Pages 177-198

XVI. DATA PROTECTION IN APPEAL PROCEEDINGS

XVI.1 - Processing of personal data

Originally published in OJ EPO 2023, A73:

Decision of the President of the Boards of Appeal dated 14 July 2023 concerning the processing of personal data in appeal proceedings before the Boards of Appeal

The President of the Boards of Appeal,

having regard to Article 10(2)(a) of the European Patent Convention (EPC) and to the Act of Delegation (OJ EPO 2018, A63), in particular Article 1 thereof,

having regard to Articles 3(1)(g) and 28(2), first sentence, of the Implementing Rules for Articles 1b and 32a of the Service Regulations for permanent and other employees of the European Patent Office on the Protection of Personal Data (DPR),

considering that the primary object of the appeal proceedings is to review decisions under appeal in a judicial manner,

has decided as follows:

Article 1
Processing of personal data

(1) Personal data are processed by the Boards of Appeal, including the Enlarged Board of Appeal, in the course of appeal proceedings before them in accordance with the EPC, including its Implementing Regulations and any other provisions applicable under it, in particular the Rules of Procedure of the Enlarged Board of Appeal (OJ EPO 2015, A35), the Rules of Procedure of the Boards of Appeal (OJ EPO 2021, A35), the Additional Rules of Procedure of the Disciplinary Board of Appeal (OJ EPO 2007, 536f), as set out in the annex to this decision.

(2) Processing of personal data in accordance with paragraph 1 is necessary for the performance of tasks carried out in the exercise of the official activities of the European Patent Organisation or in the legitimate exercise of the official authority vested in the European Patent Office (EPO) as controller of the personal data it processes and for compliance with a legal obligation to which the EPO is subject.

Article 2
Primacy of application

In case of conflict, the provisions of the EPC, including its Implementing Regulations and any other provisions applicable under it, in particular the Rules of Procedure of the Enlarged Board of Appeal (OJ EPO 2015, A35), the Rules of Procedure of the Boards of Appeal (OJ EPO 2021, A35), the Additional Rules of Procedure of the Disciplinary Board of Appeal (OJ EPO 2007, 536f), along with the provisions of the PCT, including its Regulations and any other provisions and established practices applicable under it, prevail over the DPR.

Article 3
Entry into force

This decision enters into force on 1 August 2023. It applies to any processing of personal data ongoing on or initiated after that date.

Done at Haar, 14 July 2023

Carl JOSEFSSON

President of the Boards of Appeal

Annex

Introduction

1. The Data Protection Rules (DPR) entered into force on 1 January 2022, as the Implementing Rules for Articles 1b and 32a of the Service Regulations for permanent and other employees of the EPO (EPO Service Regulations). When conducting appeal proceedings before the Boards of Appeal pursuant to the EPC and the provisions applicable under it, the Boards of Appeal, including the Enlarged Board of Appeal, process personal data of persons not covered by Article 1 of the EPO Service Regulations (i.e. persons other than EPO employees). According to Article 28(2), first sentence, of the Data Protection Rules, "[t]he President of the Boards of Appeal acts as the controller with regard to the personal data processing operations carried out as part of the judicial activity of the Boards of Appeal (…)".

2. The decision of the President of the European Patent Office dated 13 December 2021 concerning the processing of personal data in patent-grant and related proceedings (OJ EPO 2021, A98) addresses the processing of personal data by the departments specified in Article 15(a) to (e) EPC.

3. Considering the interest of users of the European patent system in having a harmonised data protection framework that applies in all proceedings before the EPO, including appeal proceedings before the Boards of Appeal, the processing of personal data in appeal proceedings before the Boards of Appeal, for the purposes of this decision also comprising proceedings under Article 112 and 112a EPC, as laid down in this annex is aligned with the processing of personal data by the departments specified in Article 15(a) to (e) EPC.

4. Personal data are processed for the purposes of the EPO's task under Article 4(3) EPC of granting European patents, as further specified in the relevant provisions of the EPC and the other provisions applicable under it. In this regard, the Boards of Appeal process personal data to fulfil the primary object of appeal proceedings, i.e. to review the decision under appeal in a judicial manner (Article 12(2) of the Rules of Procedure of the Boards of Appeal, "RPBA"). Where these data are required for proceedings under the EPC, their processing is mandatory (mandatory personal data).

