Article 112

EUROPEAN PATENT OFFICE

Information from the EPO

Decision of the President of the European Patent Office dated 7 December 2022 concerning the processing of personal data in proceedings related to European patents with unitary effect

The President of the European Patent Office, 

having regard to Article 10(2)(a) of the European Patent Convention (EPC) and Rule 3 of the Rules relating to Unitary Patent Protection,

having regard to Articles 1(2)(a) and 5(a) and (b) of the Implementing Rules for Articles 1b and 32a of the Service Regulations for permanent and other employees of the European Patent Office on the protection of personal data ("Data Protection Rules"), 

considering that pursuant to Rule 1(1) of the Rules relating to Unitary Patent Protection the European Patent Office (EPO) has been entrusted by the participating Member States with the administrative tasks referred to in Article 9(1) of Regulation (EU) No 1257/2012,

considering that the Rules relating to Unitary Patent Protection (UPR) and the Rules relating to Fees for Unitary Patent Protection (RFeesUPP)1 will enter into force on the date of application of Regulations (EU) No 1257/2012 and (EU) No 1260/2012,2

considering further that the EPO will accept requests for unitary effect filed prior to the date of application of Regulations (EU) No 1257/2012 and (EU) No 1260/2012,3

has decided as follows: 

Article 1
Processing of personal data

(1) Personal data are processed by the department of the EPO specified in Rule 4 UPR in proceedings conducted under the UPR and the RFeesUPP, including the provisions applicable under them, as set out in the annex to this decision.

(2) Processing of personal data in accordance with paragraph 1 is necessary for the performance of tasks carried out in the exercise of the official activities of the European Patent Organisation or in the legitimate exercise of the official authority vested in the EPO as the controller of the personal data it processes or for compliance with a legal obligation to which the EPO is subject. 

Article 2
Primacy of the UPR and the RFeesUPP

In case of conflict, the provisions of the UPR and the RFeesUPP, including the provisions applicable under them, prevail over the Data Protection Rules. 

Article 3
Entry into force

This decision enters into force on 1 January 2023. It applies to any processing of personal data initiated on or after that date. 

Done at Munich, 7 december 2022

António Campinos

President

Annex

Introduction

1. When conducting proceedings under the UPR and the RFeesUPP, including the provisions applicable under them, the EPO department specified in Rule 4 UPR, namely the Unitary Patent Protection Division, processes personal data of persons not covered by Article 1 of the Service Regulations for permanent and other employees of the EPO (i.e. persons other than EPO employees). The EPO President acts as the controller of the personal data processed by the EPO in these proceedings.

2. In particular, personal data are processed for the purposes of the EPO's tasks under Rule 1(1) UPR, as further specified in the relevant provisions of the UPR and the RFeesUPP, including the provisions applicable under them. Where these data are required for proceedings under the UPR and the RFeesUPP, their processing is mandatory (mandatory personal data).

3. Mandatory personal data include, in particular, the personal data that must be published in the Register for unitary patent protection under Rule 16 UPR and any applicable decision of the EPO President issued under Rule 16(2) UPR, namely personal data of individuals involved in proceedings, such as proprietors and their representatives and inventors.

4. Personal data are processed in proceedings under the UPR and the RFeesUPP where, and to the extent that, this processing is:

• necessary for the performance of a task carried out in the exercise of the official activities of the European Patent Organisation or in the legitimate exercise of the official authority vested in the EPO President, which includes the processing necessary for the EPO's management and functioning (Article 5(a) of the Data Protection Rules (DPR))
• necessary for compliance with a legal obligation to which the EPO is subject (Article 5(b) DPR4)

5. Personal data are processed for the following purposes:

• processing requests for unitary effect
• processing and administering European patents with unitary effect pursuant to the UPR and the provisions applicable under them
• administering the compensation scheme for the reimbursement of translation costs
• conducting proceedings before the Unitary Patent Protection Division
• conducting proceedings following applications filed with the Unified Patent Court (UPC)5
• communicating with parties to proceedings and, where applicable, third parties
• collecting and administering renewal fees and any additional fees for European patents with unitary effect
• maintaining the Register for unitary patent protection for the information of, and inspection by, any third party
• drawing up reports and statistics
• exchanging data with the UPC and the participating Member States as part of co-operation projects and activities as well as with the central industrial property offices, courts and other competent authorities of the participating Member States

