Article 98

EUROPEAN PATENT OFFICE

Information from the EPO

Decision of the President of the European Patent Office dated 13 December 2021 concerning the processing of personal data in patent-grant and related proceedings

The President of the European Patent Office,

having regard to Article 10(2)(a) of the European Patent Convention (EPC),

having regard to Articles 1(2)(a) and 5(a) and (b) of the Implementing Rules for Articles 1b and 32a of the Service Regulations for permanent and other employees of the European Patent Office on the protection of personal data ("Data Protection Rules"),

considering that the task of the European Patent Organisation pursuant to Article 4(3) EPC is to grant European patents and that this task is carried out by the European Patent Office (EPO),

considering further that Part X of the EPC provides for application of the Patent Cooperation Treaty of 19 June 1970 (PCT) and that, in accordance with Article 150 EPC, the EPO applies the provisions of the PCT and its Regulations, supplemented by the provisions of the EPC, in proceedings relating to international applications filed under the PCT,

has decided as follows:

Article 1

Processing of personal data

(1) Personal data are processed by the departments of the EPO specified in Article 15(a) to (e) EPC in patent-grant and related proceedings conducted in accordance with the EPC, including its Implementing Regulations and any other provisions applicable under it, as set out in the annex to this decision. Personal data are likewise processed by the EPO when acting as a PCT authority (receiving Office or International Authority) in accordance with the PCT, its Regulations and any other provisions applicable under it, as set out in the annex to this decision.

(2) Processing of personal data in accordance with paragraph 1 is necessary for the performance of tasks carried out in the exercise of the official activities of the European Patent Organisation or in the legitimate exercise of the official authority vested in the EPO as the controller of the personal data it processes and for compliance with a legal obligation to which the EPO is subject.

Article 2

Primacy of the EPC and the PCT

In case of conflict, the provisions of the EPC, including its Implementing Regulations and any other provisions applicable under it, and the provisions of the PCT, including its Regulations and any other provisions and established practices applicable under it, prevail over the Data Protection Rules.

Article 3

Entry into force

This decision enters into force on 1 January 2022. It applies to any processing of personal data ongoing on or initiated after that date.

Done at Munich, 13 December 2021

António Campinos

President

Annex

Introduction

1. The new Data Protection Rules (DPR) of the European Patent Office (EPO) enter into force on 1 January 2022, as the Implementing Rules for Articles 1b and 32a of the Service Regulations for permanent and other employees of the EPO. When conducting patent-grant and related proceedings (PGP) pursuant to the EPC and the provisions applicable under it, and likewise proceedings under the Patent Cooperation Treaty (PCT), the EPO departments specified in Article 15(a) to (e) EPC¹ process personal data of persons not covered by Article 1 of the EPO Service Regulations (i.e. persons other than EPO employees). The EPO President acts as the controller of the personal data processed by the EPO in these proceedings.

2. In particular, personal data are processed for the purposes of the EPO's task under Article 4(3) EPC of granting European patents, as further specified in the relevant provisions of the EPC and the other provisions applicable under it. Where these data are required for proceedings under the EPC, their processing is mandatory (mandatory personal data). The same applies mutatis mutandis to data required for proceedings under the PCT.

3. Mandatory personal data include, in particular, the personal data which must be published in the European Patent Register under Rule 143 EPC and the applicable decision of the EPO President,² namely personal data of individuals involved in proceedings, such as applicants and proprietors and their representatives, inventors, opponents and their representatives, persons requesting limitation or revocation and petitioners for review.

4. Mandatory personal data also include the personal data which are entered in the list of professional representatives maintained by the EPO pursuant to Article 134(1) EPC and published in its Official Journal³ and which, in the case of contact data, can also be accessed, with the representatives' consent, via a searchable database on the EPO website.