5. Mandatory personal data include, in particular, the personal data which must be published in the European Patent Register under Rule 143 EPC and the applicable decision of the President of the EPO,1 namely personal data of individuals involved in proceedings, such as applicants and proprietors and their representatives, inventors, opponents and their representatives, persons requesting limitation or revocation and petitioners for review.

6. Personal data are processed in the proceedings where, and to the extent that, this processing is:

• necessary for the performance of a task carried out in the exercise of the official activities of the EPO or in the legitimate exercise of the official authority vested in the President of the Boards of Appeal, which includes the processing necessary for the EPO's management and functioning (Article 5(a) DPR)
• necessary for compliance with a legal obligation to which the EPO is subject (Article 5(b) DPR).

7. Personal data are processed for the following purposes:

• conducting the proceedings in appeals from decisions of the Receiving Section, the examining divisions and opposition divisions, and the Legal Division
• conducting the proceedings in appeals against final decisions, including dismissals, of the Disciplinary Committee of the Institute and the Disciplinary Board of the EPO
• conducting all proceedings before the Enlarged Board of Appeal
• communicating with parties to the proceedings and, where applicable, third parties
• communicating with courts and other competent authorities from the EPC Contracting States on requests for acceleration of appeal proceedings
• drawing up reports and statistics.

A. Procedures and procedural phases in appeal proceedings before the Boards of Appeal

8. The main and ancillary procedures before the Boards of Appeal include:

• appeals from decisions of the Receiving Section, the examining divisions and opposition divisions, and the Legal Division (Article 106 et seq. EPC)
• appeals against final decisions, including dismissals, of the Disciplinary Committee of the Institute and the Disciplinary Board of the EPO (in particular Article 22(1) of the Regulation on discipline for professional representatives)
• proceedings concerning referrals (proceedings under Article 112 EPC)
• proceedings concerning petitions for review (proceedings under Article 112a EPC).

9. The following may occur in, or as part of, the proceedings before the Boards of Appeal listed above:

• filing of third-party observations (Article 115 EPC)
• submission of prior art (cf. Article 54 EPC)
• submission of evidence (cf. Article 117 EPC)
• filing and notification by electronic means of communication (Rules 2 and 127 EPC)
• correction of errors (Rule 139 EPC)
• fee payment (Article 6 RFees, Arrangements for deposit accounts)
• oral proceedings, including by videoconference (Article 116 EPC, Article 14 of the Rules of Procedure of the Enlarged Board of Appeal (RPEBA), Articles 15 and 15a of the RPBA and Article 13 of the Regulation on discipline for professional representatives)
• stay of proceedings (Articles 61(1)(a) and 99(4), Rules 14 et seq., 78 EPC)
• request for re-establishment of rights (Article 122 EPC)
• interruption and resumption of proceedings (Rule 142 EPC)

B. Personal data processed in appeal proceedings before the Boards of Appeal

10. In addition to the personal data already processed before the filing of an appeal,2 the following personal data of persons covered by Article 2(3) DPR are processed by the Boards of Appeal in appeal proceedings:

(a) Appeals from decisions of the Receiving Section, the examining divisions and opposition divisions, and the Legal Division

• appellant's name and address (Rule 99(1)(a) together with Rule 41(2)(c) EPC)
• appellant's fax and telephone numbers, email address and reference, where provided (Rule 99(3) together with Rule 41(2)(c) EPC)
• where applicable, the name and address of other parties to appeal proceedings (Rule 99(3) in conjunction with Rule 41(2)(c), Rule 76(2)(a) and Rule 100(1) EPC)
• where applicable and provided, the fax and telephone numbers, email address and reference of other parties to appeal proceedings (Rule 99(3) in conjunction with Rule 41(2)(c), Rule 76(2)(a) and Rule 100(1) EPC)
• where applicable, the names of any professional representatives of parties to the appeal proceedings, as well as of any employee under Article 133(3) EPC, address of their place of business (Rule 99(3) together with Rule 41(2)(d) EPC) and, where provided, their reference, representative number, association number, fax and telephone numbers and email addresses
• name of the person making a payment as well as personal data relating to deposit accounts or other payment means (bank accounts, credit cards, etc.) (Article 6(1) RFees, Article 5(2) RFees together with the Arrangements for deposit accounts)
• where applicable, any personal data processed in relation to any third-party observations
• signatures (Rule 99(3) together with Rule 50(3) EPC)
• any other personal data provided by a party during the proceedings, including personal data submitted in the context of:

