Background to the complaint

1. In October 2021, the complainant asked the European Data Protection Board (EDPB) to give him public access to its preparatory documents leading to the adoption of its statement, guidelines and reply to a Member of the European Parliament (MEP) regarding international transfers provided for under the General Data Protection Regulation (GDPR). This included draft versions of documents, information notes and minutes of meetings where the documents were discussed.

2. The EDPB identified 103 documents falling under the scope of the complainant´s request.^[1] It granted full access to 17 of those documents, partial access to 16 documents and denied access to the remaining documents. In refusing access to the documents, the EDPB relied on the need to protect its decision-making process and personal data. The EDPB considered that there was no overriding public interest in the disclosure of the documents.

3. The complainant turned to the Ombudsman. He complained that the EDPB relied on the decision-making exception in an overly broad manner and that there was an overriding public interest justifying the disclosure of the documents. He also stated that he sought access to the documents in anonymised form.

4. The Ombudsman opened an inquiry and her team inspected the documents that had not been disclosed to the complainant, partially or in full. It also held a meeting with representatives of the EDPB.[2]

5. During the course of the inquiry, the EDPB re-assessed the documents and granted wider partial access to two documents, which were provided to the complainant.

6. The EDPB argued that further disclosure of the documents would give rise to undue external pressure on the members of its Board if their views were made public, and that it would cause uncertainty or confusion for the public. Further, the EDPB stated that disclosure would impede its ability to provide a consistent interpretation of data protection rules, undermine its mission to speak with one voice and that it would interfere with its independent role. The EDPB also considered that further disclosure would detract attention from the published version and would encourage stakeholders not to follow that final position. Finally, the EDPB claimed that its future position as regards negotiations on the US Foreign Account Tax Compliance Act (FATCA) would be undermined by the disclosure of the requested documents.

The Ombudsman's proposal for a solution

7. Having reviewed the documents in question, the Ombudsman found that the documents partially disclosed by the EDPB either fell outside the scope of the request, were subsequently released by the EDPB or solely preserved the identity of the author of the comment, which is not challenged by the complainant.

8. As regards the documents not disclosed in their entirety, the Ombudsman found that the EDPB had failed to give the complainant sufficiently broad access.

9. The Ombudsman acknowledged that the complainant’s request covered different types of preparatory documents, namely documents related to the drafting of EDPB Guidelines,[3] on the one hand, and documents related to the drafting of an EDPB statement[4] and a reply to an MEP,[5] on the other. The Ombudsman found that it was not clear how the decision-making process of the EDPB could be seriously undermined by the disclosure of these preparatory documents given their nature and content, and that the EDPB had failed to demonstrate, in actual and specific terms, the risks that would arise from granting broader access to these documents.

10. Based on her assessment of the documents at issue and her findings, the Ombudsman proposed that the EDPB conduct a fresh assessment of the complainant’s request for access and grant the widest possible access to those documents which had not been disclosed in their entirety.^[6]

11. The EDPB, in response to the Ombudsman’s solution proposal, maintained its position and refused further disclosure. It reiterated the arguments previously mentioned, and in addition claimed that disclosure of draft versions of the documents would harm the effective protection of personal data. The EDPB also relied upon the need to protect international relations as a reason to justify the non-disclosure of the documents at issue.^[7] The EDPB stated that, based on its previous experience, the disclosure of anonymised versions of documents would not prevent the attribution of views to specific parties and thus disclosure would seriously harm its decision-making process. 

12. The solution proposal and the EDPB’s reply to the proposal were provided to the complainant and he again rejected the reasoning provided by the EDPB in maintaining its decision to refuse access.

The Ombudsman's recommendation

13. In her recommendation, the Ombudsman reiterated her view that the EDPB had not provided sufficiently convincing arguments to establish a ‘specific and actual risk’ to its decision-making process. Moreover, even where such a risk could be established, the Ombudsman found, as regards the EDPB’s guidelines, that they contained an authoritative interpretation of the GDPR and given the importance of personal data in the lives of EU citizens and business, there is an overriding public interest in granting wider and further disclosure.