5. Personal data are processed in the PGP where, and to the extent that, this processing is:

• necessary for the performance of a task carried out in the exercise of the official activities of the European Patent Organisation or in the legitimate exercise of the official authority vested in the EPO President, which includes the processing necessary for the EPO's management and functioning (Article 5(a) DPR)
• necessary for compliance with a legal obligation to which the EPO is subject (Article 5(b) DPR)

6. Personal data are processed for the following purposes:

• processing applications and patents pursuant to the EPC, the PCT and the provisions applicable under them
• conducting opposition proceedings and proceedings before the Legal Division
• communicating with parties to the proceedings and, where applicable, third parties
• maintaining the European Patent Register for information of, and inspection by, any third party
• drawing up reports and statistics
• exchanging data with EPC and/or PCT contracting states and with WIPO as part of co-operation projects and activities

A. Procedures and procedural phases in the PGP

7. The main and ancillary procedures of the PGP include:

• procedure up to the grant of a European patent (in particular, examination on filing and examination as to formal requirements, search and substantive examination) (Article 90 et seq. EPC)
• opposition procedure (Article 99 et seq. EPC)
• limitation and revocation procedure (Article 105a et seq. EPC)
• procedures for which the Legal Division is responsible (Article 20 EPC):

     – stay of proceedings (Articles 61(1)(a) and 99(4), Rules 14 et seq., 78 EPC)

     – interruption and resumption of proceedings (Rule 142 EPC)

     – registration and cancellation of licences and other rights (Article 71 et seq., Rules 23 and 24 EPC)

     – registration of transfers and changes of name (Article 71 et seq., Rules 22 and 85 EPC)

     – rectification of the designation of an inventor (Rule 21 EPC)

• interlocutory revision and any further proceedings in the above cases which follow remittal from a board of appeal
• procedures under the PCT (Article 150 et seq. EPC in conjunction with the PCT legal framework)
• searches performed on behalf of national patent offices (working agreements with national offices)
• requests from national courts for a technical opinion (Article 25 EPC)
• file inspection (Article 128 EPC)
• request for re-establishment of rights (Article 122 EPC)
• request for conversion (Article 135 et seq. EPC)
• publication of applications and granted patents (Articles 93, 98, 103, 105c EPC)
• publication of the European Patent Bulletin and maintenance of the European Patent Register (Articles 127 and 129 EPC)
• procedures relating to representatives, in particular:

     – entries on, changes to and deletions from the list of professional representatives before the EPO (Article 134, Rule 154 EPC)

     – publication of professional representatives' data in the EPO Official Journal and in a searchable database

     – transmission of professional representatives' data to the Institute of Professional Representatives before the EPO (Article 134a EPC)

     – registration and deletion of legal practitioners (Article 134(8) EPC)

     – registration, administration and deletion of associations (Article 134(1) EPC)

     – registration, administration and deletion of general authorisations (Article 133 EPC)

     – disciplinary procedures in respect of professional representatives before the EPO (Article 134a(1)(c) EPC)

8. The following may occur in, or as part of, the PGP procedures listed above:

• filing of third-party observations (Article 115 EPC)
• submission of prior art (cf. Article 54 EPC)
• submission of evidence (cf. Article 117 EPC)
• filing and notification by electronic means of communication (Rules 2 and 127 EPC)
• correction of errors (Rule 139 EPC)
• fee payment (Article 6 RFees, Arrangements for Deposit Accounts)
• oral proceedings, including by videoconference (cf. Article 116 EPC)

B. Personal data processed during the PGP

9. The following personal data of persons covered by Article 2(3) DPR are processed by the EPO during the PGP:⁴

(a) Procedure up to the grant of a European patent

(including any interlocutory revision and any proceedings following remittal from a board of appeal)

• applicant's name (i.e. family name and given names), address, nationality and state of residence or principal place of business (Rule 41(2)(c) EPC)
• applicant's fax and telephone numbers and email address, where provided (Rule 41(2)(c) EPC)
• applicant's signature (Rule 41(2)(h) EPC)
• name of any representative, his or her signature, address of his or her place of business (Rules 143(1)(h), 41(2)(d), 92(2)(c) EPC) and, where provided, representative number, association number, fax and telephone numbers and email address
• inventor's name and country and place of residence (Rule 19(1) EPC)
• personal data contained in copies of previous applications where applicants claim their priority (Rule 53(1) EPC)
• name of the person making a payment and personal data relating to deposit accounts or other payment means (bank accounts, credit cards, etc.) (Article 6(1) RFees, Article 5(2) RFees together with the Arrangements for Deposit Accounts)
• where applicable, any personal data relating to third-party observations (see item (i) below), evidence (see item (l) below), prior art (see item (m) below), IT tools and services (see item (n) below) and oral proceedings (see item (o) below)
• any other personal data provided by a party during the proceedings

