Chair of the European Data Protection Board Rue Wiertz 60 B-1047 Brussels

 

 

Dear Ms X,

I am writing to seek a solution to this case^[1], which is based on a complaint I received from Mr Y on 22 January 2022.

The complainant requested from the European Data Protection Board (EDPB) public access to “all documents related to the following artefacts produced by the EDPB:

* EDPB Statement 04/2021 on "International Agreements Including Transfers".

* EDPB Guidelines 02/2020 on "articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies"[EDPB Guidelines]

* EDPB Statement 01/2019 on "the US Foreign Account Tax Compliance Act (FATCA)"

* EDPB Response to Dutch MEP Sophie in 't Veld dated 07 July 2021, with reference OUT2021-0119 and publicly available here: (https://www.linkedin.com/posts/fabienlehagre_responsefrom-the-edpb-fatca-activity-6823908053994242048-m-t-).

Subsequently, Mr. Y clarified the scope of his request in that he sought “access to preparatory documents containing Data Protection Authority Statements, questions, opinions and concerns leading to the adoption of EDPB documents identified as 04/2021, 02/2020, 01/2029 and OUT2021-0119” in anonymised form.

The EDPB identified 103 documents falling under the scope of the complainant´s request[2]. It granted full access to 17 of those documents, partial access to 16 documents and denied access to the remaining documents. In refusing access to the documents, the EDPB invoked an exception^[3] provided for under the EU legislation on public access to documents (Regulation 1049/2001), arguing that disclosure would “seriously undermine” its decision-making process. The EDPB considered that there was no overriding public interest in the disclosure of the documents.

In the course of my inquiry, the EDPB re-assessed the documents requested and granted wider partial access to two documents, which were provided to the complainant. My inquiry team has examined the documents at stake in this inquiry and the comments provided by the EDPB on 24 February 2022.

As a preliminary remark, it is important to note that the complainant’s request covers different types of preparatory documents, namely documents related to the drafting of EDBP Guidelines, on the one hand, and documents related to the drafting of an EDPB statement and a reply to a Member of the European Parliament, on the other.

I already took the view, in the context of a previous inquiry that EDPB Guidelines set out a legal interpretation of the GDPR that has a significant bearing on its application.[4] Given the importance of the GDPR, the public clearly has an interest in knowing how an authoritative interpretation of its provisions was decided. I acknowledge that EDPB statements and replies to MEPs are of a different nature.

Having said that, Regulation 1049/2001 applies to all documents held by the institutions.^[5] Regulation 1049/2001 is based on the assumption that “openness enables citizens to participate more closely in the decision-making process and guarantees that the administration enjoys greater legitimacy and is more effective and more accountable to the citizen in a democratic system”.^[6] Access to documents can be restricted only if one (or more) of a limited number of exceptions in Regulation 1049/2001 apply^[7].

From a review of the documents partially disclosed by the EDPB to date, it appears that the parts redacted primarily fall outside the scope of the complainant’s request. In relation to the other redacted parts, these were either subsequently released or solely preserve the identity of the author of the comment made, which is not at issue.

My solution proposal therefore relates only to documents that were not disclosed in their entirety. As regards those documents, the EDPB relied on the exception in Article 4(3), second paragraph, of Regulation 1049/2001, which concerns the protection of an institution’s decision-making process where that process is concluded. 

The Court has acknowledged that the protection of the decision-making process from targeted external pressure may constitute a legitimate ground for restricting access to documents. However, it has also emphasised that the reality of such external pressure “must be established with certainty” and that “evidence must be adduced to show that there was a reasonably foreseeable risk” for the decision in question to be substantially affected by that external pressure.^[8]

The complainant requested access to documents related to decision-making processes that have ended. The EDBP’s arguments as to how disclosure of the documents could result in significant pressure being placed on Board members, in relation to these decision-making processes or in relation to potential future decision-making processes, remain vague and of a very general nature.

More specifically, it is not clear how disclosing the requested documents would give rise to undue external pressure on the constituent members of the Board if their views were made public, or that it would cause uncertainty or confusion for the public, as claimed by the EDPB. To this end, I note that the complainant has stated that he would be satisfied with having access to the views of the National Supervisory Authorities in anonymised format. The EDPB has not explained how granting access to anonymised views of its members could lead to external pressure on them or cause confusion. Neither has it been demonstrated how their disclosure would impede the EDPB’s ability to provide a consistent interpretation of data protection rules, undermine its mission to speak with one voice or that it would interfere with the independent role afforded to the EDPB under its founding regulation. Further, it is not clear how the EDPB’s claim that its future position as regards FATCA negotiations would be undermined by the disclosure of the requested documents, in circumstances where the preparatory documents concerning its Statement 01/2019 do not fall within the current inquiry (see footnote 2 above) . Thus, the EDPB has not established in actual and specific terms how such serious risks to its decision-making process arise nor have they provided any examples of such risks arising.

I also note that the role of the Commission as a member of the Board and its ability to express views as a permanent observer during those deliberations are provided for in EU law and that the expression of differing views is to be expected and welcomed. The EDPB has itself acknowledged that exchanging views and negotiation is ‘an intrinsic element’ to its functioning as a Board. Furthermore, I do not accept that the founding regulation of the EDPB creates a specific exception to the right of public access to its documents based on the EDPB’s claim that it is an independent body.

In light of the above, I would like to propose as a solution in this case that the EDPB reconsider its decision on the complainant´s public access request as regards those documents not disclosed in their entirety, taking into account the above observations, with a view to granting the widest possible public access. This could include, for example, granting access to the views expressed by its constituent members in anonymised format, that is, without attributing the views to specific parties.

I would be grateful to receive your reply to my proposals by 21/11/2022. Once we have received your reply to the proposal, we will send a copy of it to the complainant together with a copy of the proposal.

Yours sincerely,

Emily O'Reilly
European Ombudsman

Strasbourg, 21/09/2022

 

[1] In accordance with Article 2(10) of the Statute of the European Ombudsman.

[2] During the course of the inquiry, it transpired that no preparatory documents relating to the EDPB’s Statement 01/2019 on "the US Foreign Account Tax Compliance Act” (FATCA) were assessed at the initial and confirmatory stages. In line with the Ombudsman’s letter of the 11 May 2022, these 141 documents shall be treated as a separate public access request.

[3] Article 4(3) second indent of Regulation 1049/2001.

[4] Decision in case 386/2021/AMF, paragraph 8, available at: https://www.ombudsman.europa.eu/en/decision/en/146504

[5] Recital 11 of Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32001R1049

[6] Recital 2 of Regulation 1049/2001.

[7] Article 1 of Regulation 1049/2001.

[8] Judgment of the Court of First Instance (Seventh Chamber) of 18 December 2008, Pablo Muñiz v Commission of the European Communities, Case T‑144/05, para. 86; Judgment of the General Court (Seventh Chamber, Extended Composition) of 22 March 2018, Emilio de Capitani v European Parliament, Case T‑540/15, para. 99.