14. More specifically, the Ombudsman found that the arguments put forward by the EDPB on the existence of external pressure in relation to the preparatory documents remained vague and of a general nature. Moreover, even if the existence of such external pressure were to be demonstrated, it was unclear how the capacity of the EDPB to exchange freely would be seriously undermined by such pressure, in particular given that the decision-making processes that led to the adoption of the statement and the guidelines had ended by the time the confirmatory decision was adopted. In addition, the Ombudsman found that the concerns of the EDPB that disclosure of draft documents, without explanation of the reasons behind those changes, would create confusion in the eyes of the public or that it would undermine its authority or independence were not substantiated.

15. The inspection of the preparatory documents showed that, as regards the draft statements and draft replies to the MEP, these mostly contained editorial changes as well as clarifications or simplification of certain parts of the text, which did not appear particularly sensitive. The Ombudsman further noted that they did not include any interpretation of data protection rules nor illustrate differing views within the Board.

16. As regards the draft guidelines, the Ombudsman noted that some of the drafts comprised clean versions or contain editorial changes and, as with the draft statements and the draft replies to the MEP, clarified or simplified the text and did not appear particularly sensitive. In other instances, it was possible to identify differing views on the interpretation of data protection rules. However, the EDPB acknowledged that these exchanges of views or negotiations within the Board were an ‘intrinsic element’ of the functioning of the Board, including its adoption of guidelines. The Ombudsman did not see how, if the views of the authors were anonymised, such comments could be attributed to a specific author, in particular where there were no dissenting views in the public domain. On the contrary, disclosure of these preparatory documents would allow the public to better understand how an authoritative interpretation of the GDPR was reached. Neither was it established from a review of the documents how these could cause confusion for the public or how the authority of the Board would have been jeopardised as the documents were clearly marked as drafts.

17. As regards the EDPB’s argument that disclosure of the documents at issue would harm international relations, the Ombudsman found that the EDPB had not provided any justification for relying on this exception.

18. The Ombudsman had not assessed whether the EDPB’s reliance on the exception concerning the effective protection of personal data was justified as the complainant had not contested the redaction of personal data in the documents he requested.

19. The Ombudsman thus found that the EDPB’s application of the exceptions for the protection of its decision-making processes and of international relations constituted maladministration. She recommended that EDPB grant the complainant the broadest possible access to the requested documents.[8]

20. The Ombudsman shared a separate confidential note with the EDPB, annexed to the recommendation, which included a more detailed assessment on the nature and content of the preparatory documents in light of the exceptions invoked by the EDPB to deny access.

21. In June 2023, the EDPB in its opinion informed the Ombudsman that it had decided to revise its decision on the complainant’s request and grant wider access to the documents identified, in line with the Ombudsman’s recommendation. The EDPB disclosed in full eighteen draft versions of Statement 04/2021,[9] nine versions of the draft Guidelines 2/2020[10] and four versions of the draft reply to an MEP.[11] Regarding the parts of the documents which were not disclosed, the EDPB maintained the arguments previously mentioned that such disclosure would seriously undermine its decision-making process. In particular, the EDPB stressed the importance for its members, given their prominent role in developing guidelines and statements, to be able to express their views independently and without the risk of being exposed to external pressure, including from Member States’ government. Therefore, the EDPB emphasised the need to create a “space to think” for Board members which enables frank discussion and the exchange of “uncensored opinions”.

22. The EDPB considered that it was not possible to anonymise the comments of its staff and members, as there would still be a risk that the author could be identified. The EDPB thus considered that the disclosure provided was sufficient to allow individuals to understand the functioning of its decision making process in relation to the documents at stake. The EDPB also agreed that its Rules of Procedures, which provide rules on confidentiality of the discussions of the Board, do not take legal precedence over Regulation 1049/2001.

23. The complainant did not make any further comments on the EDPB’s reply.

The Ombudsman's assessment after the recommendation

24. The Ombudsman welcomes the EDPB’s decision to provide greater access to the documents requested by the complainant and to address the substantive comments made by the Ombudsman in her recommendation. She further notes that the EDPB acknowledged that its internal rules, which provide that the deliberations of the Board are confidential, do not constitute an exception to disclosure under Regulation 1049/2001.