(b) Opposition procedure

(including any proceedings following remittal from a board of appeal)

• opponent's name, address, nationality and state of residence or principal place of business (Rule 76(2)(a) together with Rule 41(2)(c) EPC)
• opponent's fax and telephone numbers and email address, where provided (Rule 76(2)(a) together with Rule 41(2)(c) EPC)
• proprietor's name, address, nationality and state of residence or principal place of business (Rule 41(2)(c) EPC)
• proprietor's fax and telephone numbers and email address, where provided (Rule 41(2)(c) EPC)
• names of any representatives of the opponent and the proprietor, address of their place of business (Rule 76(2)(a) together with Rule 41(2)(d) EPC) and, where provided, representative number, association number, fax and telephone numbers and email addresses
• name of the person making a payment as well as personal data relating to deposit accounts or other payment means (bank accounts, credit cards etc.) (Article 6(1) RFees, Art. 5(2) RFees together with the Arrangements for Deposit Accounts)
• signatures (Rule 76(3) together with Rule 50(3) EPC)
• where applicable, any personal data processed in relation to any third-party observations (see item (i) below), evidence (see item l below), prior art (see item (m) below), IT tools and services (see item (n) below) and oral proceedings (see item (o) below)
• any other personal data provided by a party during the proceedings

(c) Requests for revocation or limitation

(including any interlocutory revision and any proceedings following remittal from a board of appeal)

• requester's name, address, nationality and state of residence or principal place of business (Rule 92(2)(a) together with Rule 41(2)(c) EPC)
• signatures (Rule 92(1) together with Rule 50(3) EPC)
• requester's fax and telephone numbers and email address, where provided (Rule 92(2)(a) together with Rule 41(2)(c) EPC)
• where appropriate, names and addresses of the proprietors of the patent for contracting states in which the requester is not the proprietor (Rule 92(2)(c) EPC)
• name of any representative, address of his or her place of business (Rule 92(2)(c) together with Rule 41(2)(d) EPC) and, where provided, representative number, association number, fax and telephone numbers and email addresses
• name of the person making a payment and personal data relating to deposit accounts or other payment means (bank accounts, credit cards, etc.) (Article 6(1) RFees, Article 5(2) RFees together with the Arrangements for Deposit Accounts)
• where applicable, any personal data relating to any third-party observations (see item (i) below), evidence (see item (l) below), prior art (see item (m) below), IT tools and services (see item (n) below) and oral proceedings (see item (o) below)
• any other personal data provided by a party during the proceedings

(d) PCT procedure (international phase)

• personal data similar to those processed in the procedure up to the grant of a European patent, in particular:

     – name, address, nationality and residence of the applicant or, if there are several applicants, of each of them (Rule 4.5(a) PCT)

     – name and address of any agent appointed (Rule 4.7(a) PCT) and, if optionally provided, the agent's registration number or other indication of registration (Rule 4.7(b) PCT)

     – personal data of any common representative appointed (Rule 4.8 PCT)

     – where the national law of at least one of the designated states requires that the name of the inventor be furnished at the time of filing a national application: the name and address of the inventor or, if there are several inventors, of each of them, or if the applicant is the inventor, a statement to that effect (Rule 4.6(a) and (b) PCT)

     – any other personal data provided by a party during the proceedings

A number of other events which may occur during the PCT procedure require the processing of similar data (e.g. demand for international preliminary examination, supplementary international search request, request for restoration of the right of priority, submission of a power of attorney, request for recording of changes under Rule 92bis PCT, filing of a priority document, priority document exchange via the WIPO Digital Access Service).