A. Proceedings related to European patents with unitary effect

6. Proceedings related to European patents with unitary effect encompass:

• procedure relating to the registration or rejection of unitary effect (Rules 5 to 7 UPR), including any proceedings following an application or appeal filed with the UPC under Rule 97 of its Rules of Procedure
• compensation scheme procedure (Rules 8 to 11 UPR)
• administration of European patents with unitary effect (Rules 12, 16 and 20 UPR)
• publication in the European Patent Bulletin and maintenance of the Register for unitary patent protection (Rules 15 to 17 UPR)
• publication of the translations referred to in Rule 6(2)(d) UPR (Rule 18 UPR)
• inclusion of decisions of the UPC in the files (Rule 19 UPR)
• file inspection (Rule 20(1) UPR in conjunction with Article 128(4) EPC)
• requests for re-establishment of rights (Rule 22 UPR)
• interlocutory revision (Rule 24 UPR), including any subsequent proceedings under Rule 88 et seq. of the Rules of Procedure of the UPC
• procedures relating to representatives (Rule 20(1) UPR in conjunction with Articles 133 and 134(1) and (8) EPC).

7. The following may occur in, or as part of, proceedings related to European patents with unitary effect:

• submission of evidence (Rule 20(1) UPR in conjunction with Article 117 EPC)
• filing and notification by electronic means of communication (Rule 20(2)(a) and (f) UPR in conjunction with Rules 2 and 127 EPC)
• correction of errors (Rule 20(2)(h) UPR in conjunction with Rule 139 EPC)
• fee payment (Article 6 RFeesUPP in conjunction with Articles 5 and 6 of the Rules relating to Fees (RFees), Arrangements for deposit accounts)
• oral proceedings, including by videoconference (Rule 21 UPR)

B. Personal data processed during proceedings related to European patents with unitary effect

8. The following personal data of persons covered by Article 2(3) DPR are processed by the EPO during proceedings related to European patents with unitary effect:

• proprietor's name (i.e. family name and given names), address, nationality, state of residence or principal place of business (Rules 6(2)(a) and 16(1)(h) UPR in conjunction with Rule 41(2)(c) EPC) and, where provided, the proprietor's reference
• proprietor's fax and telephone numbers and email address where provided (Rules 6(2)(a) and 16(1)(h) UPR in conjunction with Rule 41(2)(c) EPC)
• proprietor's signature (Rule 20(2)(c) UPR in conjunction with Rule 50(3) EPC) and in the case of legal persons, the signatory's position within the legal entity
• name of any representative, their signature and the address of their place of business (Rules 6(2)(c) and 16(1)(c) UPR in conjunction with Rule 41(2)(d) EPC) and, where provided, their reference, representative number, association number, fax and telephone numbers and email address
• name of any employee, their signature and the address of their place of business (Rule 20(1) UPR in conjunction with Article 133(3) EPC), their position within the legal entity and, where provided, their reference, fax and telephone numbers and email address
• inventor's name (i.e. family name and given names) and country and place of residence (Rule 16(1)(i) UPR)
• name of the person making a payment and personal data relating to deposit accounts or other payment means (bank accounts, credit cards, etc.) (Article 6 RFeesUPP in conjunction with Articles 5(2) and 6(1) RFees together with the Arrangements for deposit accounts)
• signatures (Rule 20(2)(c) UPR in conjunction with Rule 50(3) EPC)
• where applicable, any personal data relating to evidence (see item (m) below), IT tools and services (see item (n) below) and oral proceedings (see item (o) below)
• any other personal data provided by a party during the proceedings

8.1. In addition to the above, the following personal data are also processed:

(a) In proceedings relating to the registration or rejection of unitary effect (Rules 5 to 7 UPR)

• place of business (i.e. address and state) of the applicant(s) on the date of filing of the application for the European patent pursuant to Article 7(1)(b) Regulation (EU) No 1257/2012 (Rule 16(1)(w) UPR)

(b) In proceedings following an application filed with the UPC under Rule 97 of its Rules of Procedure to annul a decision of the EPO to reject a request for unitary effect, including any subsequent appeal proceedings

• names of the claimants and, where applicable, of the claimants' representatives
• postal and electronic addresses for service on the claimants and the names and addresses of the persons authorised to accept service
• any other personal data contained in the application or appeal and in any documents, including any witness statements, which have been filed to support the application or appeal as well as in decisions or orders of the UPC issued in the context of the application or appeal, including names, signatures, official addresses and contact details of judges and other court officers involved in the proceedings or provided by the court

(c) Compensation scheme (Rules 8 to 11 UPR)

