Ref. Ares(2019)5580499 - 05/09/2019 EUROPEAN COMMISSION DIRECTORATE-GENERAL INFORMATICS Directorate A - Strategy & Resources DIGIT A3 - ICT Procurement & Contracts Brussels, DIGIT.A.3.001/EA Mr. Alexander Fanta netzpolitik.org Rue de la Loi 155 1000 Bruxelles BELGIUM By registered mail Advance copy by e-mail: a.fanta.86xtefmh9n@fragdenstaat.de a.fanta.bfgex9gzg9@fragdenstaat.de a.fanta.a3e96d8dua@fragdenstaat.de Subject: Your applications for access to documents – Ref GestDem No 2019/4296, 2019/4321 and 2019/4322 Dear Sir, We refer to your messages sent on 9 July 2019, 17 July 2019 and 19 July 2019, through the Frag den Staat platform, in which you make a request for access to documents, regarding the following subjects: - - - - - Google, request registered on 10/07/2019 under reference number 2019/3969; Facebook, request registered on 10/07/2019 under reference number 2019/3968; Apple, request registered on 23/07/2019, under reference number 2019/4296; Microsoft, request registered on 24/07/2019, under reference number 2019/4321; Amazon, request registered on 24/07/2019, under reference number 2019/4322. Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIË — Tel. +32 22991111 Commission européenne, 2920 Luxembourg, LUXEMBOURG — Tel. +352 43011 GestDem GestDem GestDem GestDem GestDem

1. INTRODUCTION Following your request, the Directorate-General Informatics sent you a letter on 25 July 2019 (Ares(2019)4948256) to inform you that the delay will be extended to 22 August 2019 for requests 2019/3968 and 2019/3969, to 4 September 2019 for request 2019/4296 and to 5 September for requests 2019/4321 and 2019/4322. In this letter, the Directorate- General Informatics also proposed a fair solution in order to better define the scope of your request, namely: - - Limiting the scope of your request time-wise to after November 2014 (current Commission). As this timeframe was already indicated in the following requests: Apple Ref, GestDem 2019/4296; Microsoft, Ref GestDem 2019/4321; Amazon, Ref GestDem 2019/4322. Limiting the scope content-wise by interpreting “lobby meeting” as either: o A meeting held by the Director-General and mentioned in the “list of meetings with organisations and self-employed individuals” available at http://ec.europa.eu/transparencyinitiative/meetings/meeting.do?host=06fb3b80- 76a8-43f1-b1a5-e703cfe8d625 and http://ec.europa.eu/transparencyinitiative/meetings/meeting.do?host=06fb3b80- 76a8-43f1-b1a5-e703cfe8d625&startDate=01-11-2014 ; or o A meeting which falls under the definition of Commission Decision 2017/838/EU, i.e. with the purpose “to discuss an issue related to policy- making and implementation in the Union”, where the other party is “engaged in activities carried out with the objective of directly or indirectly influencing the formulation or implementation of policy and the decision-making processes of the institutions of the Union”, except those meetings “taking place in the context of an administrative procedure established by the Treaties or Union acts”. In your e-mail dated on 27 July 2019, you confirmed that your requests were limited time-wise to documents after November 2014. By the same e-mail, you also clarified that for the definition of lobby meeting, you request all documents falling under the definition of Commission Decision 2014/838/EU, i.e. a meeting with the purpose “to discuss an issue related to policy-making and implementation in the Union”, where the other party is “engaged in activities carried out with the objective of directly or indirectly influencing the formulation or implementation of policy and the decision-making processes of the institutions of the Union”, except those meetings “taking place in the context of an administrative procedure established by the Treaties or Union acts”. Your requests Ref GestDem No 2019/3969 and 2019/3968 were already handled in a previous letter. The present letter only aims at answering the remaining three requests Ref GestDem No 2019/4296, 2019/4321 and 2019/4322. 2. NO DOCUMENTS CORRESPONDS TO THE SCOPE OF YOUR REQUEST We regret to inform you that our Directorate-General Informatics does not hold any documents that would correspond to the description given in your applications. 2

