EDPB documents on CSAM proposal (‘Chat Control’) – compatibility with CFR and GDPR

Andrej Magyar made this access to documents request to European Data Protection Board Automatic anti-spam measures are in place for this older request. Please let us know if a further response is expected or if you are having trouble responding.

The request was partially successful.

Dear European Data Protection Board,

Pursuant to Regulation (EC) No 1049/2001, Article 15 TFEU, and Article 42 of the Charter of Fundamental Rights, I hereby request access to:

– Any opinions, correspondence, internal notes, or meeting records held by the EDPB concerning the compatibility of the proposed Regulation laying down rules to prevent and combat child sexual abuse (the ‘Chat Control’/CSAM proposal) with the Charter of Fundamental Rights and the General Data Protection Regulation (GDPR).

In particular, I seek documents addressing:
– Interactions with Articles 7 and 8 CFR (privacy and data protection),
– The application of GDPR principles (necessity, proportionality, data minimisation, purpose limitation),
– Implications for Article 47 CFR (effective remedies and judicial safeguards).

Timeframe: 2020 to present.

If Article 4(2) or 4(3) exceptions are invoked, I submit that an overriding public interest exists in disclosure: namely, safeguarding fundamental rights and data protection standards in the context of broad surveillance proposals. Where needed, I request partial access under Article 4(6).

Please acknowledge receipt and process this request within 15 working days as set out in Article 7 of Regulation 1049/2001. I prefer electronic access.

Yours faithfully,
Andrej Magyar

Dear Contact,

Thank you for your message.

You will find the answer to the vast majority of requests sent
to us on the following page: [1]https://www.edpb.europa.eu/about-edpb/mo...

We will respond further only if your request is not already addressed on
that page. Please note that the EDPB/EDPB Secretariat will not respond to
abusive communications.

Please note that the EDPB brings together the different data protection
authorities in the EU and the European Data Protection Supervisor. The
EDPB's mission is to ensure the consistent application of the EU data
protection framework.

In particular, the EDPB has the competence to:

• provide general guidance (including guidelines, opinions,
recommendations and best practices) on data protection law;
• advise the European Commission on any issue related to the protection
of personal data, including on new proposed legislation in the
European Union;
• adopt consistency decisions and opinions in data protection cases
involving several EU countries.

For more details,
see: [2]https://www.edpb.europa.eu/about-edpb/wh...

[3]BG - Български [4]CS - Čeština [5]DA - Dansk
[6]DE - Deutsch [7]EL - Ελληνικά [8]EN - English
[9]ES - Español [10]ET - Eesti [11]FI - Suomi
[12]FR - Français [13]GA - Gaeilge [14]HR - Hrvatski
[15]HU - Magyar [16]IT - Italiano [17]LT - Lietuvių
[18]LV - Latviešu [19]MT - Malti [20]NL - Nederlands
[21]PL - Polski [22]PT - Português [23]RO - Română
[24]SK - Slovenčina [25]SL - Slovenščina [26]SV - Svenska

Kind regards,
The EDPB Secretariat

Version: 28/05/2025

References

Dear European Data Protection Board,

Thank you for your reply of 8 September 2025.

I would like to respectfully clarify that my request of the same date is not limited to documents already published on the EDPB website. Instead, I specifically seek unpublished material held by the EDPB, namely:

- Opinions, correspondence, internal notes, or meeting records concerning the compatibility of the proposed Regulation laying down rules to prevent and combat child sexual abuse (the “Chat Control” / CSAM proposal) with the Charter of Fundamental Rights and the General Data Protection Regulation (GDPR), in particular:
- Interactions with Articles 7 and 8 CFR (privacy and data protection);
- Application of GDPR principles (necessity, proportionality, data minimisation, purpose limitation);
- Implications for Article 47 CFR (effective remedies and judicial safeguards).

I fully acknowledge and have already consulted the general information, guidelines and published opinions made available on your website. My request therefore concerns documents not publicly available, including internal communications and records.

I kindly ask you to assess my request under Regulation (EC) No 1049/2001 and to:
- Confirm whether such unpublished documents are held by the EDPB;
- Disclose them where possible; or
- Provide specific, reasoned reliance on any applicable Article 4 exceptions. In that case, I also request consideration of partial access under Article 4(6) and of the overriding public interest in disclosure.