(e) Procedures before the Legal Division

(including any interlocutory revision and any proceedings following remittal from a board of appeal)

• name of any representative, address of his or her place of business (Rules 143(1)(h), 41(2)(d) EPC) and, where provided, representative number, association number, fax and telephone numbers and email address
• name of the person making a payment and personal data relating to deposit accounts or other payment means (bank accounts, credit cards, etc.) (Article 6(1) RFees, Article 5(2) RFees together with the Arrangements for Deposit Accounts)
• signatures (Rule 50(3) EPC; Article 72 et seq. EPC)
• where applicable, any personal data relating to any third-party observations (see item (i) below), evidence (see item (l) below), IT tools and services (see item (n) below) and oral proceedings (see item (o) below)
• if proceedings are stayed (Rules 14 and 78 EPC): name and address of the person requesting the stay and, where provided, his or her fax and telephone numbers and email address, as well as any other personal data provided by a party during the proceedings
• if proceedings are resumed pursuant to Rule 142(2) EPC: name and address of person authorised to continue proceedings and, where provided, his or her fax and telephone numbers and email address, as well as any other personal data provided by a party in the course of the proceedings
• in the case of proceedings for the registration and cancellation of licences and other rights (Articles 71 et seq., Rules 23 and 24 EPC): name, address and state of residence or principal place of business of the licensee (or transferee of a licence) or holder of a right in rem (or transferee of a right in rem) in respect of a European patent application (Rules 23 et seq., 143(1)(w) EPC) and any other personal data provided by a party during the proceedings
• in the case of proceedings for the registration of transfers and changes of name (Article 71 et seq., Rules 22 and 85 EPC): name, address and state of residence or principal place of business of the assignee of a European patent application or patent (Rules 22 and 85, 143(1)(f) EPC) and any other personal data provided by a party during the proceedings
• in the case of proceedings for the rectification of the designation of an inventor (Rule 21 EPC): name and address of the correct inventor (Rule 21(1) together with Rule 19(1) EPC); name and country and place of residence of the wrongly designated person (Rule 21(1) EPC); if the request for rectification is filed by a third party, name and address of that third party (Rule 21(1) EPC); and any other personal data provided by a party during the proceedings

(f) Searches performed on behalf of national patent offices

• names of the applicant and of the inventor
• personal data contained in copies of previous applications where applicants claim their priority
• personal data relating to any evidence (see item( l) below) and prior art (see item (m) below)

(g) Procedure for issuing a technical opinion at the request of a national court

• names, signatures, official addresses and contact details of judges and other court officers involved in the infringement or revocation action pending before the national court and in requesting a technical opinion
• name, address, signatures, fax and telephone numbers and email addresses of the parties to the infringement or revocation action pending before the national court, where provided
• name, signature and address of place of business of any representatives of the parties to the pending action and, where provided, their fax and telephone numbers and email addresses
• any personal data relating to any evidence (see item (l) below), prior art (see item (m) below), IT tools and services (see item (n) below) and hearings (see the personal data for oral proceedings item (o) below)
• any other personal data provided by the court or a party during the proceedings

(h) Requests for the correction of errors in documents filed with the EPO

• any personal data in the document to be corrected (such as family name, given names, address, nationality, country and place of residence) (Rule 139 EPC)
• name of any representative, address of his or her place of business (Rule 92(2)(c) together with Rule 41(2)(d) EPC) and, where provided, representative number, association number, fax and telephone numbers and email addresses
• signatures (Rule 50(3) EPC)
• any personal data of a party to the proceedings, and of any representative of that party, processed in the main proceedings in which the request was made (see above)
• any personal data relating to evidence (see item (l) below)
• any other personal data provided by a party during the proceedings

(i) Third-party observations

• any personal data provided by a third party when filing observations (Article 115 EPC) (in particular, name, address, telephone and fax numbers and email addresses)
• signatures (if any) (Rule 50(3) EPC)
• name of any representative and address of his or her place of business (cf. Rule 41(2)(d) EPC) and, where provided, representative number, association number, fax and telephone numbers and email addresses
• any personal data relating to any evidence (see item (l) below), prior art (see item (m) below) and IT tools and services (see item (n) below)
• any personal data of a party to the proceedings, and any representative of that party, processed in the proceedings in which the observations were filed

(j) Request for re-establishment of rights (Article 122 EPC)

• any personal data provided by the requester in the submission of facts and evidence (in particular, full name, employment relationship, professional background and specific contacts of persons concerned, and situations in which they had been involved)
• any personal data of a party to the proceedings, and any representative of that party, processed in the main proceedings in which the request was made (see above)
• any personal data processed in relation to evidence (see item (l) below)
• any other personal data provided by a party during the proceedings.