• name of the person receiving the compensation and personal data relating to deposit accounts or other payment means (bank accounts, credit cards, etc.) (Articles 1 and 6 RFeesUPP in conjunction with Articles 5(2) and 6(1) RFees together with the Arrangements for deposit accounts)
• any personal data contained in evidence filed under Rule 10(3) UPR

(d) Requests for registration of licensing commitments undertaken by the proprietor of the European patent with unitary effect in international standardisation bodies (Rule 16(1)(k) UPR)

• any personal data contained in the statement and licensing declaration submitted to support the request

(e) Requests for registration of transfers and changes of name (Rule 20(2)(b) UPR in conjunction with Rule 22 EPC, Rule 16(1)(j) UPR)

• name, address and state of residence or principal place of business of the new proprietor of the European patent with unitary effect

(f) Requests for registration and cancellation of licences and other rights (Rule 20(2)(b) UPR in conjunction with Rules 23 and 24 EPC, Rule 16(1)(j) UPR)

• name, address and state of residence or principal place of business of the licensee (or transferee of a licence) or holder of a right in rem (or transferee of a right in rem) in respect of a European patent with unitary effect

(g) If proceedings are resumed pursuant to Rule 20(2)(i) UPR in conjunction with Rule 142(2) EPC

• name and address of person authorised to continue the proceedings and, where provided, their fax and telephone numbers and email address

(h) Interlocutory revision (Rule 24 UPR)

In proceedings following an application filed with the UPC under Rule 88 et seq. of its Rules of Procedure to annul or alter a decision of the EPO, including any subsequent appeal proceedings:

• the names of the claimants and, where applicable, of the claimants' representatives
• postal and electronic addresses for service on the claimants and the names and addresses of the persons authorised to accept service
• any other personal data contained in the application or appeal and in any documents, including any witness statements, which have been filed to support the application or appeal as well as in decisions or orders of the UPC issued in the context of the application or appeal, including names, signatures, official addresses and contact details of judges and other court officers involved in the proceedings or provided by the court

(i) Requests for the correction of errors in documents filed with the EPO

• any personal data in the document to be corrected (such as family name, given names, address, nationality and country and place of residence) (Rule 20(2)(h) UPR in conjunction with Rule 139 EPC)
• any personal data of a party to the proceedings, and of any representative of that party, processed in the main proceedings in which the request was made

(j) Requests for re-establishment of rights (Rule 22 UPR)

• any personal data provided by the requester in the submission of facts and evidence (in particular, full name, employment relationship, professional background and specific contacts of persons concerned, and situations in which they had been involved)
• any personal data of a party to the proceedings, and any representative of that party, processed in the main proceedings in which the request was made

(k) In the case of entries in the Register for unitary patent protection pursuant to Rule 16(1)(o), (p), (q) and (v) UPR

• any kind of personal data provided by the UPC or the central industrial property offices, courts and other competent authorities of the participating Member States

(l) Fee payment

In the case of payment of any fees and expenses prescribed in the UPR and the RFeesUPP, including the provisions applicable under them: name of the person making a payment and personal data relating to deposit accounts or other payment means (bank accounts, credit cards, etc.) (Article 6 RFeesUPP in conjunction with Articles 5(2) and 6(1) RFees together with the Arrangements for deposit accounts)

(m) Evidence

• name, gender, address, date and place of birth of parties, witnesses and experts nominated to give oral testimony and any other personal data needed to establish their identity (Rule 20(1) and (2)(e) UPR in conjunction with Article 117 and Rule 117 et seq. EPC) 
• employment relationship, professional background and specific contacts of, or actions taken by, parties, witnesses and experts nominated to give oral testimony, any other personal data relating to situations in which they had been involved, and any further details of the subject-matter of the evidence (Rule 20(1) and (2)(e) UPR in conjunction with Article 117 and Rule 117 et seq. EPC) 
• name, address, date and place of birth, employment relationship, professional background and specific contacts of, or actions taken by, the person giving oral testimony or third persons (for example, court-appointed liquidators, spouses, legal guardians, heirs, physicians), and situations in which those persons had been involved
• any other personal details contained in written evidence, declarations and other documents provided by a party or identified by the EPO or in written, audio, video, multimedia and other disclosures (Rule 20(1) UPR in conjunction with Article 117 EPC)

