I would like to introduce our next speaker to you.
He is a senior fellow at the Irish Council for Civil Liberties and he is bridging policy and technology.
Please welcome on the stage Chris Srichak for the talk Transparency Not from the European Commission.
Thank you. So, Transparency Not from the European Commission. Before that, that's me.
I think I still look pretty similar.
I work at the Irish Council for Civil Liberties specifically the unit known as ENFOS, where we do advocacy, we litigate against companies and we investigate.
But why should you care about Transparency and the European Commission?
Well, if you live in the European Union, you probably have heard of this term treaties.
You haven't heard of the constitution of the European Union, but you may have heard about this term called treaties.
The treaties, are what lay out how the European Union functions.
And in particular, it's the European Commission who is responsible to ensure how the treaties are applied.
You might have heard a lot about regulations, regulations, regulations.
Only the Commission can propose EU laws.
And the Commission is just one part of the European Union. Right?
It's an executive body, not elected by any of you here, whether you're living here or not.
That would be the European Parliament.
Not part of different member state governments, because that would be then form of the Council, so European Union Council.
Only the European Commission can propose EU laws.
With that in mind, we want to know, well, how can we hold them accountable? Right?
It's an executive body, not elected by anyone, but still needs to be held accountable.
Actually, if you look at the treaties, it's already mentioned, some of the elements are already there.
That participation of civil society and different agencies and all of this has to be done as openly as possible.
Also, there needs to be dialogue between civil society and different institutions, including the Commission.
Also, there needs to be these broad consultations, whatever those are.
We'll look into that in a bit. But what can you do if the Commission is not open enough?
Because that's all on the paper. That's good.
Well, if one thing you can do is you can write to them, and as it's written in the Charter, you must receive an answer.
Good luck with that. Also, you can actually request for documents, not just information.
You can ask for specific documents, and, well, hopefully they'll give it to you.
But I want to highlight two things here.
You don't necessarily need to be the citizen of the European Union to request for these documents.
If you are a resident here, you can still do the same.
Also, there's this emphasis on whatever the medium of the document.
This will be important later in the talk.
If you have these documents and you don't get it, well, you have one option, which is to go to the European Ombudsman, who, again, can look into the issue, and if there's a real case of mal-admission, they will call them out.
Now, the Ombudsman can only make non-binding decisions.
If you want binding decisions, you go to the court. If you have the money.
So, transparency is a means for public accountability. In my mind, there are three things.
One, the transparency of the decision-making process, disclosure of the actual information, so documents, but also the public expectation of what good governance is.
In some sense, the combination of these factors is what I would think of as transparency for accountability.
If you go to the European Commission's page, you'll get this nice thing, like, transparency pretty much covers all the main things that I mentioned here, freedom of information, funding, consultation, blah, blah, blah.
That's the theory, right? Like, that's just a theory. That's not practice.
Let's see what the practice looks like.
So, if you want to contribute or give feedback and blah, blah, blah, you have this nice diagram.
You have different opportunities to give feedback. Great, if you want to do it.
Then you go to this kind of page, which will then list all the possibilities for you.
First, you need to know this page exists.
And let's assume you found the page, you've signed up to all the mailing lists and blah, blah, blah, and then you can finally get back and give your feedback.
But does it actually work that way? Right?
Like, does all these consultation process, does it actually work?
Let's take one example, because there are plenty.
So, this is the situation, for instance, with the sustainable corporate governance.
So, holding corporations accountable for due diligence in the supply chain.
How many people actually gave feedback? Right?
So, in this one occasion, eight people gave feedback. Right?
Now, what about different member states? We have 27 member states.
There are some fairly large countries there.
Austria, seven in total, including all organizations, everything. Portugal, two.
And we have even more below. One person or one entity from Czech Republic gave input.
Now, let's assume you managed to give feedback.
So, this is a screenshot from a couple of days ago.
So, some of the deadlines are during your Christmas break. Feel free to go and give feedback.
But then there's another thing.
You assume that all the opportunities to give feedback are in one place. Well, they're not.
Because sometimes they use a different system called EU service.
So, you can go to the EU service, and then you can give all this feedback.
Now, you might be following some of the news organizations primarily based in Brussels.