Thank you for your attention, and I look forward to your reply in accordance with the deadlines of Article 7 of Regulation 1049/2001.

Yours faithfully,
Andrej Magyar

image001.png

17K Download

Dear correspondent,

Thank you for your email. However, the broad description given in your
request attached and the extensive timeframe you indicated, does not
enable us to identify the concrete documents you are seeking access to.

Following a preliminary assessment based on your request, the EDPB would
incur a disproportionate workload in order to carry out the preliminary
research required to identify the documents potentially related to your
request, based on the information you have provided in your message below.
This is because your request is made in a very broad manner and refers to
a very extended timeframe of 5 years of EDPB work. Going through 5 years
of documents to identify those potentially falling within the broad scope
of your request entails a disproportionate task that the EDPB is not in a
position to undertake.

In this regard, we would like to draw your attention to the fact that an
EU Institution can refuse to identify the documents falling under the
scope of a request if the identification would lead to a disproportionate
workload.

Nevertheless, in the light of Article 6(3) of Regulation (EC) No 1049/2001
regarding public access to documents when an application relates to a very
long document or concerns a very large number of documents, we would try
to confer with you with a view to finding a fair solution.

This fair solution cannot allow the time-limits laid down by Regulation
No 1049/2001 to be changed.

In the light of above, we would kindly ask whether you could narrow down
the scope of your application in a way that would enable its processing
within the deadline provided in Article 7 of Regulation 1049/2001. In
particular, we would like to ask you to narrow the request to one specific
kind of documents and/or to reduce the timeframe, in order for us to be
able to identify the documents potentially related to this new scope of
the request.

We believe that the documents that are most relevant in relation to your
request could be the minutes of the expert groups of the EDPB members
where the compatibility of the proposed Regulation laying down rules to
prevent and combat child sexual abuse (the ‘Chat Control’/CSAM proposal)
with the Charter of Fundamental Rights and the General Data Protection
Regulation (GDPR) were discussed from 2020 to present. In identifying this
proportionate scope for your request, we carefully consider what could be
in your best interest. By providing you with the relevant minutes of the
expert subgroups, we show you what had actually been discussed by EDPB
members on the matters of your interest in the timeframe of your choice.

Please note that this request will be considered closed if no reply is
received within 15 working days. Of course, this does not prevent you from
making another request at any stage in the future.

Thank you for your cooperation.

Kind regards,

EDPB Secretariat

[1]edpb.europa.eu
[2]EDPB logo
This email (and
any attachment)
may contain
information that
is internal or
confidential.
Unauthorised
access, use or
other processing
is not permitted.
If you are not
the intended
recipient please
inform the sender
by reply and then
delete all
copies. Emails
are not secure as
they can be
intercepted,
amended, and
infected with
viruses. The EDPB
therefore cannot
guarantee the
security of
correspondence by
email.

References

Visible links
1. https://www.edpb.europa.eu/

Dear European Data Protection Board,

Thank you for your response. I understand the volume of material referred to in my request is substantial. To facilitate your handling, I am willing to refine the scope as follows:

- Timeframe: documents dated from 1 January 2023 to present
- Topics: specifically relating to the compatibility of the CSAM proposal with GDPR data protection principles (necessity, proportionality, data minimisation, purpose limitation) and Charter Article 47 (effective remedies)
- Document types: EDPB legal opinions, meeting minutes, and official internal correspondence or notes under the EDPB logo

Please confirm that you will proceed to search and provide documents within this refined scope. I emphasise that this refinement is intended to assist processing—not to concede the relevance of materials extending beyond these parameters.

Thank you for your cooperation.

Yours sincerely,
Andrej Magyar

Dear correspondent,

Many thanks for your email.

We are writing to you because we would like to inform you that the EDPB has no legal service unlike the Commission, therefore the EDPB does not have "EDPB legal opinions" as documents.

If you would mean something different, we would be happy to help you.

