E-mail exchange with Apple on spyware targeting
Alexander Fanta made this access to documents request to Justice and Consumers Automatic anti-spam measures are in place for this older request. Please let us know if a further response is expected or if you are having trouble responding.
Dear Justice and Consumers,
Under the right of access to documents in the EU treaties, as developed in Regulation 1049/2001, I am requesting all documents regarding the targeting of Commissioner Didier Reynders and four members of his staff with spyware, as reported by Reuters news agency on April 11, 2022. This is meant to include internal e-mails and meetings minutes; reports sent to the EU’s Computer Emergency Response Team or the European Data Protection Supervisor, as well as communication with external stakeholders such as Apple.
I would like to point out that I makes this request in my role as journalist, which the European Court of Human Rights has recognized to have a special "social watchdog" function in the public interest. I ask you to take this into account when dealing with my request.
Kind regards,
Alexander Fanta
netzpolitik.org e.V.
Schönhauser Allee 6-7
10119 Berlin
Germany
Link: [1]File-List
Link: [2]themeData
Link: [3]colorSchemeMapping
[4]RE: access to documents request - E-mail exchange with Apple on spyware
targeting --- GESTDEM 2022/3234 --- AoR - Ares(2022)4147716 (Please use
this link only if you are an Ares user – Svp, utilisez ce lien
exclusivement si vous êtes un(e) utilisateur d’Ares)
Dear Sir,
Thank you for your e-mail of 3 June 2022. We hereby acknowledge receipt of
your application for access to documents, which was registered on 6 June
2022 under reference number GESTDEM 2022/3234.
In accordance with Regulation (EC) No 1049/2001 regarding public access to
European Parliament, Council and Commission documents, your application
will be handled within 15 working days. The time limit will expire on 27
June 2022. In case this time limit needs to be extended, you will be
informed in due course.
You have lodged your application via a private third-party website, which
has no link with any institution of the European Union. Therefore, the
European Commission cannot be held accountable for any technical issues or
problems linked to the use of this system.
Please note that the private third party running the AsktheEU.org website
is responsible and accountable for the processing of your personal data
via that website, and not the Commission. For further information on your
rights, please refer to the third party’s privacy policy.
┌────────────────────────────────────────────────────────────────────────┐
│We understand that the third party running the AsktheEU.org website│
│usually publishes the content of applicants’ correspondence with the│
│Commission on that website. This includes the personal data that you may│
│have communicated to the Commission (e.g. your private postal address). │
│ │
│ │
│ │
│Similarly, the third party publishes on that website any reply that the│
│Commission will send to the email address of the applicants generated by│
│the AsktheEU.org website. │
│ │
│ │
│ │
│If you do not wish that your correspondence with the Commission is│
│published on a private third-party website such as AsktheEU.org, you can│
│provide us with an alternative, private e-mail address for further│
│correspondence. In that case, the Commission will send all future│
│electronic correspondence addressed to you only to that private address,│
│and it will use only that private address to reply to your request. You│
│should still remain responsible to inform the private third-party│
│website about this change of how you wish to communicate with, and│
│receive a reply from, the Commission. │
│ │
│ │
└────────────────────────────────────────────────────────────────────────┘
For information on how we process your personal data visit our page
[5]Privacy statement – access to documents.
Yours faithfully,
JUST Access to Documents Team
Link: [1]File-List
Link: [2]themeData
Link: [3]colorSchemeMapping
[4]GESTDEM 2022/3234 --- holding reply - Ares(2022)4559471 (Please use
this link only if you are an Ares user – Svp, utilisez ce lien
exclusivement si vous êtes un(e) utilisateur d’Ares)
Dear Sir,
Subject: Your application for access to documents – GESTDEM 2022/3234
We refer to your e-mail of 3 June 2022 in which you make a request for
access to documents, registered on 3 June 2022 under the above mentioned
reference number.
Your application is currently being handled. However, we will not be in a
position to complete the handling of your application within the time
limit of 15 working days, which expires on 27 June 2022.
An extended time limit is needed as the application concerns documents
held by different Services, which must be consulted.
Therefore, we have to extend the time limit with 15 working days in
accordance with Article 7(3) of Regulation (EC) No 1049/2001 regarding
public access to documents. The new time limit expires on 18 July 2022.
We apologise for this delay and for any inconvenience this may cause.
Yours faithfully,
JUST ACCESS TO DOCUMENTS team
Dear Mr Fanta,
We would like to provide you with information on the state of play of the
above-mentioned access to document request.
Due to the sensitivity of the documents that you have requested, we had to
consult several Cabinets as well as the Directorate General for Security.