(i) Stay, interruption and resumption of proceedings

• if proceedings are stayed (Rules 14 and 78 EPC): name and address of the person requesting the stay and, where provided, their fax and telephone numbers, email address and reference, as well as any other personal data provided by a party during the proceedings
• if a decision is required on whether to interrupt proceedings under Rule 142(1) EPC, personal data which may justify the interruption, including health-related data of a party or their representative
• if proceedings are resumed pursuant to Rule 142(2) EPC: name and address of person authorised to continue the proceedings and, where provided, their fax and telephone numbers, email address and reference, as well as any other personal data provided by a party in the course of the proceedings

(ii) Requests for the correction of errors in documents filed with the EPO

• any personal data in the document to be corrected (such as name, address, nationality, country and place of residence) (Rule 139 EPC)

(iii) Third-party observations

• any personal data provided by a third party when filing observations (Article 115 EPC) (in particular, name, address, telephone and fax numbers, email addresses and references)

(iv) Request for re-establishment of rights (Article 122 EPC)

• any personal data provided by the requester in the submission of facts and evidence (in particular, name, employment relationship, professional background and specific contacts of persons concerned, and situations in which they had been involved)

(v) Evidence

• name, gender, address, date and place of birth of parties, witnesses and experts nominated to give oral testimony and any other personal data needed to establish their identity (Article 117 and Rule 117 et seq. EPC)
• employment relationship, professional background and specific contacts of, or actions taken by, parties, witnesses and experts nominated to give oral testimony, any other personal data relating to situations in which they had been involved, and any further details of the subject-matter of the evidence (Article 117 and Rule 117 et seq. EPC)
• name, address, date and place of birth, employment relationship, professional background and specific contacts of, or actions taken by, the person giving oral testimony or third persons (for example, court-appointed liquidators, spouses, legal guardians, heirs, physicians), and situations in which those persons had been involved
• any other personal details contained in written evidence, declarations and other documents provided by a party or identified by the EPO or in written, audio, video, multimedia and other disclosures (Article 117 EPC)

(vi) Prior art

(acquired and stored by the EPO for use in the patent-grant and related proceedings or filed by a party or third party)

• any type of personal data contained in any written, audio, video, multimedia and other prior-art disclosures, in particular authors' names, affiliations, email addresses, images, audio and voice recordings of individuals (Article 54 EPC)

(vii) Use of IT tools and services

• for filing, payment and notification tools and any other services for the exchange of information (Rules 2, 127 EPC, Article 5(2) RFees together with the Arrangements for deposit accounts): connection and identification data of professional representatives, legal practitioners, individual applicants, proprietors or opponents, and employees acting on their behalf, as well as third parties under Article 115 EPC
• potentially for access to the European Patent Register, whether for the purposes of file inspection or otherwise: connection and identification data of any party or third party

(viii) Oral proceedings

• for public oral proceedings held on the premises of the EPO: name of any person attending who is not a party to the proceedings and not affiliated with such a party (Article 116 EPC)
• for oral proceedings held by videoconference or where a party, representative or accompanying person is allowed to attend by videoconference:
• name, email address and connection details (including IP addresses) of all participants and attendees (Article 116 EPC, Article 15a RPBA and related decisions of the President of the EPO)
• any personal data processed in the platform used by the EPO to conduct the oral proceedings (Article 116 EPC, Article 15a RPBA and related decisions of the President of the EPO)
• personal data submitted in the context of a request for change of the date fixed for oral proceedings (Article 15(2)(b) RPBA)

(ix) File inspection

• for online inspection: IP addresses of persons inspecting the file, in accordance with the privacy policy for users of the EPO website and the European Patent Register service available on that website (Article 128 EPC and the related decision of the President of the EPO)
• for inspection of paper copies and inspection on the premises: name and address (and, where provided, telephone and fax number, email address and reference) of the person inspecting the file (Article 128 EPC and the related decision of the President of the EPO)
• any kind of personal data contained in the documents constituting the file and in the related entries made in the European Patent Register and published in the European Patent Bulletin (Article 128 EPC)