(k) Request for conversion (Article 135 et seq. EPC)

• any personal data of a party to the proceedings, and any representative of that party, processed in the pending proceedings up to the grant of a European patent
• any other personal data provided by a party during the proceedings

(l) Evidence

• name, gender, address, date and place of birth of parties, witnesses and experts nominated to give oral testimony and any other personal data needed to establish their identity (Article 117 and Rule 117 et seq. EPC)
• employment relationship, professional background and specific contacts of, or actions taken by, parties, witnesses and experts nominated to give oral testimony, any other personal data relating to situations in which they had been involved, and any further details of the subject-matter of the evidence (Article 117 and Rule 117 et seq. EPC)
• name, address, date and place of birth, employment relationship, professional background and specific contacts of, or actions taken by, the person giving oral testimony or third persons (for example, court-appointed liquidators, spouses, legal guardians, heirs, physicians), and situations in which those persons had been involved
• any other personal details contained in written evidence, declarations and other documents provided by a party or identified by the EPO or in written, audio, video, multimedia and other disclosures (Article 117 EPC)

(m) Prior art

(acquired and stored by the EPO for use in the PGP or filed by a party or third party)

• any type of personal data contained in any written, audio, video, multimedia and other prior-art disclosures, in particular authors' names, affiliations, email addresses, images, audio and voice recordings of individuals (Article 54 EPC)

(n) Use of IT tools and services

• for filing, payment and notification tools and any other services for the exchange of information (Rules 2, 127 EPC, Article 5(2) RFees together with the Arrangements for Deposit Accounts): connection and identification data of professional representatives, legal practitioners, individual applicants, proprietors or opponents, and employees acting on their behalf, as well as third parties under Article 115 EPC
• potentially for access to the European Patent Register, whether for the purposes of file inspection or otherwise: connection and identification data of any party or third party

(o) Oral proceedings

• for public oral proceedings held on the premises of the EPO: name of any person attending who is not a party to the proceedings and not affiliated with such a party (Article 116 EPC)
• for oral proceedings held by videoconference:

     – name, email address and connection details (including IP addresses) of all participants and attendees (Article 116 EPC and related decisions of the EPO President)

     – any personal data processed in the platform used by the EPO to conduct the oral proceedings (Article 116 EPC)5

(p) File inspection

• for online inspection: IP addresses of persons inspecting the file, in accordance with the privacy policy for users of the EPO website and the European Patent Register service available on it (Article 128 EPC and the related decision of the EPO President)
• for inspection of paper copies and inspection on the premises: name and address (and, where provided, telephone and fax number and email address) of the person inspecting the file (Article 128 EPC, and the related decision of the EPO President)
• any kind of personal data contained in the documents constituting the file and in the related entries made in the European Patent Register and published in the European Patent Bulletin (Article 128 EPC).

(q) Procedures relating to representatives

• in relation to professional representatives: gender, name, date of birth, nationality, copy of passport/ID card, address (place of business or employment), year of passing the European qualifying examination (EQE), signature, telephone number, email address, fax number, URL address, preferred language, entry or re-entry date, role, action date, type of change, representative registration number (ID), deletion date and legal reference to the entry and deletion (Article 134, Rule 154 EPC)
• in the case of disciplinary proceedings against professional representatives: gender, name, contact details (address, email address) of claimants and respondents and their respective representatives, as well as claims and related correspondence and documentation necessary for the handling of the proceedings
• in relation to legal practitioners: gender, name, address (place of business or employment), signature, telephone number, email address, fax numbers, URL address, preferred language, entry or re-entry date, role, action date, type of change, former ID, deletion date and legal reference to the entry and deletion (Article 134(8) EPC)
• in relation to associations of representatives: name, representative registration number (ID), address (place of business or employment), signature, entry or deletion date as member of an association (Article 134(1), Rule 152(11) EPC)
• in relation to general authorisations: name, address, role and signature of the person issuing the authorisation and name, address, level of rights and role of the authorised person (Article 133, Rules 151, 152 EPC)

10. Where necessary, the procedures and procedural elements listed above include publication of the personal data in question as part of the patent application and, if granted, of the patent specification and in the related entries in the European Patent Bulletin and the European Patent Register, all of which will remain available to the public without limitation in time or content.