We are still awaiting some of their feedback.
As a next step, their responses will be analyzed and integrated into our
reply to you.
Please rest assured that we are working on your request.
Thank you very much for your patience.
Best regards,
JUST ACCES TO DOCUMENTS
Dear Mr. Fanta,
Please find attached our reply concerning your application for access to
documents – GESTDEM 2022/3234.
With kind regards,
JUST ACCESS DOCUMENTS
[1]Just Logo
European Commission
Directorate-General for Justice and Consumers
Rue Montoyer 59
B-1049 Brussels, Belgium
References
Visible links
1. http://ec.europa.eu/justice/index_en.htm
Dear Justice and Consumers,
Please pass this on to the person who reviews confirmatory applications.
I am filing the following confirmatory application with regards to my access to documents request 'E-mail exchange with Apple on spyware targeting'.
You deny access to the documents in question with reference to the exception to Regulation 1049/2001 on public security. In your reply, you state that „most of the documents have been earmarked with a marking and/or classification level. This indicates the sensitivity of the information they contain as well as the need protect it.“ I would like to point out that Regulation 1049 explicitly covers sensitive documents. It states that an „institution which decides to refuse access to a sensitive document shall give the reasons for its decision in a manner which does not harm the interests protected in Article 4.“ Therefore it can not be claimed that just because a document is classified, access may be denied.
In your reasoning for denying access under Article 4(1)a, you mention that a „large number of the documents are witness statements which contain identification data“, as well as that „disclosure of the details of the investigation of the matter would undermine the very purpose of this investigation“. I would like to argue that these two statements refer to other exceptions under Regulation 1049/2001, therefore the specific exception in question has been misapplied.
You go on to state that „public disclosure would also provide details on the information systems, making them more vulnerable and prone to hacking by the very individuals and/or groups targeted by these initiatives.“ I would like to remind the Commission that the General Court ruled in the Evropaïki Dynamiki case (T-167/10) in regard to a matter of public security that the Commission had to show how disclosure „could specifically and actually undermine that objective in a way that is reasonably foreseeable and not purely hypothetical“. In the Steinberg case (T-17/10), the General Court established that there was a concrete risk of disclosure as the documents might be used to exert pressure on the relevant persons, even to make threats to their physical or moral integrity. I would like to contend that in the present case, the Commission must examine whether the high standard of the exception is met, namely that disclosure would result into an actual threat.
Regarding your refusal to provide access under Article 4(1)b, you state that the documents contain personal data belonging to witnesses and/or staff members. My request explicitly asked for documents regarding the targeting of the device of Commissioner Didier Reynders, which he used in his official capacity as European Commissioner. Mr. Reynders, as European Commissioner and former Belgian minister, is a highly prominent person who is acting in official capacity. Therefore saying that disclosure of his personal information would constitute a risk to his privacy is, in my view, a misreading both of Regulation 1049/2001 and Regulation 2018/1725 concerning data protection of EU institutions. I would also like to point out the relevant case law in the matter. In the case Commission vs. Bavarian Lager (C‑28/08 P), the matter at stake was that the Commission redacted five names of people following two express refusals by persons to consent to the disclosure of their identity and the Commission’s failure to contact the remaining three attendees. In this case, the conduct of Commissioner Reynders as well as information about the details of the attack including possible information about the perpetrators and the reaction by the Commission are not private matters. His name should therefore be presented on all document in de-redacted form.
Regarding your refusal to provide access under Article 4(2) for the protection of inspections and audits, the European Ombudsman has found in several rulings that the risk of a protected interest being undermined must be reasonably foreseeable and not purely hypothetical. Furthermore, institutions need to prove, for each individual document, that disclosure would undermine the investigation (see cases: 3699/2006/ELB 06 April 2010; 725/2014/FOR 01 October 2015; 248/2016/PB 31 October 2016). I would like to point out that the Commission has refused to grant access to a list of documents, therefore making it impossible to fulfil this requirement by the Ombudsman and provide clear reasoning for the motives for non-disclosure. Likewise the Court, in Franchet and Byk (T-391/03 and T-70/04), stated that this exception only applies if disclosure of the documents in question endangers the completion of the investigation. The reason stated in the refusal, namely that “disclosure at this point in time would affect the climate of mutual trust between the authorities of the concerned Member States and the Commission as it would put in the public domain possible preliminary findings which have not yet been confirmed and which may be rebutted”, is therefore a misapplication of the exception. The “climate of trust” between institutional actors is not, in my view, an actionable danger to the investigation from a legal perspective. Furthermore, I would like to argue that there is an overriding public interest in disclosure of the documents in question. I note that the matter of the Pegasus spyware and its use in various European Union member states is a matter of considerable scrutiny by the media, member state institutions and co-legislators. Indeed, the European Parliament has set up a committee specifically to investigate the use and misuse of said spyware. The hearings are public to advance the understanding of current practices regarding spyware and probe the need for new legislative action to prevent misuse. I would argue that the possible attack against a member of the European Commission and dealings of the European Commission in regard to Pegasus therefore constitute a matter which could provide crucial insight into the subject investigated by the co-legislative institution. Indeed, I would like to argue that non-disclosure would obstruct any attempt to gain a full picture of the potential misuse of Pegasus and other spyware, therefore constituting a clear harm to public interest. In this regard, I would like to point out the Pari Pharma case (T-235/15), where the court found that specific, „succinct“ circumstances may merit disclosure. I argue that this threshold is met in this case.
