Ref. Ares(2020)7898139 - 23/12/2020 EUROPEAN COMMISSION Secretariat-General Directorate C – Transparency, Efficiency & Resources The Director Brussels SG.C.1/TB/rc - By registered mail with AR Mr Arne Semsrott c/o Open Knowledge Foundation Deutschland e.V. Singerstraße 109, 10179 Berlin Germany Copy by email: a.semsrott.bgebwvfz48@fragdenstaat.de Subject:        Your application for access to documents – GESTDEM 2020/5816 Dear Mr Semsrott, I refer to your e-mail of 1 October 2020, registered on 2 October 2020, in which you make a request for access to documents, under the above-mentioned reference number. Please accept our apologies for the late reply to your request. 1.   SCOPE OF YOUR REQUEST You request access to, I quote: ‘All documents concerning the online platform for Freedom of information / 1049/2001 requests that the Commission is planning to launch, including tenders, concepts, memos, internal as well as external correspondence and documents of meetings concerning the platform including agendas, list of participants and preparatory documents’. 2.   ASSESSMENT AND CONCLUSIONS UNDER REGULATION (EC) NO 1049/2001 The Secretariat-General of the European Commission has identified the following documents as falling under the scope of your request:          Memorandum of Understanding (MoU) on "Study on the use of Artificial Intelligence techniques for the electronic access to Commission documents (for EASE and new RegDoc systems), dated 27/06/2019, reference Ares(2019)4076912 (hereafter document 1); Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIË - Tel. +32 22991111

 Addendum to the Memorandum of Understanding (MoU) on “Study on the use of Artificial Intelligence techniques for the electronic access to Commission documents (for EASE and new RegDoc systems)”, dated 09/10/2019, reference Ares(2019)6246514 (hereafter document 2);  Business Case - Electronic Access to European Commission Documents (EASE), dated 07/02/2019 (hereafter document 3);  Project Charter - Electronic Access to European Commission Documents (EASE), dated 04/07/2019 (hereafter document 4);  Project Status Report, reporting period: 01/01/2019 to 31/01/2019 (hereafter document 5);  Project Status Report, reporting period: 01/05/2019 to 31/05/2019, dated 06/06/2019 (hereafter document 6);  Project Status Report, reporting period: 01/09/2019 to 30/09/2019 (hereafter document 7);  Project Status Report, reporting period: 01/01/2020 to 31/01/2020, dated 24/03/2020 (hereafter document 8);  Project Status Report, reporting period: 01/02/2020 to 29/02/2020, dated 24/03/2020 (hereafter document 9);  Note to the Legal Service, reference Ares(2020)1968909, dated 07/04/2020 (hereafter document 10);  Reply from the Legal Service, reference Ares(2020)2244932, dated 27/04/2020 (hereafter document 11);  Electronic Access to EC Documents (EASE) Kick-off, reference Ares(2018)5665150, dated 06/11/2018 (hereafter document 12);  Minutes of Meeting, reference Ares(2019)661011, dated 05/02/2019 (hereafter document 13);  Minutes of Meeting, reference Ares(2019)3561368, dated 03/06/2019 (hereafter document 14);  Minutes of Meeting, reference Ares(2019)4984025, dated 30/07/2019 (hereafter document 15);  Minutes of Meeting, reference Ares(2020)1858206, dated 31/03/2020 (hereafter document 16); 2

       Minutes of Meeting, reference Ares(2020)1858206, dated 31/03/2020 (hereafter document 17);        Minutes of Meeting, reference Ares(2020)1858206, dated 31/03/2020 (hereafter document 18);        Minutes of Meeting, reference Ares(2020)3490394, dated 02/07/2020 (hereafter document 19), which has the following annex: o       Project Steering Committee meeting - presentation, dated 02/07/2020, reference Ares(2020)3490394 (hereafter document 19.1);        Minutes of Meeting, reference Ares(2020)4881566, dated 17/09/2020 (hereafter document 20), which has the following annex: o       Project Steering Committee meeting - presentation, dated 17/09/2020, reference Ares(2020)4881566 (hereafter document 20.1);        Study on the use of Artificial Intelligence techniques for the electronic access to Commission documents (for EASE and new RegDoc systems), dated 29/05/2019 (hereafter document 21);        Architecture Overview - Electronic Access to Commission Documents (EASE), dated 13/08/2020 (hereafter document 22);        Article “Almost 600 respondents participated in the consultation on designing an online platform for public access to Commission documents”, dated 23/10/2018 (hereafter document 23);        Statistics: Public access to the documents held by the European Commission (hereafter document 24); and        Description of Use Cases - SG Artificial Intelligence Study (hereafter document 25). I can inform you that:  document 23 is publicly available under the following Internet address: https://ec.europa.eu/isa2/news/almost-600-respondents-participated-consultation- designing-online-platform-public-access_en;  full access is granted to documents 19.1 and 24;  wide partial access is granted to the rest of the requested documents only subject to redactions due to the protection of personal data as per point (b) of Article 4(1) of Regulation (EC) No 1049/2001, for the reasons set out below. 3

