President European Commission

 

Dear President,

I am writing to seek a solution to this case^[1], which is based on a complaint I received from the European Digital Rights (EDRi) network on 17 April 2023.

The complainant requested public access to documents concerning questionnaires sent by the Commission to Member States on the topic of encryption in 2021. The Commission refused disclosure, and subsequently failed to reply to the complainant’s confirmatory application within the time limits set out in the applicable legislation on public access to documents.[2] The complainant is waiting on a reply since 15 February 2023.

I opened an inquiry into this complaint and, in light of the ongoing delay, I asked the Commission to provide my inquiry team with copies of the documents at issue for inspection.

Following the inspection of the documents, my inquiry team takes the preliminary view that the Commission should have granted partial access to the documents, in particular the parts that describe applicable national legislation or case-law. These parts do not appear to be covered by any of the exceptions invoked by the Commission, in particular because - logically - information on legislation is already publicly available. A more detailed assessment is available in an Annex to this letter.

I would like to underline that there is a strong public interest in disclosure of the documents, not only because of the importance of the topic of encryption and how it relates to the fundamental right to privacy, but also because civil society organisations such as the complainant rely on documents disclosed in response to public access requests in order to exercise their role of watchdogs.

In light of the above, I would like to propose the following solution in this case:

The Commission should reconsider its position on the public access request, taking into account the arguments presented in the annex, with a view of granting the widest possible access to the five documents at issue.

I would be grateful to receive your reply to my proposal within three months, by 17 February 2024.

At this stage, the solution proposal and its accompanying annex are confidential. My inquiry team has, however informed the complainant of my intention to seek a solution in this case.^[3] Please note that our usual practice is to send a copy of the solution proposal to the complainant for comments, together with a copy of the institution’s reply to it, once we have received that reply. I would therefore ask the Commission to inform us if any information contained in the solution proposal, or in its reply, should not be shared with the complainant.^[4]

Yours sincerely,

Emily O'Reilly
European Ombudsman

Strasbourg, 17/11/2023

 

Annex: Ombudsman’s proposal for a solution in case 707/2023/NH[5]

Background

On 25 October 2022, the complainant requested from the Commission public access to the following documents:

(1) The questionnaire circulated to Member States in 2021 on the topic of encryption;

(2) The responses of Member States to the questionnaire received by the Directorate General;

(3) The compilation of the responses done by the Directorate General;

(4) All presentation material (powerpoint, etc.) used by the European Commission to present the results and give feedback to Member States at the beginning of 2022;

(5) The "thorough mapping of how member states deal with encryption" done by the European Commission as mentioned in the European Commission's Communication on the EU Strategy to tackle Organised Crime 2021-2025.

The Commission registered the request for documents under reference number 2022/6061.

On 8 December 2022, the Commission issued its initial decision on the complainant’s request. It identified six documents as falling within the scope of the request, granted full access to one document, and refused disclosure of the remaining documents. In doing so, the Commission invoked two exceptions^[6] provided for under the EU legislation on public access to documents (Regulation 1049/2001), arguing that disclosure would undermine the public interest as regards public security as well as undermine the decision-making process of the Commission in relation to encryption in the law enforcement context. The Commission argued that disclosure would reveal preliminary views and policy options that are currently under consideration.

The Commission also explained that it does not hold any documents corresponding to the “thorough mapping” referred to in the complainant’s application, as this topic is covered by all the other documents requested.

The complainant requested the Commission to review its decision, by making a confirmatory application, on 29 December 2022.

The Commission extended the time limits to reply to the confirmatory application and subsequently sent a holding reply on 15 February 2023 as it was carrying out the necessary consultations. The Commission assured the complainant that a reply would be provided as soon as possible. In the absence of any reply from the Commission, despite several reminders, the complainant turned to my Office on 17 April 2023.

I opened an inquiry and asked the Commission to provide a reply to the complainant’s confirmatory application as soon as possible and no later than 20 June 2023. The Commission informed my inquiry team that it would not be able to meet that deadline.

On 10 July 2023, my inquiry team asked the Commission to provide the documents at issue for an inspection.