In this light, I want to ask the Commission to re-examine the documents in question to see whether they can be disclosed at least partially. In this light, I also would like you to re-assess your refusal to grant access to a list of the documents in question. I contend that to exercise the right of access to documents, which is guaranteed not just by the Regulation, but the Fundamental Rights Charter, in a meaningful way, there must be a way of knowing whether given documents actually exist. Not providing a clear picture of what the institution holds makes any legal recourse particularly difficult.
Yours faithfully,
Alexander Fanta
Schönhauser Allee 6-7
10119 Berlin
Germany
Dear Sir,
Thank you for your email dated 27/07/2022 by which you request, pursuant
to Regulation No 1049/2001 regarding public access to European Parliament,
Council and Commission documents, a review of the position taken by DG
JUST in reply to your initial application GESTDEM 2022/3234
We hereby acknowledge receipt of your confirmatory application for access
to documents which was registered on 27/07/2022 (Ares(2022)5406356).
Your application will be handled within 15 working days (18/08/2022). In
case this time limit needs to be extended, you will be informed in due
course.
Please be informed that the answer to your confirmatory application is a
formal Commission decision that will be notified to you by express
delivery. Thank you for providing your contact phone number, so that the
external delivery service can contact you in case of absence.
Please note that the Commission will not use your phone number for any
other purpose than for informing the delivery service, and that it will
delete it immediately thereafter.
Yours faithfully,
Access to documents team (cr)
SG.C.1
Transparency
Link: [1]File-List
Link: [2]Edit-Time-Data
Link: [3]themeData
Link: [4]colorSchemeMapping
Dear Mr Fanta,
I refer to your email of 27 July 2022, registered on the same day, by
which you submitted a confirmatory application in accordance with Article
7(2) of Regulation (EC) No 1049/2001 regarding public access to European
Parliament, Council and Commission documents ("Regulation (EC) No
1049/2001"), registered under reference number above.
Your confirmatory application is currently being handled. Unfortunately,
we have not yet been able to gather all the elements needed to carry out a
full analysis of your request and to take a final decision. Therefore, we
are not in a position to reply to your confirmatory request within the
prescribed time limit which expires on 18 August 2022. Consequently, we
have to extend this period by another 15 working days in accordance with
Article 8(2) of Regulation (EC) No 1049/2001. The new deadline expires on
8 September 2022. However, I can assure you that we are doing our utmost
to provide you with a final reply within the next 15 working days.
I regret this additional delay and sincerely apologise for any
inconvenience this may cause.
Yours sincerely,
Mariusz Daca, Ph.D.
Deputy Head of Unit
European Commission
Secretariat General
Unit C.1 (Transparency, Document Management and Access to Documents)
References
Visible links
1. file:///tmp/cid:filelist.xml@01D8B313.AE747D50
2. file:///tmp/cid:editdata.mso
3. file:///tmp/~~themedata~~
4. file:///tmp/~~colorschememapping~~
Link: [1]File-List
Link: [2]Edit-Time-Data
Link: [3]themeData
Link: [4]colorSchemeMapping
[5]Your confirmatory application for access to documents under Regulation
(EC) No 1049/2001 - GESTDEM 2022/3234 - 2nd holding letter -
Ares(2022)6209755 (Please use this link only if you are an Ares user –
Svp, utilisez ce lien exclusivement si vous êtes un(e) utilisateur d’Ares)
Dear Mr Fanta,
I refer to your email of 27 July 2022, registered on the same day, by
which you submitted a confirmatory application in accordance with Article
7(2) of Regulation (EC) No 1049/2001 regarding public access to European
Parliament, Council and Commission documents (‘Regulation (EC) No
1049/2001’), registered under reference number above.