(b) Proceedings under Article 112 EPC

• where applicable, appellant's name and address (Rule 99(1)(a) together with Rule 41(2)(c) EPC)
• where applicable, appellant's fax and telephone numbers, email address and reference, where provided
• where applicable, the name and address of other parties to appeal proceedings
• where applicable and provided, the fax and telephone numbers, email address and reference of other parties to appeal proceedings
• where applicable, the names of any professional representatives of parties to the appeal proceedings, as well as of any employee under Article 133(3) EPC, address of their place of business (Rule 99(3) together with Rule 41(2)(d) EPC) and, where provided, representative number, association number, fax and telephone numbers, email addresses and reference
• signatures (Rule 99(3) together with Rule 50(3) EPC)
• where applicable, any personal data processed in relation to any third-party observations
• any other personal data provided by a party during the proceedings, including personal data submitted in the context of:

(i) Oral proceedings

• for public oral proceedings held on the premises of the EPO: name of any person attending who is not a party to the proceedings and not affiliated with such a party (Article 116 EPC)
• for oral proceedings held by videoconference or where a party, representative or accompanying person is allowed to attend by videoconference:
• name, email address and connection details (including IP addresses) of all participants and attendees (Article 116 EPC and related decisions of the President of the EPO)
• any personal data processed in the platform used by the EPO to conduct the oral proceedings
• personal data submitted in the context of a request for change of the date fixed for oral proceedings (Article 14(3) RPEBA) or

(ii) Requests for the correction of errors in documents filed with the EPO

• any personal data in the document to be corrected (such as name, address, nationality, country and place of residence) (Rule 139 EPC)

(iii) Third-party observations

• any personal data provided by a third party when filing observations (Article 115 EPC) (in particular, name, address, telephone and fax numbers, email addresses and references)

(iv) Evidence

• name, gender, address, date and place of birth of parties, witnesses and experts nominated to give oral testimony and any other personal data needed to establish their identity (Article 117 and Rule 117 et seq. EPC)
• employment relationship, professional background and specific contacts of, or actions taken by, parties, witnesses and experts nominated to give oral testimony, any other personal data relating to situations in which those persons have been involved, and any further details of the subject-matter of the evidence (Article 117 and Rule 117 et seq. EPC)
• name, address, date and place of birth, employment relationship, professional background and specific contacts of, or actions taken by, the person giving oral testimony or third persons (for example, court-appointed liquidators, spouses, legal guardians, heirs, physicians), and situations in which those persons had been involved
• any other personal details contained in written evidence, declarations and other documents provided by a party or identified by the EPO or in written, audio, video, multimedia and other disclosures (Article 117 EPC)

(v) Use of IT tools and services

• for filing, payment and notification tools and any other services for the exchange of information (Rules 2, 127 EPC, Article 5(2) RFees together with the Arrangements for deposit accounts): connection and identification data of professional representatives, legal practitioners, individual applicants, proprietors or opponents, and employees acting on their behalf, as well as third parties under Article 115 EPC

(vi) File inspection (concerning cases under Article 112(1)(a) EPC)

• for online inspection: IP addresses of persons inspecting the file, in accordance with the privacy policy for users of the EPO website and the European Patent Register service available on that website (Article 128 EPC and the related decision of the President of the EPO)
• for inspection of paper copies and inspection on the premises: name and address (and, where provided, telephone and fax number, email address and reference) of the person inspecting the file (Article 128 EPC and the related decision of the President of the EPO)
• any kind of personal data contained in the documents constituting the file and in the related entries made in the European Patent Register and published in the European Patent Bulletin (Article 128 EPC)

