The European Commission is exploring the possibility of lodging a complaint with a data protection authority in an EU Member State regarding the disclosure of personal data belonging to some of its staff members by major tech companies, as part of the reporting obligations stipulated by the Digital Services Act (DSA).
This matter follows the publication of a report last February by the US House of Representatives Judiciary Committee containing “thousands of email exchanges between digital platforms such as Meta and TikTok, European Commission officials and civil society organisations, including Democracy Reporting International and Reporters Without Borders”, a group of MEPs denounced, raising “concerns about violations of personal data and privacy, including breaches of the General Data Protection Regulation (GDPR), as well as a risk of sanctions”, such as the travel bans imposed by the US State Department on former Commissioner Thierry Breton, members of civil society involved in the fight against online disinformation and hate speech, and on French MP Éric Bothorel.
“The publication of the personal data of EU officials and civil society experts is deeply concerning. The act of publishing personal data in unredacted documents could expose the companies concerned to legal liability for personal data breaches under the General Data Protection Regulation (GDPR). The Commission is [therefore] exploring a complaint on behalf of the affected staff members to the competent data protection authority”, confirmed Executive Vice-President for Tech Sovereignty, Security and Democracy Henna Virkkunen in a response dated Wednesday 20 May to a parliamentary question tabled by several MEPs from the Renew Europe, S&D and Greens/EFA groups.
The MEPs asked the Commission to specify what measures it intended to take to address these violations of privacy and personal data and to ensure that “the European officials and citizens publicly exposed in this report are protected against possible US sanctions”.
Ms Virkkunen clarified that “the rules regarding information confidentiality must be respected by all parties, including online platform providers, in terms of European data protection rules”, and stressed that “the Commission has a duty of care towards its staff, which it takes very seriously”. “The staff members concerned have received information on how to obtain support in the event of threats, insults, defamation or other attacks against their person or property. Furthermore, the Commission is already providing tailored support and assistance to meet the needs of the staff responsible for enforcing the DSA”, she stated in her response.
In its interim report entitled ‘The Foreign Censorship Threat, Part II: Europe’s Decade-Long Campaign to Censor the Global Internet and How it Harms American Speech in the United States’, the House Judiciary Committee accuses the European Commission of having “repeatedly” pressured major social media platforms to alter their content moderation rules in order to more aggressively censor certain content, thereby “directly undermining Americans’ online free speech within the United States”, during more than 100 closed-door meetings held since 2020. The report is based on non-public documents provided by major tech companies to the Commission under subpoenas.
At a press conference on 22 May, European Commission spokesman Thomas Regnier stated that the Commission expected companies to “redact sensitive information”. “We stand by our staff and we will not hesitate to take action, should it prove necessary, though such measures will always remain proportionate”, he explained, specifying that the complaint, were one to be filed, would be lodged “within an EU Member State”, and not within the United States, while noting that no final decision had yet been reached, as internal discussions remain ongoing. He did not specify whether this matter could have broader implications for exchanges of personal data between the EU and the United States.
“The application of democratically adopted EU digital regulations is a matter of European sovereignty. The Commission remains committed to implementing the DSA fully and without delay and, in doing so, firmly stands behind its staff”, emphasised Ms Virkkunen in her response. (Original version in French by Ana Pisonero Hernández)