To: Alexander Schmalenberger xxxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxx.xxx
Brussels, 21 August 2023
Subject: Your application for access to documents – Ref No 2023-26
Dear Mr. Schmalenberger,
We refer to your e-mail dated 1 June 2023 in which you made a request to access documents.
Following the agreement reached on a fair solution on 22 June 2023, your request was
registered on 12 July 2023 under reference 2023/26.
Due to the need to consult a national data protection authority with respect to a document falling
within the scope of your request, on 2 August 2023 we extended the time limit to reply to your
request, in accordance with Article 4(4) of Regulation (EC) No 1049/2001 regarding public
access to documents. Therefore, the deadline to reply to your request expires on 24 August
2023.
You requested access to the fol owing documents: “According to paragraph 16 of the Report
of the work undertaken by the supervisory authorities within the 101 Task Force from 28 March
2023 several SA have issued decisions. They apparently have been shared with the EDPB.
Thus, I would like to get a copy of them.”
Assessment
We have identified
1 document that falls within the scope of your request.
Please note that, even though the Report refers to several SAs having issued decisions, this
does not mean that they were all discussed within or shared with the EDPB. In this respect, we
highlight that the SAs have channels of communication among them, which do not run through
either the EDPB or its Secretariat.
The only decision which was shared with the EDPB in this context is a decision of the Austrian
SA. We have assessed the document in light of Regulation (EC) No 1049/2001 regarding public
access to documents and the relevant case law of the Court of Justice of the European Union
(CJEU). The Austrian SA was also consulted with respect to the assessment.
Having examined the document requested under the provisions of Regulation (EC) No 1049/2001,
in accordance with Article 4(4) of Regulation (EC) No 1049/2001, I have come to the conclusion
that
full disclosure of the document cannot be granted, as its disclosure is prevented by the
following exceptions to the right of access laid down in Article 4 of Regulation (EC) No
1049/2001.
1) Exception 4(1)(b) (“Privacy and integrity of the individual”): The document to which you
request access contains personal data, in particular names and contact details of data subjects, as
well as other personal information. Pursuant to Article 4(1)(b) of Regulation (EC) No 1049/2001,
access to a document has to be refused if its disclosure would undermine the protection of privacy
1
and the integrity of the individual, in particular in accordance with EU legislation regarding the
protection of personal data. The applicable legislation in this field is Regulation (EU) 2018/17251.
When access is requested to documents containing personal data, Regulation (EU) 2018/1725
becomes fully applicable2. According to Article 9(1)(b) of this Regulation, personal data shall
only be transferred to recipients if they establish the necessity of having the data transferred to
them for a specific purpose in the public interest and the controller considers it proportionate. We
consider that, with the information available to date, the necessity of disclosing the
aforementioned personal data to you has not been established and/or that it cannot be assumed
that such disclosure would not prejudice the legitimate rights of the persons concerned.
2) Article 4(2), 1st indent (“commercial interests of a legal person”): The document to which
you requested access contains commercial information, the disclosure of which could result in
undermining the protection of the commercial interests of the company mentioned in the
document.
3) Article 4(2), 2nd indent (“disclosure would undermine court proceedings’’): The document
to which you requested access relates to ongoing proceedings before national courts. The court
proceedings could be jeopardised should the document be fully disclosed. Therefore, some parts
of the document have been redacted on this basis.
The exceptions laid down in Article 4(2) of Regulation (EC) No 1049/2001 apply unless there is
an overriding public interest in disclosure of the documents. We have not been able to identify
such an interest.
Please note that the document we are providing in the context of this access to documents request
is the same one published by the Austrian SA on its website3. The Austrian SA anonymised and
removed some information in the published document. Even though the EDPB holds the full
version of the decision, as it was shared by the Austrian SA, the application of the above-
mentioned exceptions leads to a version of the document essentially tantamount to the one
published by the Austrian SA. Therefore, we are providing the version of the document published
by the Austrian SA. For the sake of clarity, we underline that the following information has been
redacted on the basis of the above-mentioned exceptions: names of natural persons and
companies; legal forms and product designations; addresses (incl. URLs, IP and e-mail addresses);
file numbers; initials and abbreviations that could lead to the identification of natural or legal
persons and graphics with information concerning individual browser-data, individual account
settings and cookie-values. Finally, the following information was also removed from the
published version of the decision: information on legal remedies as well as the e-mail address of
the Austrian SA.
1 Regulation (EU) 2018/17251 of the European Parliament and of the Council of 23 October 2018 on the protection of
natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies
and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.
2 Judgment of the Court of Justice of the European Union of 29 June 2010 in Case C-28/08 P,
Commission/The
Bavarian Lager Co. Ltd, ECR 2010 I-06055. This case concerns the previous Regulation (EC) No 45/2001 of the
European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the
processing of personal data by the Community institutions and bodies and on the free movement of such data.
3 https://www.dsb.gv.at/dam/jcr:c1eb937b-7527-450c-8771-74523b01223c/D155.027%20GA.pdf
2