Best regards,

EDPB Secretariat

show quoted sections

Dear European Data Protection Board,

Thank you for your clarification. To avoid any misunderstanding, by “EDPB legal opinions” I was referring to formal outputs such as guidelines, recommendations, consistency opinions, letters, or other formal positions adopted under the EDPB logo that concern the proposed Regulation on preventing and combating child sexual abuse (CSAM/“Chat Control”), in particular its compatibility with GDPR principles (necessity, proportionality, data minimisation, purpose limitation) and Charter Article 47 (effective remedies).

I would be grateful if you could proceed to identify and provide such documents, alongside any relevant meeting minutes or internal correspondence that address these issues, within the previously refined timeframe (1st January 2023 – present).

Thank you for your cooperation.

Yours sincerely,
Andrej Magyar

Dear Contact,

Thank you for your message.

You will find the answer to the vast majority of requests sent
to us on the following page: [1]https://www.edpb.europa.eu/about-edpb/mo...

We will respond further only if your request is not already addressed on
that page. Please note that the EDPB/EDPB Secretariat will not respond to
abusive communications.

In particular, the EDPB has the competence to:

For more details,
see: [2]https://www.edpb.europa.eu/about-edpb/wh...

Kind regards,
The EDPB Secretariat

Version: 28/05/2025

References

image001.png

17K Download

Dear correspondent,

We confirm registration of your access to documents request and registered
it today under reference 2025-15. Please use this reference for further
correspondence.

We are currently assessing your request and will provide you with a reply
within 15 working days (01/10/2025).

Please note that the EDPB specific privacy statement regarding the
processing of personal data for the purposes of handling requests for
access to documents is available on the EDPB website and can be viewed via
this link: [1]https://edpb.europa.eu/edpb-specific-pri....

Should you have any further queries, please do not hesitate to contact us.

Best regards,

The EDPB Secretariat

[2]edpb.europa.eu
[3]EDPB logo
This email (and
any attachment)
may contain
information that
is internal or
confidential.
Unauthorised
access, use or
other processing
is not permitted.
If you are not
the intended
recipient please
inform the sender
by reply and then
delete all
copies. Emails
are not secure as
they can be
intercepted,
amended, and
infected with
viruses. The EDPB
therefore cannot
guarantee the
security of
correspondence by
email.

References

Visible links
1. https://edpb.europa.eu/edpb-specific-pri...
2. https://www.edpb.europa.eu/

Dear European Data Protection Board,

Thank you for your swift registration and acknowledgment of my request. I would also like to commend the EDPB for its straightforward handling of the procedure: procession the application without requiring a postal address, which is fully consistent with Regulation 1049/2001 and with the principles of necessity and proportionality under Regulation 2018/1725.

This stands in direct contrast with European Commission's current practice of demanding postal addresses even in cases of purely electronic correspondence - a practive that is, in fact, the subject of a pending Ombudsman complaint (2596/2025/SB, now tracked under number 2596/2025/TM). Your approach demonstrates that such a requirement is neither legally mandated nor administratively necessary, and represents best practice in access to documents handling.

I look forward to your reply within the statutory deadlines and thank you once again for your efficient and transparent handling of this request.

Yours sincerely,
Andrej Magyar

image001.png

17K Download
Document 3.pdf

673K View Download
Document 4.pdf

724K View Download
Document 5.pdf

719K View Download
Document 1.pdf

566K View Download
Document 2.pdf

918K View Download
Letter to applicant 2025 15.pdf

251K View Download

Dear correspondent,

Please find enclosed the reply to your request for access to documents
(ref. 2025-15) signed by Mr Zdravko Vukić, Vice-Chair of the EDPB.

We kindly ask to confirm receipt of this document.

Best regards,

The EDPB Secretariat

References

Visible links
1. https://www.edpb.europa.eu/

AsktheEU.org

EDPB documents on CSAM proposal (‘Chat Control’) – compatibility with CFR and GDPR

1 Attachment

1 Attachment

7 Attachments

Act on what you've learnt

Requests like this

Facebook and processing purposes

Regulatory Scrutiny Board Communication

PhotoDNA: DG Connect

PhotoDNA: EDPS

Law on child sexual abuse material

WK documents on CSAM Regulation

Working documents on CSAM Regulation

CSAM proposal (‘Chat Control’) – compatibility with Charter of Fundamental Rights

EDPS documents on CSAM proposal (‘Chat Control’) – compatibility with CFR and GDPR

CSAR trilogue documents and age verification assessments