(c) Proceedings under Article 112a EPC

• petitioner's name and address (Rule 107(1)(a) together with Rule 41(2)(c) EPC)
• petitioner 's fax and telephone numbers, email address and reference, where provided (Rule 107(3) together with Rule 41(2)(c) EPC)
• where applicable, the name and address of other parties to the proceedings
• where applicable and provided, the fax and telephone numbers, email address and reference of other parties to the proceedings
• the names of any professional representatives of parties to the proceedings, as well as of any employee under Article 133(3) EPC, address of their place of business (Rule 107(3) together with Rule 41(2)(d) EPC) and, where provided, representative number, association number, fax and telephone numbers, email addresses and references
• name of the person making a payment as well as personal data relating to deposit accounts held with the EPO or other payment means (bank accounts, credit cards, etc.) (Article 6(1) RFees, Article 5(2) RFees together with the Arrangements for deposit accounts)
• signatures (Rule 107(3) together with Rule 50(3) EPC)
• where applicable, any personal data processed in relation to any third-party observations
• any other personal data provided by a party during the proceedings, including personal data submitted in the context of:

(i) Requests for the correction of errors in documents filed with the EPO

• any personal data in the document to be corrected (such as name, address, nationality, country and place of residence) (Rule 139 EPC)

(ii) Third-party observations

• any personal data provided by a third party when filing observations (Article 115 EPC) (in particular, name, address, telephone and fax numbers, email addresses and references)

(iii) Request for re-establishment of rights (Article 122 EPC)

• any personal data provided by the requester in the submission of facts and evidence (in particular, name, employment relationship, professional background and specific contacts of persons concerned, and situations in which they had been involved)

(iv) Evidence

• name, gender, address, date and place of birth of parties, witnesses and experts nominated to give oral testimony and any other personal data needed to establish their identity (Article 117 and Rule 117 et seq. EPC)
• employment relationship, professional background and specific contacts of, or actions taken by, parties, witnesses and experts nominated to give oral testimony, any other personal data relating to situations in which they had been involved, and any further details of the subject-matter of the evidence (Article 117 and Rule 117 et seq. EPC)
• name, address, date and place of birth, employment relationship, professional background and specific contacts of, or actions taken by, the person giving oral testimony or third persons (for example, court-appointed liquidators, spouses, legal guardians, heirs, physicians), and situations in which those persons had been involved
• any other personal details contained in written evidence, declarations and other documents provided by a party or identified by the EPO or in written, audio, video, multimedia and other disclosures (Article 117 EPC)

(v) Use of IT tools and services

• for filing, payment and notification tools and any other services for the exchange of information (Rules 2, 127 EPC, Article 5(2) RFees together with the Arrangements for deposit accounts): connection and identification data of professional representatives, legal practitioners, individual applicants, proprietors or opponents, and employees acting on their behalf, as well as third parties under Article 115 EPC
• potentially for access to the European Patent Register, whether for the purposes of file inspection or otherwise: connection and identification data of any party or third party

(vi) Oral proceedings

• for public oral proceedings held on the premises of the EPO: name of any person attending who is not a party to the proceedings and not affiliated with such a party (Article 116 EPC)
• for oral proceedings held by videoconference or where a party, representative or accompanying person is allowed to attend by videoconference:
• name, email address and connection details (including IP addresses) of all participants and attendees (Article 116 EPC and related decisions of the President of the EPO)
• any personal data processed in the platform used by the EPO to conduct the oral proceedings (Article 116 EPC and related decisions of the President of the EPO)
• personal data submitted in the context of a request for change of the date fixed for oral proceedings (Article 14(3) RPEBA)

(vii) File inspection

• for online inspection: IP addresses of persons inspecting the file, in accordance with the privacy policy for users of the EPO website and the European Patent Register service available on that website (Article 128 EPC and the related decision of the President of the EPO)
• for inspection of paper copies and inspection on the premises: name and address (and, where provided, telephone and fax number, email address and reference) of the person inspecting the file (Article 128 EPC and the related decision of the President of the EPO)
• any kind of personal data contained in the documents constituting the file and in the related entries made in the European Patent Register and published in the European Patent Bulletin (Article 128 EPC)

(d) Appeals against final decisions, including dismissals, of the Disciplinary Committee of the Institute and the Disciplinary Board of the EPO (in particular Article 22(1) of the Regulation on discipline for professional representatives)

