COMPLAINT: 274/2021/TE

Case title: The EDPS’s refusal to grant public access to documents related to a report concerning the Schrems II judgment

Date: Monday, 29 March 2021

Inspection at the EDPS’s premises with some EDPS representatives attending remotely via WebEx

Present

Representatives from the European Ombudsman

· Ms Tanja Ehnert, Inquiries Officer, Directorate of Inquiries

· Ms Angela Marcos Figueruelo, Inquiries Officer, Directorate of Inquiries

· Ms Leticia Díez Sánchez, Trainee, Directorate of Inquiries

Representatives from the European Data Protection Supervisor

· Head of Unit Technology and Privacy

· Legal Officer, Supervision and Enforcement Unit

· Data Protection Officer

· Transparency Officer

Purpose of the meeting

The inquiry concerns the EDPS’s refusal to grant public access to the following documents, as per the request:

a) the mapping exercise identifying which ongoing contracts, procurement procedures and other types of cooperation involve transfers of data that the EDPS carried out for itself, in the context of its ‘Strategy for Union institutions, offices, bodies and agencies to comply with the Schrems II ruling’;

b) a copy of any privacy assessment, including data protection impact assessments, carried out by the EDPS for the use by the EDPS of the following tools: Microsoft Office365, Microsoft Teams, Zoom, Cisco WebEx, Skype.

On 24 February 2021, a first meeting between the Ombudsman’s inquiry team and EDPS representatives took place to discuss the background of the inquiry, the documents falling within the scope of the access to document request, and their relevance for the investigation that the EDPS is currently conducting regarding the EU institutions’ compliance with the Schrems II ruling.^[1]

The purpose of this second meeting was to inspect the documents covered in this inquiry.

Documents inspected

The EDPS representatives presented the documents that the EDPS identified as falling within the scope of the complainant’s access request:

On part a):

· Report on the mapping exercise identifying which ongoing contracts, procurement procedures and other types of cooperation involve transfers of data that the EDPS carried out for itself.

On part b):

· Note to file - Assessment of videoconference and webinar tools (case 2020-0382 - last update 29 May 2020);

· Report - VC tools v. 1.2;

· Report - VC tools v. 1.3;

· EDPS Inspection tools;

· EDPS Inspection tools v.2.

The Ombudsman’s inquiry team asked the EDPS for copies of the documents regarding part b) of the complainant’s access request.

The EDPS asked that the documents be treated confidentially.

Brussels, 26 April 2021

 

Tanja Ehnert                                                                          Angela Marcos Figueruelo

Inquiries Officer                                                                    Inquiries Officer

 

[1] Judgment of the Court (Grand Chamber) of 16 July 2020, Data Protection Commissioner v Facebook

Ireland Limited and Maximillian Schrems, Request for a preliminary ruling from the High Court (Ireland),

Case C-311/18, available at https://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=12312155.