1 As specified in Article 2(3) of Regulation (EC) No 1049/2001 , the right of access as defined in that regulation applies only to existing documents in the possession of the institution. Given that no such documents, corresponding to the description given in your application, are held by the Commission, the Commission is not in a position to fulfil your request. 3. SIMILAR DOCUMENT However, in order to answer to your request in the most comprehensive way possible, the Directorate-General Informatics informs you that meetings have been held in the past between Ms Gertrud Ingestad (Director-General) and Microsoft, and between Mr Stephen Quest (former Director-General) and Microsoft. These meetings are listed in the register on “Meetings of Director-General Gertrud 2 Ingestad with organisations and self-employed individuals” and in the register on “Meetings of Director-General Stephen Quest with organisations and self-employed 3 individuals” . The following meetings have been held: Date Location Entity/ies met Subject(s) 27-06-2018 Brussels, Belgium Microsoft Corporation Commission Digital Strategy 13-06-2017 Brussels, Belgium Microsoft Corporation Handshake with Eva d'Onofrio, General Manager Services Western Europe 09-09-2016 Brussels, Belgium Microsoft Corporation Microsoft strategy update, DIGIT priorities, Governance 11-12-2014 Brussels, Belgium Microsoft Corporation IT trends in the public sector A document has been drawn up in the context of the meeting held on 11 December 2014: 1 Regulation (EC) 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (Official Journal L 145, 31/05/2001, p. 43) 2 http://ec.europa.eu/transparencyinitiative/meetings/meeting.do?host=06fb3b80-76a8-43f1-b1a5- e703cfe8d625 3 http://ec.europa.eu/transparencyinitiative/meetings/meeting.do?host=06fb3b80-76a8-43f1-b1a5- e703cfe8d625&d-6679426-p=2&startDate=01-11-2014 3

# Registration number 1 Ares(2019)5563403 4. Description Minutes of meeting held on 11 December 2014 between the Director-General of DIGIT, with other collaborators, and representatives of Microsoft. APPLICATION OF THE EXCEPTION ON THE PROTECTION OF PERSONAL DATA 4 Pursuant to Article 4(1)(b) of Regulation (EC) 1049/2001 , access to a document has to be refused if its disclosure would undermine the protection of privacy and the integrity of the individual, in particular in accordance with European Union legislation regarding the protection of personal data. 5 The applicable legislation in this field is Regulation (EU) 2018/1725 . Article 3(1) of Regulation (EU) 2018/1725 provides that personal data “means any information relating to an identified or identifiable natural person […]”. The Court of Justice has specified that any information, which by reason of its content, purpose or effect, is linked to a 6 particular person is to be considered as personal data . The document to which you request access contain personal data, in particular names, e- mail addresses and telephone numbers of their authors and/or addressees, or of the persons who took part in the relevant meetings. The persons to whom the data in question are related include members of the staff of the European Commission and representatives of Microsoft. Please note in this respect that the names, signatures, functions, telephone numbers and/or initials pertaining to staff members of an institution are to be considered personal 7 data . 8 In its judgment in Case C-28/08 P (Bavarian Lager) , the Court of Justice ruled that when a request is made for access to documents containing personal data, the relevant 9 Data Protection Regulation, i.e. Regulation (EU) 2018/1725, becomes fully applicable . 4 Regulation (EC) 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (Official Journal L 145, 31/05/2001, p. 43). 5 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (Official Journal L 295, 21/11/2018, p. 39). 6 Judgment of the Court of Justice of the European Union of 20 December 2017 in Case C-434/16, Peter Nowak v Data Protection Commissioner, request for a preliminary ruling, paragraphs 33-35, ECLI:EU:C:2017:994. 7 Judgment of the General Court of 19 September 2018 in case T-39/17, Port de Brest v Commission, paragraphs 43-44, ECLI:EU:T:2018:560. 8 Judgment of 29 June 2010 in Case C 28/08 P, European Commission v The Bavarian Lager Co. Ltd, paragraph 59, ECLI:EU:C:2010:378. 4