C. Exercising data subject rights under the DPR

11. The DPR provide data subjects with specific rights in section III. As with all secondary legislation adopted by the Administrative Council in accordance with its powers under Article 33(2) EPC, the DPR are subject to the provisions of the EPC, including its Implementing Regulations, which form an integral part of the EPC under Article 164(1) EPC. In addition, where the EPO is acting as PCT receiving Office and International Authority, it is bound first by the PCT legal framework, which consists of the Patent Cooperation Treaty, its Regulations and the related secondary law, i.e. the Administrative Instructions, the Guidelines for receiving Offices and the International Searching and Preliminary Examination Guidelines. Accordingly, any data subject rights under the DPR apply only to the extent that they do not conflict with the provisions of the EPC and its Implementing Regulations and, where applicable, of the PCT legal framework.

(a) Exercising the right of access

12. The right of access under Article 18 DPR entitles the data subject to obtain from the controller (i.e. from the EPO President) confirmation as to whether or not personal data concerning him or her are being processed and, if so, to access the personal data and be provided with the information listed in Article 18(1) DPR (purpose of processing, categories of data concerned, recipients of data, existence of rights, etc.).

13. Personal data included in the file of a European patent application or a granted European patent can be accessed by means of public file inspection; personal data in the European Patent Register can be accessed there. In addition, applicants can request to inspect the file at any time under Article 128(1) EPC.

14. The right of access is subject to limitations where:

• the data concerned are in files relating to applications which have not yet been published, unless the applicants have expressly consented to access (Article 128(1) EPC);
• the data concerned in parts of files which are excluded from file inspection (Rule 144 EPC and the related decision of the EPO President).

15. Access to personal data contained in PCT files is already provided by means of file inspection in WIPO's PATENTSCOPE and in the European Patent Register in accordance with the applicable legal provisions (Article 30 PCT; Rules 94 and 48 PCT; Articles 150(2) and 128(4) EPC; Rule 144 EPC; Special edition No. 3, OJ EPO 2007, J.3.; OJ EPO 2019, A17).

16. Since access to PCT files is regulated by PCT and EPC provisions, which prevail over the DPR, the right of access under Article 18 DPR applies only subject to the limitations set by those provisions.

(b) Exercising the right to rectification

17. The right to rectification under Article 19 DPR entitles the data subject to obtain from the controller (i.e. from the EPO President) correction of inaccurate data and completion of incomplete data.

18. In relation to personal data in files of applications and granted patents, as well as in the relevant publications, rectification is subject to the requirements and limitations set out in the applicable provisions of the EPC, such as, in particular:

• Rule 139 (correction of errors in documents filed with the EPO),
• Rule 140 (correction of errors in decisions),
• Article 14(2), 2nd sentence (correction of translations),
• Rule 21 (rectification of inventor designation),
• Article 61 and Rules 14 to 18 (applications filed by non-entitled persons).

19. A correction or rectification pursuant to these provisions may result in the updating of entries in the European Patent Register and the European Patent Bulletin and of publications of the application or patent. However, it will not retroactively change the content of the file (which will continue to contain all submissions of parties and communications and decisions from the EPO). Nor will it result in the withdrawal or deletion of earlier publications.

20. Rectifications, amendments and changes of data contained in international applications are governed by the PCT legal framework (Articles 19 and 34 PCT, Rules 66, 91, 26, 20.5, 20.5bis and 92bis PCT). Therefore, any right under the DPR to change personal data in international applications applies only subject to the limitations and requirements set by that framework.

(c) Exercising the right to erasure

21. The right to erasure ("right to be forgotten") under Article 20 DPR entitles the data subject to obtain from the controller (i.e. from the EPO President) the erasure of personal data if one of the grounds listed in Article 20(1) DPR applies (e.g. because the personal data are no longer necessary, were unlawfully processed or have to be erased to comply with another legal obligation).

22. The right to erasure is subject to the limitations and requirements set out in the EPC, which prevails over the DPR. As regards published patent applications and patents and information published in the European Patent Bulletin, the Official Journal and the European Patent Register, the EPO is obliged under Articles 93, 98, 127, 129 EPC to maintain this information, and keep it publicly available, indefinitely. As regards the content of files, the EPO is obliged to keep it for the period specified in Rule 147(4) and (5) EPC.