So, you might have found the link, and you might end up there.
And you might be great in knowing different issues with AI, for instance.
And you might have actual examples with real-time facial recognition, and you want to tell the commission what are the real issues, why this should be prohibited, for instance.
And then you realize, you have 1500 characters. But that's about 220 words.
So, go ahead, try your chance.
So, open public consultations end up being mostly a box-ticking exercise.
What about access to documents?
So, this is a document which shows the conversation between Brett Hahn, who was the former commissioner for digital, and Sundar Pichai at Google.
Well, forget the Google part. I like this part from Brett Hahn.
Well, he expects technology in Europe to respect all our values.
On data protection, online safety, in Europe, it's not pick and choose.
He has nice, he goes well with words.
But then this is also true, where the commission gave cloud contracts to Amazon. Right?
It's the same commission, by the way. And then there is also investigation.
There's the same company. So, Microsoft and Amazon, they're the same case.
We did have some preliminary decisions regarding Microsoft.
I haven't heard in the three years from EDPS about Amazon yet.
But how much have they actually spent on that contract? Right?
So, that's more than 54 million public money to Amazon, and then roughly about another 50 million also to Microsoft.
You might not be interested in money, but you might be interested in this kind of stuff, trade.
So, in the EU, we always talk about lawmaking for the internal market, because the laws apply to the EU market.
But here's an example where the unit for trade is telling the unit for Connect, which is digital, like, hey, you need to make these corrections because we committed something to Microsoft.
We need to make these corrections to the United Kingdom, who are not in the European Union anymore.
So, please make these updates so that we can manage our trade negotiations.
Here's some interesting one from Meta.
So, they want to apply four principles when it comes to Metaverse. Never surprise people.
Provide controls that matter. Consider everyone. Put people first.
I think all of them sound better than move fast and break things.
But I don't know what this actually says. And you might have heard about European identity system.
And here's Google generously asking the European Commission if their wallet can become an EU official wallet.
And thankfully, our folks do know that there's something called interoperability, and we should focus on that instead.
More than documents, sometimes just the responses from the Commission are very interesting.
So, this is one case where two documents they listed out and would not give it because just disclosing it would deter the Commission from expressing its opinions, even their internal discussions.
And what are these documents? Well, these are meetings with two companies.
Like, they have the document. Why are they afraid of their internal discussions? Right?
But then, we see, they're actually concerned about the public.
Because they're concerned that we might misrepresent the documents.
And this would then put external pressure on the Commission.
Well, I thought that is what's supposed to happen. Let's take a nice case.
So, back in 2022, I looked at this article, and I was like, oh, this looks like a problem.
But then I went and looked at the actual law that was being proposed by the Open Commission, and I found some interesting parts.
Like, I'm a technologist, so I went and looked at the technical section and the impact assessments.
They talk about encryption and fight against child sexual abuse, which is, pardon, okay.
And then they mentioned that they actually have assessed the technical feasibility using technical experts.
I was like, okay, now I want to know who the experts are.
Because that part went directly into an impact assessment of an important law.
Oh, then I noticed there are stuff that I actually know.
Secure multi-party computation and homomorphic encryption and stuff. Okay, great.
I can ask them for the documents so that I can look deep into it.
I mean, at the same time, there were a lot of works that were showing that, well, there are big problems with these kind of proposals.
So, well, which experts did they actually speak to then? Oof. So, well, simple question.
What reference docs did you use to develop this and tell me who the experts were?
Well, they gave me back pretty much the same as what is in the impact assessment, just an old, dated one.
Two-year-old document, pretty much the same. I was like, okay.
They kind of just rejected my request. Well, I tried hard. So I was like, okay, backup option.
Go to the European Ombudsman.
Because, well, in the rules of procedure of this expert committee, it says all the organization names and the member names, blah, blah, should be made public.
Problem was, not even the meeting was listed anywhere.
Like, the only reason I knew when the meeting happened was because this document told me it happened in March.
March. Or in April. Okay. In 2020. Like, okay, it's not even listed. Great. Okay. Ombudsman.
Ombudsman does their job. And it took a long time for them to get a meeting with the commission.
And then they sent me a report. It has even more interesting stuff.
