Director of the EDPB Secretariat Rue Wiertz 60 B-1047 Brussels

 

Dear Ms X,

The Ombudsman has received a complaint against the EDPB concerning its refusal to grant public access to “preparatory documents containing Data Protection Authority Statements, questions, opinions and concerns leading to the adoption of EDPB documents identified as 04/2021^[1], 02/2020^[2], 01/2029^[3] and OUT2021-0119^[4]”. In his request for public access to documents to the EDPB, the complainant made reference to the Ombudsman’s findings in case 386/2022/AMF^[5]. In that case, the EDPB decided to grant wider access to the anonymised opinions of the National Supervisory Authorities in the preparatory documents for its guidelines on the processing of personal data in the context of the provision of online services.

The EDPB has identified 103 documents (or parts of documents) falling under the scope of the request. It has granted full public access to 21 documents and denied access (either in full or partially) to the remaining 82 documents. The EDPB has argued that the disclosure of these documents would seriously undermine its decision making process^[6]. The EDPB has added that the disclosure of some of the information contained in one of the documents would undermine the purpose and the result of an ongoing investigation^[7]. In addition, parts of the documents contain personal data and had to be redacted to protect the privacy and integrity of the individuals concerned^[8].

In its confirmatory decision of 14 January 2022, the EDPB stated that “making previous versions of the draft documents publicly available would cause confusion. These draft documents are part of the internal deliberations and preliminary consultations within the EDPB and do not necessarily reflect the position of the EDPB as a whole”. The EDPB considers that the views expressed by its members, its Secretariat or the European Commission at different stages of the negotiations are “snapshots” from the drafting process”. The EDPB added that “making comments of individual members and/or the staff of the EDPB Secretariat publicly available [...] would seriously undermine the decision- making process of the EDPB, as members would be less likely to share their uncensored views on a matter if they knew in advance these were to be subsequently published (even if in an anonymised manner).” Finally, the EDPB considers that the Ombudsman’s findings in case 386/2022/AMF do not set a precedent for the handling of public access requests by the EDPB. It always assesses such requests on a case-by-case basis.

We have decided to open an inquiry into this complaint.

Regulation 1049/2001 states that applications for access should be handled promptly. It is in line with this principle that the Ombudsman also seeks to deal with cases such as this as quickly as possible.

As a first step, we consider it necessary to review the documents at issue in the complainant’s request. I would be grateful if the EDPB could provide us with a copy of all the documents to which public access was denied, whether partially or in full, preferably in electronic format through encrypted e-mail,^[9] by 2 February 2022.  

The documents subject to the public access request will be treated confidentially, along with any other material that the EDPB chooses to share with us that it marks confidential. Documents of this kind will be handled and stored in line with this confidential status and will be deleted from the Ombudsman’s files shortly after the inquiry has ended.

The EDPB’s position has been set out in its confirmatory decision. However, should the EDPB wish to provide additional views, to be taken into account by the European Ombudsman during this inquiry, we would be grateful if they could be provided to us within fifteen working days from the receipt of this letter, that is, 16 February 2022.

The inquiries officer responsible for the case, Ms Angela Marcos Figueruelo.

Yours sincerely,

Rosita Hickey
Director of Inquiries

Strasbourg, 26/01/2022

 

[1] EDPB Statement 04/2021 on "International Agreements Including Transfers”

[2] EDPB Guidelines 02/2020 on "articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies”

[3] EDPB Statement 01/2019 on "the US Foreign Account Tax Compliance Act (FATCA)"

[4] EDPB Response to Dutch MEP Sophie in 't Veld dated 07 July 2021, with reference OUT2021-0119

[5] Available at: https://www.ombudsman.europa.eu/en/decision/en/146504

[6] Article 4(3) 2nd paragraph of Regulation 1049/2001

[7] Article 4(2) 3rd indent of Regulation 1049/2001

[8] Article 4(1)(b) of Regulation 1049/2001

[9] Encrypted emails can be sent to our dedicated mailbox.