(n) Use of IT tools and services

• for filing, payment and notification tools and any other services for the exchange of information (Rule 20(2)(a) and (f) UPR in conjunction with Rules 2 and 127 EPC, Article 6 RFeesUPP in conjunction with Article 5(2) RFees together with the Arrangements for deposit accounts): connection and identification data of professional representatives, legal practitioners, individual proprietors and employees acting on their behalf
• potentially for access to the Register for unitary patent protection, whether for the purposes of file inspection or otherwise: connection and identification data of any party or third party

(o) Oral proceedings

For oral proceedings held by videoconference:

• name, email address and connection details (including IP addresses) of all participants and attendees (Rule 21 UPR and any applicable decision of the EPO President taken under it)
• any personal data processed in the platform used by the EPO to conduct the oral proceedings (Rule 21 UPR)6

(p) File inspection

• for online inspection: IP addresses of persons inspecting the file, in accordance with the privacy policy for users of the EPO website and the Register for unitary patent protection service available on it (Rule 20(1) UPR in conjunction with Article 128(4) EPC and the related decision of the EPO President) 
• for inspection of paper copies and inspection on the premises: name and address (and, where provided, telephone and fax numbers and email address) of the person inspecting the file (Rule 20(1) UPR in conjunction with Article 128(4) EPC and the related decision of the EPO President) 
• any kind of personal data contained in the documents constituting the file, including the decisions of the UPC7 (Rule 19 UPR), and in the related entries made in the Register for unitary patent protection and published in the European Patent Bulletin (Rule 20(1) UPR in conjunction with Article 128(4) EPC)

(q) Procedures relating to representatives

• in relation to professional representatives: the personal data8processed for entry on and deletion from the list of professional representatives before the EPO (Article 134 and Rule 154 EPC and the related decision of the EPO President9)
• in relation to legal practitioners: gender, name, address (place of business or employment), signature, telephone number, email address, fax number, URL address, preferred language, entry or re-entry date, role, action date, type of change, former ID, deletion date and legal reference to the entry and deletion (Rule 20(1) UPR in conjunction with Article 134(8) EPC)
• in relation to associations of representatives: name, representative registration number (ID), address (place of business or employment), signature, entry or deletion date as member of an association (Rule 20(1) and (2)(l) UPR in conjunction with Article 134(1) and Rule 152(11) EPC)
• in relation to general authorisations: name, address, role and signature of the person issuing the authorisation and name, address, level of rights and role of the authorised person (Rule 20(1) and (2)(l) UPR in conjunction with Article 133, Rule 151 and Rule 152 EPC)

9. Where necessary, proceedings related to European patents with unitary effect and the procedural elements listed above include publication of the personal data in question as part of the European patent with unitary effect and in the related entries in the European Patent Bulletin and the Register for unitary patent protection, all of which will remain available to the public without limitation in time or content.

C. Exercising data subject rights under the DPR

10. The DPR (Section III) provide data subjects with the specific rights outlined below. They apply only to the extent that they do not conflict with the provisions of the UPR and the RFeesUPP and any provisions applicable under them.

(a) Exercising the right of access

11. The right of access under Article 18 DPR entitles the data subject to obtain from the controller (i.e. the EPO President) confirmation as to whether or not personal data concerning them are being processed and, if so, to access the personal data and be provided with the information listed in Article 18(1) DPR (purpose of processing, categories of data concerned, recipients of data, existence of rights, etc.).

12. Personal data included in a file of a European patent with unitary effect can be accessed by means of public file inspection; personal data in the Register for unitary patent protection can be accessed there. In addition, proprietors can request to inspect the file at any time under Rule 20(1) UPR in conjunction with Article 128(4) EPC.

13. The right of access is subject to limitations where the data concerned are in parts of files which are excluded from file inspection (Rule 20(2)(j) UPR in conjunction with Rule 144 EPC and the related decision of the EPO President).

(b) Exercising the right to rectification

14. The right to rectification under Article 19 DPR entitles the data subject to obtain from the controller (i.e. from the EPO President) correction of inaccurate data and completion of incomplete data.

15. In relation to personal data in files of European patents with unitary effect, as well as in the relevant publications, rectification is subject to the requirements and limitations set out in the applicable provisions of the UPR, including any provisions applicable under them, and in particular:

• Rule 20(2)(h) UPR in conjunction with Rule 139, first sentence, EPC (correction of errors in documents filed with the EPO)
• Rule 20(2)(h) UPR in conjunction with Rule 140 EPC (correction of errors in decisions)

16. A correction or rectification pursuant to these provisions may result in the updating of entries in the Register for unitary patent protection and the European Patent Bulletin and of publications of the European patent with unitary effect. However, it will not retroactively change the content of the file (which will continue to contain all submissions of parties and communications and decisions from the EPO). Nor will it result in the withdrawal or deletion of earlier publications.