Apparently, I'm a special case. Only my complaint was delayed. I was like, should I feel special?
No. Okay. No. So I went online. I was like, oh, wait. Felix Radar also asked about the same topic.
So it went to the same unit. And hey, that one was also delayed. So it can't be special.
They're just lying to me. Actually, they're lying to the ombudsman. That's their first trick.
But there's more. The experts come from the companies themselves. I was like, wait.
I was thinking about academics. Okay. So which companies? Probably. Hmm. Okay. Three, I suspect.
Maybe more. But at least three. But what are they afraid?
Why aren't they willing to tell me which companies were involved that day?
Well, because the public, the companies are afraid of their public image. Okay.
And their security. I mean, Zuckerberg already has, like, fences and everything for him.
Like, okay. And then I look at this part, and I'm like, wait, there's a problem here.
These experts, whoever they were, put together this information.
And then this was just used as part of the regulation.
Did they even know that this is what they were contributing to? Hmm. Okay. Well, decision. Great.
As expected, maladministration. I should be celebrating. Except nothing happened after that.
Like, pfft. But then there are leaks. I was like, okay, well, we got the document anyway. Not bad.
Not through the sources we wanted to. And here's the list.
And I was like, okay, well, Netspolitik published it. Let's go and look at some of the... Okay.
It's all Microsoft. Then a lot of Googles. And then there's Tharn. Oh! Interesting.
And they're marked as NGO. Okay.
The only thing that did change, though, was this transparency rule. They just changed the rules.
Because they were not going to give us a document.
So the transparency part became more intransparent. Here's a different case.
Some of you might know this. This is way more famous. This is the Pfizer case.
And Alexander Fanta read the same article and asked, well, please give me the text messages exchanged between Wendell Lyon and the Pfizer vaccine.
He's the Pfizer guy. Reject. Nope. Not giving you. And the reason? Text messages are ephemeral.
That was the actual words used. They're like footsteps on the beach. They'll just vanish.
Well, and they say, well, because it's ephemeral, well, it's not meant to contain any important information except, oh, 1.8 billion vaccine doses were decided there.
And so, it's exempt from public access.
Like me, well, you just have to go and look at the definition then.
That says, clearly, whatever its medium, like, does it say anywhere like text messages are not counted as a document?
Well, the ombudsman was like, well, I don't think there's any issue about SMSs.
Not being documents. Because they are.
Well, the ombudsman agrees, and she's even better with words.
In the recent review, she was like, well, the medium doesn't matter. It's the message.
Any social scientists here?
You should be reminded of this one from Marshall McLern from, what, 60 years ago.
It's a very, I think he touched it very nicely. The medium is the message here.
If that conversation was over email, then it would have just been automatically treated as a document.
The fact that it was an SMS, it was treated as, oh, it's not a document.
We don't have to give it to anyone. But then, the usual tactic too. Sternwalling.
Keep asking the commission, they'll be like, meh. We keep asking. We're not going to do anything.
Fortunately for us, the New York Times decided, well, we can't do much with non-binding decisions, so we'll take them to court.
We should hear back in a couple of months, I think, about the decision. Expect delays. Regular.
So, normally, with access documents, this is the timeline.
Like a 15-day deadline to respond and 30 days in exceptional cases.
And then there's a round two if you want to ask them, well, please check again.
And they're called confirmatory requests. But the exception is the now.
Like, I can't think of ever getting a document in 15 days.
If I think about delays, I think about Dutch Barn.
I think a lot of you might have come here by train. Mine was 20 minutes late.
I don't know about yours. So, I went and looked at their numbers.
Like, they didn't have a strong reputation for being punctual.
So, I thought, okay, well, let's look at their numbers. Okay, long distance, 72% punctuality.
I mean, they're flexible in how they assess. Like, within six minutes, it's on time.
So, I thought, well, let's put the commission number there.
So, their response time for punctuality for confirmatory applications is 14%.
Like, I think you'll stop complaining about Dutch Barn.
And I've been flexible just like with Dutch Barn.
Like, only counted the 30-day part, not the 15 days, because then we might be down to single digits.
These are nice numbers.
And the ombudsman asked the commission, please tell us the five longest applications.