I also refer to our holding reply dated 18 August 2022, by which the time
limit for replying to your confirmatory request was extended by 15 working
days, pursuant to Article 8(2) of the Regulation. This extended time limit
expired on 8 September 2022.
Unfortunately, we are not yet in a position to provide you with our final
position within this deadline, due to the ongoing internal consultations
within the Commission. However, I can assure you that we are doing our
utmost to provide you with a final reply within the upcoming days.
I regret this additional delay and sincerely apologize for any
inconvenience this may cause.
Yours sincerely,
Mariusz Daca, Ph.D.
Deputy Head of Unit
European Commission
Secretariat General
Unit C.1 (Transparency, Document Management and Access to Documents)
References
Visible links
1. file:///tmp/cid:filelist.xml@01D8C361.CC614380
2. file:///tmp/cid:editdata.mso
3. file:///tmp/~~themedata~~
4. file:///tmp/~~colorschememapping~~
5. https://webgate.ec.testa.eu/Ares/documen...
Dear Access to documents team,
I haven't heard any news on my access to documents appeal 2022/3234 for the past six months. Any progress?
Yours sincerely,
Alexander Fanta
Your message has been received by the Transparency Unit of the
Secretariat-General of the European Commission.
Requests for public access to documents are treated on the basis of
[1]Regulation (EC) No 1049/2001 of 30 May 2001 regarding public access to
European Parliament, Council and Commission documents.
The Secretariat-General will reply to your request within 15 working days
upon registration of your request and will duly inform you of the
registration of the request (or of any additional information to be
provided in view of its registration and/or treatment).
L’unité «Transparence» du secrétariat général de la Commission européenne
a bien reçu votre message.
Les demandes d’accès du public aux documents sont traitées sur la base du
[2]règlement (CE) n° 1049/2001 du 30 mai 2001 relatif à l’accès du public
aux documents du Parlement européen, du Conseil et de la Commission.
Le secrétariat général répondra à votre demande dans un délai de 15 jours
ouvrables à compter de la date d’enregistrement de votre demande, et vous
informera de cet enregistrement (ou vous indiquera toute information
supplémentaire à fournir en vue de l'enregistrement et/ou du traitement de
votre demande).
Ihre Nachricht ist beim Referat „Transparenz“ des Generalsekretariats der
Europäischen Kommission eingegangen.
Anträge auf Zugang zu Dokumenten werden auf der Grundlage der
[3]Verordnung (EG) Nr. 1049/2001 vom 30. Mai 2001 über den Zugang der
Öffentlichkeit zu Dokumenten des Europäischen Parlaments, des Rates und
der Kommission behandelt.
Das Generalsekretariat beantwortet Ihre Anfrage innerhalb von
15 Arbeitstagen nach deren Registrierung und wird Sie über die
Registrierung Ihres Antrags (oder die Notwendigkeit weiterer Informationen
im Hinblick auf dessen Registrierung und/oder Bearbeitung) unterrichten.
References
Visible links
1. https://eur-lex.europa.eu/legal-content/...
2. https://eur-lex.europa.eu/legal-content/...
3. https://eur-lex.europa.eu/legal-content/...
[1]Your confirmatory application for access to documents under Regulation
(EC) No 1049/2001 - GESTDEM 2022/3234 - 2nd holding letter -
Ares(2022)6209755 - Ares(2023)1802329 (Please use this link only if you
are an Ares user – Svp, utilisez ce lien exclusivement si vous êtes un(e)
utilisateur d’Ares)
Dear Mr Fanta,
Thank you for your message.
Please excuse the persisting delay in our processing of your confirmatory
application for access to documents, registered under the reference number
GESTDEM 2022/3234, which has been caused by the need to hold various
internal consultations between the Commission services concerned by the
subject matter of the documents requested. Please be informed that, for
the most part, those consultations have been now concluded and a draft
confirmatory decision on your confirmatory applications is currently being
drawn up. Once it is finalised, it will be subjected to a review by the
Commission's Legal Service and, upon its approval, adopted by the
Secretary-General. Once adopted, it will be notified to you.
Once again, please accept our apologies for the delay in the processing of
your application.
With kind regards,
SG ACCESS TO DOCUMENTS TEAM
Dear Mr FANTA Alexander,
Please find attached the electronic version of Commission Decision C(2023)
6556 as adopted by the European Commission on 25.9.2023.
The formal notification of the decision under Article 297 TFEU is being
made only in electronic form.
Could you please confirm receipt of the attached document by return
e-mail?
Many thanks in advance.
Kind regards,
MARTIN GALAN MARIA SERENA
Secrétariat général de la Commission
SG B2 - Procédures écrites, habilitation, délégation
BERL 05/P071' +32-2-299.59.48