• in relation to professional representatives: gender, name, date of birth, nationality, copy of passport/ID card, address (place of business or employment), year of passing the European qualifying examination (EQE), signature, telephone number, email address, fax number, URL address, preferred language, date of entry or re-entry on the list of professional representatives before the EPO or date of deletion from that list and legal reference to such events, role, action date, type of change, representative number (Article 134, Rule 154 EPC)
• in the case of disciplinary proceedings against professional representatives: gender, name, address and email address of claimants and respondents and their respective representatives, as well as claims and related correspondence and documentation necessary for the handling of the proceedings
• in relation to legal practitioners: gender, name, address (place of business or employment), signature, telephone number, email address, fax numbers, URL address, preferred language, date of entry or re-entry on the list of professional representatives before the EPO or deletion from that list and legal reference to such events, role, action date, type of change, former ID (Article 134(8) EPC)
• in relation to associations of representatives: name, representative number, address (place of business or employment), signature, date of registration as a member of an association or date of deletion of such a registration (Article 134(1), Rule 152(11) EPC)
• in relation to general authorisations: name, address, role and signature of the person issuing the authorisation and name, address, level of rights and role of the authorised person (Article 133, Rules 151, 152 EPC)

11. Where necessary, the procedures and procedural elements listed above include publication of the personal data in question as part of the patent application and, if granted, of the patent specification and in the related entries in the European Patent Bulletin and the European Patent Register, all of which will remain available to the public without limitation in time or content.

C. Exercising data subject rights under the DPR

12. The DPR provide data subjects with specific rights in section III. As with all secondary legislation adopted by the Administrative Council in accordance with its powers under Article 33(2) EPC, the DPR are subject to the provisions of the EPC, including its Implementing Regulations, which form an integral part of the EPC under Article 164(1) EPC. Accordingly, any data subject rights under the DPR apply only to the extent that they do not conflict with the provisions of the EPC, its Implementing Regulations and any other provisions applicable under it and, where applicable, with the PCT and its Regulations.

(a) Exercising the right of access

13. The right of access under Article 18 DPR entitles the data subject to obtain from the controller (i.e. from the President of the Boards of Appeal) confirmation as to whether or not personal data concerning them are being processed and, if so, to access the personal data and be provided with the information listed in Article 18(1) DPR (purpose of processing, categories of data concerned, recipients of data, existence of rights, etc.).

14. Personal data included in the file of a European patent application or a granted European patent can be accessed by means of public file inspection; personal data in the European Patent Register can be accessed in the Register. In addition, applicants can inspect their own files at any time under Article 128(1) EPC.

15. The right of access is subject to limitations where:

• the data concerned are in files relating to applications which have not yet been published, unless the applicants have expressly consented to access (Article 128(1) EPC)
• the data concerned are in parts of files which are excluded from file inspection (Rule 144 EPC and the related decision of the EPO President)

16. Since access to PCT files is regulated by PCT and EPC provisions, which prevail over the DPR, the right of access under Article 18 DPR applies only subject to the limitations set by those provisions.

(b) Exercising the right to rectification

17. The right to rectification under Article 19 DPR entitles the data subject to obtain from the controller (i.e. from the President of the Boards of Appeal) correction of inaccurate data and completion of incomplete data.

18. In relation to personal data in files of applications and granted patents, as well as in the relevant publications, rectification is subject to the requirements and limitations set out in the applicable provisions of the EPC, such as, in particular:

• Rule 139 (correction of errors in documents filed with the EPO)
• Rule 140 (correction of errors in decisions)
• Article 14(2), second sentence (correction of translations)
• Rule 21 (rectification of inventor designation)
• Article 61 and Rules 14 to 18 (applications filed by non-entitled persons).

19. A correction or rectification pursuant to these provisions may result in the updating of entries in the European Patent Register and the European Patent Bulletin and of publications of the application or patent. However, it will not retroactively change the content of the file (which will continue to contain all submissions of parties and communications and decisions from the EPO). Nor will it result in the withdrawal or deletion of earlier publications.

20. Rectifications, amendments and changes of data contained in international applications are governed by the PCT legal framework (Articles 19 and 34 PCT, Rules 66, 91, 26, 20.5, 20.5bis and 92bis PCT). Therefore, any right under the DPR to change personal data in international applications applies only subject to the limitations and requirements set by that framework.

(c) Exercising the right to erasure

21. The right to erasure ("right to be forgotten") under Article 20 DPR entitles the data subject to obtain from the controller (i.e. from the President of the Boards of Appeal) the erasure of personal data if one of the grounds listed in Article 20(1) DPR applies (e.g. because the personal data are no longer necessary, were unlawfully processed or have to be erased to comply with another legal obligation).

