Dear European Commission Data Protection Officer,

Under the right of access to documents in the EU treaties, as developed in Regulation 1049/2001, I am requesting documents which contain the following information:

The application concerns documents held by the Data Protection Officer (‘the DPO’), which the DPO holds in accordance to the provisions of the Commission Decision 597/2008 (O.J. 22/7/2008 L 193, page 7), henceforth ‘the Decision’.

The applicant kindly requests the full disclosure of copies of the following documents:

1. The documents notified to the DPO pursuant to article 8(1) of the Decision regarding the inter-services consultations about the FP7 and Horizon 2020.

2. The documents notified to the DPO pursuant to article 8(3) of the Decision about the FP7 (e.g. calls for proposals, negotiations, running of the grant agreement, external financial audits), Horizon 2020, and the external financial audits of the Research DGs.

3. Regarding the DPOs investigations pursuant to articles 4(5) or 13 of the Decision about matters directly concerned with the FP6 and FP7, the DPO drawn up documents pursuant to articles 6(a) and 13(2) of the Decision addressed to the Legal Services, and the replies of the Legal Services.

4. Regarding the DPOs investigations pursuant to articles 4(5) or 13 of the Decision about matters directly concerned with the FP6 and FP7, the documents with which the DPO made enquiries, or an investigation, with a Research DG(s), and the corresponding replies of a Research DG(s).

5. The DPO documents offering advice and recommendations to the Commission services and the data controllers about FP6 and FP7 (e.g. advice to correct inaccuracies of the DG INFSO/CNECT DPO-3338.1 & DPO-3338.2, observations about the completeness of DG RTD DPO-978.5 and DPO-978.6).

6. Notwithstanding the above five requests, the documents drawn up by the Legal Services from 1/1/2010 onwards in which both the DPO and a Research family DG are two of the listed recipients.

It is obvious that there is an overriding public interest for the full release of the requested documents.

Concerning legal opinions that, in principle, might fall under the exception of article 4(2) second indent of Regulation 1049/2001, that such legal opinions concern the fundamental right of personal data protection makes them also subject to the said interest.

Yours faithfully,

Mr. Aris KOLIMATSIS

Dear European Commission Data Protection Officer,

This email is a confirmatory application. I would appreciate if you would forward it to the Secretariat-General.

******

Dear Secretariat-General

The present document is a confirmatory application concerning GESTDEM 2013/5957, for which DG RTD provided the initial reply.

I. ASSESSMENT OF DG RTD INITIAL REPLY ON REQUEST #1

DG RTD failed to identify a single document, which is truly astonishing as the FP7 programme is the by far the most extensive personal data processing undertaking of the Commission services since 2008. The prior notifications DG RTD released in request #2 illustrate this point.

Article 8(1) of Commission Decision 597/2008 (OJ 2008, L 193 page 7) stipulates:

"The DPO shall be informed immediately by the lead
service whenever an issue, which has data-protection implications, is under consideration in the Commission’s services, and at the latest prior to taking any decision."

There can be no question that article 13 and 22(4) of Annex II of the FP7 model grant agreement has data-protection implications, in so far updated versions (after 1/7/2008) of the FP7 model grant agreement are concerned.

From the partially disclosed under Regulation 1049/2001 via asktheeu.org FP7 Audit Manual and the FP7 Audit Process Handbook (both drawn up or updated after 1/7/2008), it is evident that the FP7 external financial audits entailed massive personal data proceeding. The prior notifications DPO-3334, DPO-3338, DPO-3398 and DPO-3420 leave no room for the slightest doubt. Also, the FP7 Guide to the Financial Issues is loaded with 'recommendations' for personal data processing; several versions were published after 1/7/2008.

The FP7 Guide to Negotiations also expressly prescribes that FP7 grant agreements contain profiles (i.e. short CVs) of key personnel. In GestDem 2012/1414, http://www.asktheeu.org/en/request/82/re..., one of the reasons DG RTD refused total access is that the FP7 grant agreement contains personal data (i.e. CV). This shows that the Research DGs have systematically been processing personal data of third parties to the grant agreements.

Consequently, the FP7 Negotiations Guide, the FP7 Audit Manuals, and the FP7 Guide to Financial Issues fall under the ambit of article 8(1). As a result there is an absolute binary choice: Either the Research DGs have gravely infringed article 8(1) by not consulting the DPO, or there are documents that 'have fallen between the cracks' of the DG RTD files.

The applicant respectfully requests that the Secretariat-General undertake a fresh and diligent search for documents.

II. ASSESSMENT OF DG RTD INITIAL REPLY ON REQUEST #2

Artile 8(3) reads:

"The DPO shall be informed by the lead service or by the Legal Service, as appropriate, about opinions and position papers of the Legal Service directly relating to internal application of the provisions of the Regulation, as well as about opinions concerning the interpretation or implementation of other legal acts related to the protection of personal data and the processing thereof more particularly related to Inter-Service Consultation, and related to access to information".

It is self-evident that prior notifications are not opinions of the Legal Services, and therefore the released prior notifications of article 25 of Regulation 45/2001 are entirely immaterial to the request #2.

It is possible that the Legal Services had not drawn up a document with their opinion about FP7. This, however, would a reckless disregard of duty by both DG RTD and the Legal Services, because both administrative departments were fully aware about the personal data processing in the external financial audits. The Legal Services had submitted as evidence to the General Court audit reports and other documents with personal data of third parties. Therefore, they cannot claim that they were not aware of what was going on.

The applicant respectfully requests that the Secretariat-General undertake a fresh and diligent search for documents.

III. OVERRIDING PUBLIC INTEREST

The applicant submits that there is an overriding public interest for the full release of the documents at issue. The primary reason is to scrutinise the conduct of the Commission services and the DPO as regards the fundamental right of personal data protection.

Yours faithfully,

Mr. Aris KOLIMATSIS

Dear European Commission Data Protection Officer,

I refer to the application under Regulation 1049/2001 GESTDEM 2013/5954 attributed to your Unit and your email of 18 December 2013 http://www.asktheeu.org/en/request/fp6_f....

This is kind reminder that whilst the time-limit of 20 January 2014 has expired the Data Protection Officer has not provided the initial response.

Yours faithfully,

Mr. Aris KOLIMATSIS