Leonardo CERVERA NAVAS
Director
Mr Alexander BORG
by email only: ask+request-10112-
xxxxxxxx@xxxxxxxx.xxx
Brussels, 3 November 2021
LCN/SPR/TT/mch/D(2021)2273
C 2021-0963
Please use xxxx@xxxx.xxxxxx.xx for all
correspondence
Subject: Your request for access to documents under Regulation (EC) 1049/2001
Dear Mr Borg,
On 17.10.2020, you sent an access to documents request to the European Data Protection
Supervisor (“EDPS”) on the basis of Regulation (EC) 1049/2001. Your request was registered
on the next day, for which we sent you an acknowledgement of receipt on 25.10.2021 also
mentioning the deadline in accordance with Article 7(1) of Regulation (EC) 1049/2001.
You request concerns documents, which contain the information relating to:
1. Whether the EDPS can validate/invalidate certain claims apparently made public by the press
relating to plans to re-establish a new data-sharing plan between the US and the EU based on
existing documents?
2. What is the net cost in EUR in data breaches related to US surveillance efforts on European
soil.
After careful assessment of your request, we regret to inform you that the EDPS does not
hold any documents that would correspond to your request. In this regard, please note that
in accordance with settled case-law of the Court of Justice of the European Union,
Regulation No 1049/2001 applies only to existing documents in the institution and that the
EDPS is not under the obligation to create a document which does not exist, even if that
document is based on information already appearing in existing documents1.
Pursuant to Article 7(2) of Regulation No 1049/2001, you may make a confirmatory
application asking the EDPS to reconsider his position as regards to the total or partial
refusal of your request. Such a confirmatory application should be addressed within 15
working days upon receipt of this letter to the EDPS general e-mail: xxxx@xxxx.xxxxxx.xx.
Yours sincerely,
Data Protection Notice
According to Articles 15 and 16 of Regulation (EU) 2018/1725 (the Regulation) on the protection of natural
persons with regard to the processing of personal data by the Union institutions, bodies, offices and
agencies and on the free movement of such data, we are processing your personal data, where
proportionate and necessary, for the purpose of answering your request. The legal base for this processing
operation is Regulation (EU) 1049/2001 and Article 52(4) of the Regulation (EU) 2018/1725. Subject to
applicable rules under EU legislation, the personal data relating to you, as provided in your request as
well as personal data that might be collected while processing your request, are used solely for the
purpose of replying to your request. EDPS staff members dealing with the request will have access to the
case file containing your personal data on a need-to-know basis. All access to case files is logged. Your
personal data are not disclosed outside the EDPS. Your personal data will be stored electronically for a
maximum of ten years after the closure of the case, or as long as the EDPS is under a legal obligation to
do so. You have the right to access your personal data held by the EDPS and to relevant information
concerning how we use it. You have the right to rectify your personal data. Under certain conditions, you
have the right to ask that we delete your personal data or restrict its use. We will consider your request,
take a decision and communicate it to you. For more information, please see Articles 14 to 21, 23 and 24
of the Regulation. Please note that in some cases restrictions under Article 25 of the Regulation may
apply. Any request to exercise your rights should be addressed to the EDPS at xxxx@xxxx.xxxxxx.xx. You
may contact the data protection officer of the EDPS (xxxxxxxx@xxxx.xxxxxx.xx), if you have any
remarks or complaints regarding the way we process your personal data. You have the right to lodge a
complaint with the EDPS, as supervisory authority. Any such request should be addressed to the EDPS
at xxxx@xxxx.xxxxxx.xx. You can reach the EDPS in the following ways: E-mail: xxxx@xxxx.xxxxxx.xx;
EDPS postal address: European Data Protection Supervisor, Rue Wiertz 60, B-1047 Brussels, Belgium. For
more information, please refer to the extended version of the data protection notice available on the
EDPS website: https://edps.europa.eu/data-protection/our-work/publications/other-documents/requests-
access-documents_en.
1 Judgment of the Court of 11 January 2017 in case C-491/15 P, Typke v Commission
2