Pursuant to Article 9(1)(b) of Regulation (EU) 2018/1725, “personal data shall only be transmitted to recipients established in the Union other than Union institutions and bodies if [t]he recipient establishes that it is necessary to have the data transmitted for a specific purpose in the public interest and the controller, where there is any reason to assume that the data subject’s legitimate interests might be prejudiced, establishes that it is proportionate to transmit the personal data for that specific purpose after having demonstrably weighed the various competing interests”. Only if these conditions are fulfilled and the processing constitutes lawful processing in accordance with the requirements of Article 5 of Regulation (EU) 2018/1725, can the transmission of personal data occur. According to Article 9(1)(b) of Regulation (EU) 2018/1725, the European Commission has to examine the further conditions for a lawful processing of personal data only if the first condition is fulfilled, namely if the recipient has established that it is necessary to have the data transmitted for a specific purpose in the public interest. It is only in this case that the European Commission has to examine whether there is a reason to assume that the data subject’s legitimate interests might be prejudiced and, in the affirmative, establish the proportionality of the transmission of the personal data for that specific purpose after having demonstrably weighed the various competing interests. In your request, you do not put forward any arguments to establish the necessity to have the data transmitted for a specific purpose in the public interest. Therefore, the European Commission does not have to examine whether there is a reason to assume that the data subject’s legitimate interests might be prejudiced. Notwithstanding the above, please note that there are reasons to assume that the legitimate interests of the data subjects concerned would be prejudiced by disclosure of the personal data reflected in the document, as there is a real and non-hypothetical risk that such public disclosure would harm their privacy and subject them to unsolicited external contacts. Consequently, I conclude that, pursuant to Article 4(1)(b) of Regulation (EC) 1049/2001, access cannot be granted to the personal data, as the need to obtain access thereto for a purpose in the public interest has not been substantiated and there is no reason to think that the legitimate interests of the individuals concerned would not be prejudiced by disclosure of the personal data concerned. Nevertheless, in accordance with current Commission administrative practice the above conclusion does not apply to the names of Commission staff in senior management positions (such as Directors-General, Deputy Directors-General and Directors). These personal data will therefore be disclosed. Therefore, please find enclosed a copy of the requested document with the personal data blanked out (except the names of Commission staff in senior management positions). 9 Whereas this judgment specifically related to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, the principles set out therein are also applicable under the new data protection regime established by Regulation (EU) 2018/1725. 5

5. ADDITIONAL INFORMATION AND DISCLAIMERS Please note the following: - - - - 6. You may reuse the requested document free of charge for non-commercial and commercial purposes provided that the source is acknowledged, and that you do not distort their original meaning or message, but the Commission does not assume liability stemming from the reuse. The requested document includes a meeting summary which was drawn up for internal use under the responsibility of the relevant services. These documents solely reflect the author’s interpretation of the interventions made and do not set out any official position of the third parties to which they refer, which were not consulted on their content. They do not reflect the position of the Commission and cannot be quoted as such. Insofar as the requested document may include content received from third parties, that content is disclosed for information only, and cannot be re-used without the agreement of the originator, who may hold a copyright on it. Such content does not reflect the position of the Commission and cannot be quoted as such. Part of the requested document is of an informal nature; they do not reflect the position of the Commission and cannot be quoted as such. MEANS OF REDRESS In case you would disagree with the assessment that the redacted data are personal data which can only be disclosed if such disclosure is legitimate under the applicable rules on the protection of personal data, you are entitled, in accordance with Article 7(2) of Regulation (EC) No 1049/2001, to submit a confirmatory application requesting the Commission to review this position. Such a confirmatory application should be addressed within 15 working days upon receipt of this letter to the Secretariat-General of the Commission at the following address: European Commission Secretariat-General Transparency, Document Management & Access to Documents (SG.C.1) BERL 7/076 B-1049 Bruxelles or by email to: sg-acc-doc@ec.europa.eu Yours faithfully, [e-signed] Gertrud INGESTAD Director-General 6

Enclosure: Document 1 - Minutes of meeting held on 11 December 2014 between the Director-General of DIGIT, with other collaborators, and representatives of Microsoft (Redacted) 7 Electronically signed on 05/09/2019 07:31 (UTC+02) in accordance with article 4.2 (Validity of electronic documents) of Commission Decision 2004/563