So, how much long did you take the maximum length just to respond?
It wasn't minutes, because that would be Dutch Barn. It was days. Right?
So, some folks were waiting for nearly a year just to get a response.
But, I mean, these are numbers. Take it with a grain of salt. Also, tequila and with some lime.
Because, sometimes, the commission might come back and ask for clarifications.
Well, you asked for this document, but hey, we have, like, 100 documents. It'll take a long time.
Please tell us which of these documents you want.
And often, that question will come on the deadline day. And then, the clock resets.
So, those 15 days are wiped out. And they'll say, well, we'll restart the clock again.
So, this was the theory. And this is the practice. Thank you.
Thank you very much for this awesome talk. We still have time for some questions left.
So, if you want to ask a question, please line up at the microphones.
So, what was the longest time that you had to wait for a document?
A couple of months, because I know some of the tricks. Okay. You should tell them afterwards.
We have a question on that microphone, please.
First of all, thank you for the really wonderful presentation.
But I would like to get practical, let's say. What is the model to overcome these problems?
Because, like, we can pursue a Swedish model.
So, each public servant has his own diary where he writes everything. He publishes it.
But then, reality could be easily, I mean, changed.
Or, I think you know better than me how difficult it is to pursue a transparency legislation and a lobbying regulation.
How can we do that?
And how would you reply to many youth scholars in social studies, political science, law, et cetera, that says that the democratic awkwardness of the European Union, so the fact that the European Union is not that transparent, is what gives it output and makes you able to react in the long, to act in the long term.
Because that's something that scholarship argues.
How would you suggest, so, the regulation and how would you reply to these concerns of many scholars?
So, in the first part, if I understood correctly, what they're asking is, does the aspect of a lot of work intended to be given to the European Union in some way or another?
I'm not completely sure, right?
Because in some cases, the problem is not whether they're giving the documents or not, but rather why they're not giving the documents, because they already are in possession of them, right?
So, the question is whether the Commission is actually using those exceptions honestly, right?
And in some cases, they're just protecting the information from actual companies, which is not actually protecting their decision making in any way.
It's actually information from third parties that they're protecting.
So, in that sense, I'm thinking, is it actually beneficial to them in any way? I don't think so.
Thank you. All right. Then we have a question over there. I have two questions.
One is, do you think the ombudsman is useless or is not doing their job right?
And the second question is, what's written in the treatise?
How can you force these actors, like the Commission and the ombudsman, to do their job well?
So, on the first question, is the ombudsman useless?
The ombudsman has strong ability to make a decision, and then it's up to the recipient, in this case, the European Commission, whether or not to act.
As opposed to if it was a court decision, which is binding, the Commission just has to act, right?
So, that's the difference. On the second part, how do you hold them accountable with the treatise?
Two things. One, put pressure if you can. The second thing, use the legal tool, litigation.
So, if the Commission, the ombudsman, whoever, is not doing the job, you can actually litigate against them, right?
In some cases, actually, you don't need to litigate.
Sometimes you just have to ask well, put external pressure.
So, we had a case which is not an access document, but with respect to monitoring of the implementation of GDPR.
I work for an Irish organization.
And the Irish Data Protection Commission has for a long time dragged its feet with respect to how it's doing its job.
And the Commission's duty is to actually make sure that the law is implemented, which means it needs to have the numbers.
So, we kept asking, and they kept pointing to a database from the 1980s.
And we were like, that doesn't work.
Even the European Data Protection Board says that's not the right thing to check.
Multiple letters, one and a half years, I think.
And then the ombudsman puts pressure on the Commission, and things did change to an extent.
Now, it's not a full solution yet, but it takes a long time.
And it'll be the same thing with litigations. But the problem with litigations, you need money.
How much? All right. It's about It could be six to seven digits.
Then we take the next question over there, please.
Yeah, so in Germany, we have the option to go Is there something similar for that on the European side?
You can.
So I said I know the tricks, which basically means that there are parts in the law which says if you don't get a response within 15 days, and you don't get an explanation why there is or if there is an extension, you can automatically ask for a confirmatory application.
And you can already start going to the ombudsman. Right? So that's a possibility.
And the same thing, you can also go to the court.