(c) Exercising the right to erasure

17. The right to erasure ("right to be forgotten") under Article 20 DPR entitles the data subject to obtain from the controller (i.e. from the EPO President) the erasure of personal data if one of the grounds listed in Article 20(1) DPR applies (e.g. because the personal data are no longer necessary, were unlawfully processed or have to be erased to comply with another legal obligation).

18. The right to erasure is subject to the limitations and requirements set out in the UPR and the RFeesUPP, including any applicable provisions under them, which prevail over the DPR. As regards information published in the European Patent Bulletin, the Official Journal and the Register for unitary patent protection, the EPO is obliged under Rules 15, 16 and 17 UPR to maintain this information, and keep it publicly available, indefinitely. As regards the content of the files, the EPO is obliged to keep it for the period specified in Rule 20(2)(j) UPR in conjunction with Rule 147 EPC.

19. The right to erasure is also subject to the same limitations and requirements as set out above in relation to the right to rectification (see point 16 above) and so applies only to the extent possible under the provisions of the UPR allowing for such modification of data or of documents and databases containing them.

(d) Exercising the right to restriction of processing

20. The right to restriction under Article 21 DPR entitles the data subject to obtain from the controller (i.e. from the EPO President) the restriction of processing of their personal data where one of the grounds listed in Article 21(1) DPR applies (e.g. because the accuracy of the personal data is contested, the processing is unlawful or the personal data are no longer needed).

21. The right to restriction of processing is subject to the limitations and requirements set out in the UPR and the RFeesUPP, including any provisions applicable under them, which prevail over the DPR. The EPO is obliged to perform its tasks under Rule 1 UPR in line with these provisions and is subject only to the limitations and requirements set out there. Thus, the right to restriction of processing applies only to the extent possible under the provisions of the UPR and the RFeesUPP, including any provisions applicable under them, allowing for modification of data or documents and databases containing them.

(e) Exercising the right to object to processing of certain personal data

22. According to Article 23(1) DPR, data subjects have, in principle, the right to object, on grounds relating to their particular situation at any time, to the processing of personal data concerning them which is based on Article 5(a) DPR. If a data subject so objects, the controller (i.e. the EPO President) must cease to process the personal data unless it can be demonstrated that there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject.

23. The right to object is subject to the limitations and requirements set out in the UPR and the RFeesUPP, which prevail over the DPR. The EPO is obliged to perform its tasks under Rule 1 UPR in line with these provisions and is therefore subject only to the limitations and requirements set out there. Compliance with these obligations is a compelling legitimate ground for the processing of personal data which overrides any competing interests, rights and freedoms of the data subject concerned.

(f) Exercising the right to data portability

24. Under Article 22 DPR, data subjects have the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning them which they have provided to the controller. 

25. This right applies only to data provided where the processing is based on the data subject's consent or a contract, and where the processing is carried out by automated means. As personal data processing in proceedings related to European patents with unitary effect is not based on consent or a contract, this right does not apply in this context.

D. Inspection of files

26. Pursuant to Rule 20(1) UPR in conjunction with Article 128(4) EPC, files relating to European patents with unitary effect are open for inspection by third parties via the Register for unitary patent protection, which forms an integral part of the European Patent Register and is available free of charge on the EPO website.10

27. Pursuant to Rule 20(2)(j) UPR in conjunction with Rule 144 EPC and the related decision of the EPO President,11the following documents are excluded from file inspection:

• draft decisions and notices, and all other documents used for the preparation of decisions and notices, which are not communicated to the parties (Rule 20(2)(j) UPR in conjunction with Rule 144(b) EPC)
• the designation of the inventor, if they have waived their right to be mentioned under Rule 20(1) EPC (Rule 20(2)(j) UPR in conjunction with Rule 144(c) EPC)
• any other document, or part of a document, excluded from inspection by the President of the EPO on the ground that its inspection would not serve the purpose of informing the public about the European patent with unitary effect. In particular, the following documents are excluded:
• medical certificates
• documents relating to file-inspection proceedings or the communication of information from the files, and requests for exclusion from inspection
• other documents where it appears or is claimed that their inspection would be prejudicial to the legitimate personal or economic interests of a natural or legal person and their inspection would not serve the purpose of informing the public about the European patent with unitary effect.