22. The right to erasure is subject to the limitations and requirements set out in the EPC, which prevails over the DPR. As regards published patent applications and patents and information published in the European Patent Bulletin, the Official Journal and the European Patent Register, the EPO is obliged under Articles 93, 98, 127, 129 EPC to maintain this information, and keep it publicly available, indefinitely. As regards the content of files, the EPO is obliged to keep it for the period specified in Rule 147(4) and (5) EPC.

23. The right to erasure is also subject to the same limitations and requirements as set out above in relation to the right to rectification (see points 19 and 20) and so applies only to the extent possible under the provisions of the EPC allowing for such modification of data or of documents and databases containing data.

(d) Exercising the right to restriction of processing

24. The right to restriction under Article 21 DPR entitles the data subject to obtain from the controller (i.e. from the President of the Boards of Appeal) the restriction of processing of their personal data where one of the grounds listed in Article 21(1) DPR applies (e.g. because the accuracy of the personal data is contested, the processing is unlawful or the personal data are no longer needed).

25. The right to restriction of processing is subject to the limitations and requirements set out in the EPC, which prevails over the DPR. The EPO – including the Boards of Appeal – is obliged to perform its tasks on patent-grant and related proceedings under Article 4(3) EPC in line with the provisions of the EPC and its secondary legislation, and subject only to the limitations and requirements set out there. Thus, as set out above in relation to the right to rectification, the right to restriction of processing applies only to the extent possible under the provisions of the EPC allowing for modification of data or of documents and databases containing data.

(e) Exercising the right to object to processing certain personal data

26. According to Article 23(1) DPR, data subjects have, in principle, the right to object, on grounds relating to their particular situation at any time, to the processing of personal data concerning them, which is based on Article 5(a) DPR. If a data subject so objects, the controller (i.e. the EPO) must cease to process the personal data unless it can be demonstrated that there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject.

27. The right to object to processing is subject to the limitations and requirements set out in the EPC, which prevails over the DPR. The EPO – including the Boards of Appeal – is obliged to perform its tasks on patent-grant and related proceedings under Article 4(3) EPC in line with the provisions of the EPC and its secondary legislation, and subject only to the limitations and requirements set out there. Compliance with these EPC provisions is a compelling legitimate ground for the processing of personal data which overrides any competing interests, rights and freedoms of the data subject concerned.

(f) The right to data portability

28. Under Article 22 DPR, data subjects have the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning them which they have provided to the controller.

29. This right applies only to data provided where the processing is based on the data subject's consent or a contract, and where the processing is carried out by automated means. As personal data processing in the patent-grant and related proceedings is generally not based on consent3 or a contract, this right does not apply in that context.

D. Inspection of files

30. Pursuant to Article 128(4) EPC, files relating to published European patent applications and European patents granted in respect of those applications are open for inspection by third parties via the European Patent Register, which is available free of charge on the EPO website (see Article 1 of the decision of the President of the EPO dated 20 February 2019, OJ EPO 2019, A16).

31. Pursuant to Rule 144 EPC and the related decision of the President of the EPO (dated 12 July 2007, Special edition No. 3, OJ EPO 2007, 125), the following documents relating to the patent-grant and related proceedings are excluded from file inspection:

• the documents relating to the exclusion of or objections to members of the Boards of Appeal or of the Enlarged Board of Appeal (Rule 144(a) EPC)
• draft decisions and notices, and all other documents used for the preparation of decisions and opinions which are not communicated to the parties (Rule 144(b) EPC)
• the designation of the inventor if the inventor has waived the right to be mentioned as such under Rule 20(1) (Rule 144(c) EPC)
• any other document, or part of a document, excluded from inspection on the ground that its inspection would not serve the purpose of informing the public about the European patent application or the resulting patent, in particular
• medical certificates
• documents relating to the issue of priority documents, file-inspection proceedings or the communication of information from the files, and requests for exclusion from inspection
• other documents where it appears or is claimed that their inspection would be prejudicial to the legitimate personal or economic interests of a natural or legal person and their inspection would not serve the purpose of informing the public about the application or resulting patent.