So the ombudsman route and the court route are kind of in parallel.
You don't have to do one or the other. You can do both.
But with the ombudsman, you have more time.
With the court, there is a restriction on how soon you need to go to the court.
So that option is there. Okay.
Because you just explained that the ombudsman doesn't he can say something.
But no one has to take action. Yep.
I have to say, the outgoing ombudsman, Emery O'Reilly, has been fantastic. So. All right.
Then we have one more question over there, please.
So my question, first of all, thank you very much for that amazing talk.
My question is, have you seen a difference depending on the topic you're asking for, like other topics that are getting answered very good and very fast, and other topics that take a very long time and that are very hard to come by?
So with child sexual abuse regulation, I think pretty So that is one clear example.
In some cases, the struggle is because the commission thinks it's very political and wants to keep documents to itself and wants to find ways around it.
So that happened with that. Trade is another.
If you ask for trade documents, you're going to struggle. Surveillance.
I remember asking once for CCTV documentation, and they said, well, that's issue.
I'm like, I can see the manufacturer. Like, what is easy?
I think it's more with respect to whether the issue is political or not, because I think the commission often treats it differently, and it's from the top.
It's not the actual civil servants who are doing the job. It's coming from the top.
And actually, Emily O'Reilly recently gave an interview, and she was basically flat out like, well, see, if you have the commissioner like Wanda Lyon who turns everything into political, you're going to struggle to actually get any transparency out of that commission.
Thank you. There's another question over there, please.
You mentioned the ombudsman, but what about other supervising institutions like European Data Protection Supervisor?
Because as I understand, they were taking an eye on at least two cases you mentioned on the slides, like child abuse and giving away documents to Microsoft basically, and they do appear to be working faster and having more direct action to access to commission.
So the ombudsman has a fairly broader view of The EDPS, European Data Protection Supervisor, is the supervisor for data protection for EU institutions, which includes the European Commission.
So when it comes to data protection, then yes, they have a role.
With the Microsoft thing, they did reprimand the commission, and it's an ongoing issue currently.
With the EDPS, they have So they will have a broader mandate, but still they can't cover everything.
They need to be very specific into what they can and can't do. Thank you. All right. Thank you.
Another question at the back, please. Hello.
I want to know if there is a chance to have more leverage on such requests like you do.
I mean, it sounds like you are like a lonely fighter.
You put in your request, and potentially there might be 100 other people or organizations having the same thinking if they would see your request, oh, I want to have this, too.
I mean, is there a way like a petition way where multiple people join one request?
Is there something like this present or at least that you can see that these requests are pending, that they are in the process of being processed by the EU?
I mean, possible to make the request, and it's fully public, so when one makes a request, anyone can see it.
When and if there is a response from any of the institutions and actually bodies, so folks like
EDPS is also bound by the same law there, you can't And some of them do work quite closely
with each other, sharing tips on what to do, also sharing things like what the case laws are,
because often you have to actually argue against the explanations from the EU institution based on
existing case laws, and not everyone would be on top of existing case laws. Yeah, but sometimes
you know there's the issue of parallelism. I mean, if like 50 organizations do rather the same
thing, then the commission can even more hide and say, oh, I'm swamped, I'm sorry, and there's
the wording slightly different, despite it's about the same document as everyone else. Because,
as I said, it's public access to documents. So once they release, it's freely accessible to
everyone. Yeah, it's just thinking to have this pressure more concentrated, and not that it gets
diluted by these maybe powerful things, and the sense that it's just one guy. Yeah. So,
pressure on the lawmakers at the European Commission. Ask for more data, but also, one of
the elements of the EU setup is that, for instance, the European Parliament is also responsible
to hold the commission responsible. So you voted for your parliamentarians, and they are
responsible to hold the commission responsible as well. And in some ways, they are more
stronger than the Ombudsman. In other ways, they are not. So ask your parliamentarians.
There are plenty of good MEPs out there who would take it up. So that's one option you do have.
I mean, you can go the official way, ask questions directly to the EU institutions, including the
Parliament, by the way. But also, you can ask your parliamentarians to take up your issue.
Thank you very much for this awesome presentation. Please give a huge round of applause.