2.1.   Protection of the privacy and the integrity of the individual Article 4(1)(b) of Regulation (EC) No 1049/2001 provides that ‘[t]he institutions shall refuse access to a document where disclosure would undermine the protection of […] privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection of personal data’. 1 In its judgment in Case C-28/08 P (Bavarian Lager) , the Court of Justice ruled that when a request is made for access to documents containing personal data, Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the 2 Community institutions and bodies and on the free movement of such data (hereafter ‘Regulation (EC) No 45/2001’) becomes fully applicable. Please note that, as from 11 December 2018, Regulation (EC) No 45/2001 has been repealed by Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 3 1247/2002/EC (hereafter ‘Regulation (EU) 2018/1725’). However, the case law issued with regard to Regulation (EC) No 45/2001 remains relevant for the interpretation of Regulation (EU) 2018/1725. In the above-mentioned judgment, the Court stated that Article 4(1)(b) of Regulation (EC) No 1049/2001 ‘requires that any undermining of privacy and the integrity of the individual must always be examined and assessed in conformity with the legislation of the Union concerning the protection of personal data, and in particular with […] [the 4 Data Protection] Regulation’. Article 3(1) of Regulation (EU) 2018/1725 provides that personal data ‘means any information relating to an identified or identifiable natural person […]’. As the Court of Justice confirmed in Case C-465/00 (Rechnungshof), ‘there is no reason of principle to justify excluding activities of a professional […] nature from the notion of 5 private life’. The requested documents contain personal data such as the names, positions, email and office addresses and telephone numbers of persons who do not form part of the senior management of the European Commission. 1 Judgment of the Court of Justice of 29 June 2010, European Commission v The Bavarian Lager Co. Ltd (hereafter referred to as ‘European Commission v The Bavarian Lager judgment’) C-28/08 P, EU:C:2010:378, paragraph 59. 2 OJ L 8, 12.1.2001, p. 1. 3 OJ L 295, 21.11.2018, p. 39. 4 European Commission v The Bavarian Lager judgment, cited above, paragraph 59. 5 Judgment of the Court of Justice of 20 May 2003, Rechnungshof and Others v Österreichischer Rundfunk, Joined Cases C-465/00, C-138/01 and C-139/01, EU:C:2003:294, paragraph 73. 4

6 The names of the persons concerned as well as other data from which their identity can be deduced undoubtedly constitute personal data in the meaning of Article 3(1) of Regulation (EU) 2018/1725. Pursuant to Article 9(1)(b) of Regulation (EU) 2018/1725, ‘personal data shall only be transmitted to recipients established in the Union other than Union institutions and bodies if ‘[t]he recipient establishes that it is necessary to have the data transmitted for a specific purpose in the public interest and the controller, where there is any reason to assume that the data subject’s legitimate interests might be prejudiced, establishes that it is proportionate to transmit the personal data for that specific purpose after having demonstrably weighed the various competing interests’. Only if these conditions are fulfilled and the processing constitutes lawful processing in accordance with the requirements of Article 5 of Regulation (EU) 2018/1725, can the transmission of personal data occur. In Case C-615/13 P (ClientEarth), the Court of Justice ruled that the institution does not 7 have to examine by itself the existence of a need for transferring personal data. This is also clear from Article 9(1)(b) of Regulation (EU) 2018/1725, which requires that the necessity to have the personal data transmitted must be established by the recipient. According to Article 9(1)(b) of Regulation (EU) 2018/1725, the European Commission has to examine the further conditions for the lawful processing of personal data only if the first condition is fulfilled, namely if the recipient establishes that it is necessary to have the data transmitted for a specific purpose in the public interest. It is only in this case that the European Commission has to examine whether there is a reason to assume that the data subject’s legitimate interests might be prejudiced and, in the affirmative, establish the proportionality of the transmission of the personal data for that specific purpose after having demonstrably weighed the various competing interests. In your request for access to documents, you do not put forward any arguments to establish the necessity to have the data transmitted for a specific purpose in the public interest. Therefore, the European Commission does not have to examine whether there is a reason to assume that the data subjects’ legitimate interests might be prejudiced. Notwithstanding the above, there are reasons to assume that the legitimate interests of the data subjects concerned would be prejudiced by the disclosure of the personal data reflected in the requested documents, as there is a real and non-hypothetical risk that such public disclosure would harm their privacy and subject them to unsolicited external contacts. Consequently, I conclude that, pursuant to Article 4(1)(b) of Regulation (EC) No 1049/2001, access cannot be granted to the personal data, as the need to obtain access thereto for a purpose in the public interest has not been substantiated and there is no 6 European Commission v The Bavarian Lager judgment, cited above, paragraph 68. 7 Judgment of the Court of Justice of 16 July 2015, ClientEarth v European Food Safety Agency, C-615/13 P, EU:C:2015:489, paragraph 47. 5

reason to think that the legitimate interests of the individuals concerned would not be prejudiced by the disclosure of the personal data concerned. 3.     OVERRIDING PUBLIC INTEREST IN DISCLOSURE Please note that point (b) of Article 4(1) of Regulation (EC) No 1049/2001 do not include the possibility for the exceptions defined therein to be set aside by an overriding public interest. 4.     PARTIAL ACCESS In accordance with Article 4(6) of Regulation (EC) No 1049/2001, I have considered the possibility of granting (further) partial access to the documents requested. However, for the reasons explained above, no wider partial access is possible without undermining the interests described above. 5.     MEANS OF REDRESS In accordance with Article 7(2) of Regulation (EC) No 1049/2001, you are entitled to make a confirmatory application requesting the Commission to review this position. Such a confirmatory application should be addressed within 15 working days upon receipt of this letter to the Secretariat-General of the Commission at the following address: European Commission Secretariat-General Unit C.1. ‘Transparency, Document Management and Access to Documents’ BERL 7/076 B-1049 Brussels, or by email to: sg-acc-doc@ec.europa.eu. Yours sincerely, Tatjana Verrier Director Enclosures: 26 6 Electronically signed on 23/12/2020 10:43 (UTC+01) in accordance with article 11 of Commission Decision C(2020) 4482