────╨───────────────────────────────────────────────────────┘

 

 

 

References

Visible links
3. https://www.edpb.europa.eu/