25. The Ombudsman notes that the EDPB decided not to disclose all comments, in their entirety, made at staff level and/or by its members on draft versions of Statement 04/2021, Guidelines 2/2020 and the reply to the MEP. The EDPB was concerned that, even if those comments were anonymised, it would still be possible to identify the author of the comment, for instance, through their use of language or syntax, and thus disclosure would seriously harm its decision-making process.

26. While the Ombudsman acknowledges that the EDPB provided a more detailed reasoning in this regard, she notes that the EDPB redacted all comments in their entirety, irrespective of their specific content and nature in order to protect the process behind the Board’s deliberations. In this regard, the Ombudsman notes that a number of comments are rather generic in nature and raise editorial considerations, which do not appear sensitive. The Ombudsman would like to recall that the EDPB cannot systematically redact a particular type of information without assessing its actual content. The requirement to carry out an individual assessment of the documents requested in order to determine whether access may be refused based on a risk that must be actual and specific, reasonably foreseeable and not hypothetical, also applies in the case of partial access. It is on the basis of this individual assessment, and where such a risk is established, that the EDPB is required to assess the existence of an overriding public interest in disclosure. It is not clear that the EDPB conducted such an individual assessment of risk for each of the comments redacted to enable it distinguish between those parts which would pose a serious risk to its decision-making process and those that would not.

27. Nevertheless, given that the complainant did not take further issue with the EDPB’s decision, and as the EDPB provided broader access to the documents identified, the Ombudsman has decided to close the case.

28. The Ombudsman would also like to mention that the protection of the decision-making process from targeted external pressure can be a reason for refusal only if the reality of such pressure is “established with certainty”, and there is evidence of “a reasonably foreseeable risk that the decision to be taken would be substantially affected owing to that external pressure”. This finding of the Court applies irrespective of whether the documents at issue form part of the legislative process or not and whether or not the document is final.[12]

29. The Ombudsman trusts that the EDPB, when faced with access to documents requests in the future, will ensure that it complies with the case law and that, where it seeks to apply an exception to disclosure, it establishes the risks posed by the disclosure of all or parts of a document, including, internal comments, individually and on a case by case basis, in order to determine whether such a risk is real and actual, foreseeable and not purely hypothetical.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

As the EDPB granted wider access, the Ombudsman has decided to close the case.

The complainant and the EDPB will be informed of this decision.

 

Emily OʹReilly
European Ombudsman

Strasbourg, 31/10/2023

 

[1] During the course of the inquiry, it transpired that no preparatory documents relating to one of the two EDPB statements were assessed at the initial and confirmatory stages. The Ombudsman encouraged the EDPB to treat these 141 documents as a separate public access request.

[2] https://www.ombudsman.europa.eu/en/doc/inspection-report/en/156600

[3] EDPB Guidelines 2/2020 on “Articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies”

[4] EDPB Statement 04/2021 on "International Agreements Including Transfers"

[5] reply available here: https://edpb.europa.eu/system/files/2021-07/edpb_letter_out2021-0119_intveld_igas.pdf

[6] For further information on the background to the complaint, the parties' arguments and the Ombudsman's inquiry, please refer to the full text of the Ombudsman's proposal for a solution.  

[7] Article 4(1)(a) 3rd indent of Regulation 1049/2001.

[8] For further information on the assessment of the Ombudsman in her recommendation, please refer to the full text of the Ombudsman's recommendation available here: https://www.ombudsman.europa.eu/en/recommendation/en/167856

[9] The EDPS granted partial access to the remaining version of its draft statement, redacting all comments made which identify the author.

[10] The EDPS granted partial access to the remaining 32 versions of its draft guidelines, redacting all comments made which identify the author.

[11] The EDPS granted partial access to the remaining 4 versions of its draft reply to an MEP, redacting all comments which identify the author

[12] Judgment of the General Court of 9 September 2014 in case T-516/11, MasterCard and Others v Commission, is in connection with a study called for following an invitation to tender and also includes draft versions of documents. See paras 15, 70-71. https://curia.europa.eu/juris/document/document.jsf?text=&docid=157442&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=350441