23. The right to erasure is also subject to the same limitations and requirements as set out above in relation to the right to rectification (see points 19 and 20) and so applies only to the extent possible under the provisions of the EPC allowing for such modification of data or of documents and databases containing them. The same applies mutatis mutandis to data contained in international applications and their files (see also point 20 on the right to rectification).

(d) Exercising the right to restriction of processing

24. The right to restriction under Article 21 DPR entitles the data subject to obtain from the controller (i.e. from the EPO President) the restriction of processing of his or her personal data where one of the grounds listed in Article 21(1) DPR applies (e.g. because the accuracy of the personal data is contested, the processing is unlawful or the personal data are no longer needed).

25. The right to restriction of processing is subject to the limitations and requirements set out in the EPC, which prevails over the DPR. The EPO is obliged to perform its PGP-related tasks under Article 4(3) EPC in line with the provisions of the EPC and its secondary legislation and subject only to the limitations and requirements set out there. Thus, as set out above in relation to the right to rectification, the right to restriction of processing applies only to the extent possible under the provisions of the EPC allowing for modification of data or of documents and databases containing them.

26. Where the EPO is acting as a PCT Authority (receiving Office or International Authority), it is obliged to process international applications in accordance with the PCT legal framework and any supplementary EPC provisions. The right to restriction of processing (Article 21 DPR) therefore applies only to the extent that it is compatible with the applicable PCT and EPC provisions.

(e) Exercising the right to object to processing certain personal data

27. According to Article 23(1) DPR, data subjects have, in principle, the right to object, on grounds relating to their particular situation at any time, to the processing of personal data concerning them which is based on Article 5(a) DPR. If a data subject so objects, the controller (i.e. the EPO) must cease to process the personal data unless it can be demonstrated that there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject.

28. The right to object to processing is subject to the limitations and requirements set out in the EPC, which prevails over the DPR. The EPO is obliged to perform its PGP-related tasks under Article 4(3) EPC in line with the provisions of the EPC and its secondary legislation, and subject only to the limitations and requirements set out there. As already mentioned above, where the EPO is acting as a PCT Authority, it is obliged to process international applications as provided for under the PCT legal framework and any supplementary EPC provisions. Compliance with these EPC and PCT provisions is a compelling legitimate ground for the processing of personal data which overrides any competing interests, rights and freedoms of the data subject concerned.

(f) The right to data portability

29. Under Article 22 DPR, data subjects have the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning them which they have provided to the controller.

30. This right applies only to data provided where the processing is based on the data subject's consent or a contract, and where the processing is carried out by automated means. As personal data processing in the PGP is generally not based on consent⁶ or a contract, this right does not apply in that context.

D. Inspection of files

31. Pursuant to Article 128(4) EPC, files relating to published European patent applications and European patents granted on them are open for inspection by third parties via the European Patent Register, which is available free of charge on the EPO website (see Article 1 of the decision of the President of the EPO dated 20 February 2019, OJ EPO 2019, A16).

32. In the PCT framework, files can be inspected via WIPO's PATENTSCOPE and the European Patent Register in accordance with the applicable legal provisions (Article 30 PCT; Rules 94 and 48 PCT; Articles 150(2) and 128(4) EPC; Rule 144 EPC; Special edition No. 3, OJ EPO 2007, J.3.; OJ EPO 2019, A17).

33. Pursuant to Rule 144 EPC and the related decision of the EPO President (dated 12 July 2007, Special edition No. 3, OJ EPO 2007, J.3), the following documents relating to the PGP are excluded from file inspection:

• draft decisions and opinions, and all other documents used for the preparation of decisions and opinions, which are not communicated to the parties (Rule 144(b) EPC)
• the designation of the inventor if the inventor has waived the right to be mentioned as such under Rule 20(1) (Rule 144(c) EPC)
• any other document, or part of a document, excluded from inspection by the President of the EPO on the ground that its inspection would not serve the purpose of informing the public about the European patent application or the resulting patent, in particular

     – medical certificates

     – documents relating to the issue of priority documents, file-inspection proceedings or the communication of information from the files, and requests for exclusion from inspection

     – requests for accelerated search and accelerated examination under the "PACE" programme

     – other documents where it appears or is claimed that their inspection would be prejudicial to the legitimate personal or economic interests of a natural or legal person and their inspection would not serve the purpose of informing the public about the application or resulting patent.