The preliminary assessment leading to a solution proposal

Following the inspection of the documents, my inquiry team takes the following preliminary view:

• Document 2 contains 27 questionnaires that the Commission sent to the Member States’ authorities in order to gather their replies as regards (a) applicable national legislation and case law concerning encryption (“questionnaire A”) and (b) operational practices and needs in each Member State, including quantitative data where available (“questionnaire B”).

My inquiry team notes that the Commission refused disclosure of the “questionnaire B” based on the public security exception. The Commission argued that the replies by Member States contain sensitive information on operational practices of law enforcement authorities in all Member States in the area of encryption, disclosure of which would potentially create a public security risk.

My inquiry team believes, however, that the public security exception is not applicable to the parts of document 2 related to the “questionnaire A”. The replies by Member States authorities to questionnaire A simply list the applicable legislation and case-law in each Member State. This information is already publicly available. The Commission also invoked another exception in its initial reply, namely the protection of the decision-making process. The Commission said that “disclosure would reveal preliminary views and policy options which are currently under consideration. The Commission's services must be free to explore all possible options in preparation of a decision free from external pressure.” My inquiry team acknowledges that certain questions of questionnaire A[7] may reveal the preliminary views of certain Member States on potential new EU rules in the area of encryption. However, my team is of the opinion that disclosure of such views would not seriously undermine the decision-making process.

The complainant’s argument that there is an overriding public interest in the disclosure of the documents and their contents should be taken into account in this regard. The complainant said in the confirmatory application that “there is a huge public interest in knowing how the European Commission is collecting data and evidence to support the Union's future policies in the area of law enforcement, especially given the interference with European citizens' fundamental rights at stake.”

• Document 1 contains the same questionnaires, without the replies from Member States. My inquiry team believes that the document could be disclosed to the public, taking into account the arguments presented as regards document 2 above.
• Document 3 contains two summaries drafted by the Commission of the replies by Member States to, respectively, questionnaire A and questionnaire B. My inquiry team’s assessment for document 2 above applies to this document by analogy: document 3 should be partially disclosed, in particular the parts related to questionnaire A.
• Document 4 is a PowerPoint presentation prepared by the Commission services and shown during a meeting on 1 December 2021 with Member States representatives. My inquiry team considers that this document could be disclosed to the public in full, as it contains general and horizontal information on the responses by Member States. The document does not attribute any single response to a specific Member State. The parts of the document relating to the replies to questionnaire B (operational practices) do not appear to present any risk of undermining the public security of any Member State. 
• Document 5 was disclosed to the public and is therefore outside the scope of this inquiry.
• Document 6 is a background discussion paper drafted in preparation of a technical meeting between the Commission and Member States in March 2022. The Commission invoked the exceptions concerning the protection of public security and of the decision-making process for this document, arguing in particular that it contains policy options that the Commission is still exploring. My team believes that the public security exception does not apply to this document. Should the Commission consider that the exception relating to the protection of the decision-making process applies to document 6, my inquiry team notes that the complainant has put forward convincing arguments that there is an overriding public interest in disclosure. The complainant said, in particular, that “the methods, limits and conditions of state access to encrypted data is a fundamental question in a democracy as it implies critical debates on the checks and balances between state authorities and targeted individuals.”

[1] In accordance with Article 2(10) of the Statute of the European Ombudsman (Regulation 2021/1163 of 24 June 2021 laying down the regulations and general conditions governing the performance of the Ombudsman’s duties) available at: https://www.ombudsman.europa.eu/en/legal-basis/statute/en.

[2] Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents, available at: https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32001R1049

[3] In line with Article 2(10) of the Statute of the Ombudsman.

[4] If you wish to submit documents or information that you consider to be confidential, and which should not be disclosed to the complainant, please mark them ‚Confidential‘. Encrypted emails can be sent to our dedicated mailbo.Information and documents of this kind will be deleted from the European Ombudsman’s files shortly after the inquiry has ended.

[5] In accordance with Article 2(10) of the Statute of the European Ombudsman.

[6] Article 4(1)(a) first subparagraph and Article 4(3) first subparagraph of Regulation (EC) No 1049/2001.

[7] In particular questions 13, 14 and 15.