ADMINISTRATIVE COUNCIL
Decision of the Administrative Council of 11 December 2024 laying down an independent oversight mechanism for the processing of personal data by the Boards of Appeal in their judicial capacity (CA/D 19/24)
THE ADMINISTRATIVE COUNCIL OF THE EUROPEAN PATENT ORGANISATION,
Having regard to the European Patent Convention and in particular Article 23, paragraph 3, thereof,
Having regard to the Implementing Regulations to the European Patent Convention and in particular Rule 12a(2) thereof,
Having regard to decision CA/D 5/21 introducing a new data protection framework at the European Patent Office, and in particular Article 32a, paragraph 7, of the Service Regulations for permanent and other employees of the European Patent Office (hereinafter referred to as "Service Regulations") and Article 2, paragraph 6, of the Implementing Rules for Articles 1b and 32a Service Regulations (hereinafter referred to as "Data Protection Rules"),
Considering that the present decision shall apply only to the processing of personal data by the Boards of Appeal in their judicial capacity,
On a proposal from the President of the Boards of Appeal, submitted after consulting the Presidium of the Boards of Appeal and the Boards of Appeal Committee,
HAS DECIDED AS FOLLOWS:
Article 1
General provisions
1. An independent oversight mechanism for the processing of personal data by the Boards of Appeal acting in their judicial capacity is established.
2. Where the Boards of Appeal act in their judicial capacity, the mechanism laid down in the present decision applies instead of Articles 49 to 52 Data Protection Rules. In the application of this mechanism, references in the Data Protection Rules to the application of Articles 49 to 52 thereof shall be interpreted as referring, where possible, to the application of the corresponding provisions laid down in the present decision.
3. In case of conflict, the provisions of the EPC, including its Implementing Regulations and any other provisions applicable under it, in particular the Rules of Procedure of the Enlarged Board of Appeal (OJ EPO 2015, A35), the Rules of Procedure of the Boards of Appeal (OJ EPO 2024, A15), the Additional Rules of Procedure of the Disciplinary Board of Appeal (OJ EPO 2007, 548f), and the provisions of the PCT, including its Regulations and any other provisions, prevail over the present decision and the Data Protection Rules.
4. The independent oversight mechanism is applicable to requests concerning pending appeals before the Boards of Appeal only to the extent that the provisions of the EPC as referred to in paragraph 3 do not provide a legal basis for such requests. Decisions taken under the independent oversight mechanism, in accordance with the fundamental principle of judicial independence, shall not interfere with decisions taken by boards of appeal under the provisions of the EPC.
5. All terms and pronouns referring to persons in this decision apply irrespective of gender.
Article 2
Request for review
1. Data subjects who consider that the processing of their personal data by the Boards of Appeal in their judicial capacity infringes their rights as a data subject under the Data Protection Rules may request that the Data Protection Co-ordinator of the Boards of Appeal review the matter and take a decision. The request shall be submitted no later than three months from the day on which the data subject was informed or otherwise became aware of the processing of personal data allegedly infringing their rights.
2. When examining a request filed by a data subject, the Data Protection Co-ordinator of the Boards of Appeal shall, where appropriate, invite the deciding board to set out in writing their position on the claims and facts at issue and to provide evidence or comments and arguments on evidence already at hand.
3. The Data Protection Co-ordinator of the Boards of Appeal may consult the support services of the Boards of Appeal and the Data Protection Officer before taking a decision.
4. The decision under paragraph 1 above shall be taken within one month of receipt of the request, and communicated to the data subject in writing, indicating the means of redress provided for in Article 3. This time limit may be extended by two months where necessary, taking into account the complexity and number of the requests. If an extension of the standard time limit is required, the Data Protection Co-ordinator of the Boards of Appeal shall duly notify the data subject of this and the reasons for the delay within one month of receipt of the request for review. If the Data Protection Co-ordinator of the Boards of Appeal fails to take any action by the end of a period of three months, this will be deemed an implicit rejection of the request.
5. A decision or implicit rejection by the Data Protection Co-ordinator of the Boards of Appeal under this article is a condition for filing a complaint with the controller under Article 3.
6. Where appropriate, the deciding board shall be notified of any decision on the request for review by the Data Protection Co-ordinator of the Boards of Appeal.
7. The Data Protection Co-ordinator of the Boards of Appeal shall be appointed by the President of the Boards of Appeal from among the staff members of the support services of the Boards of Appeal. The decision appointing them may also further specify their tasks.
Article 3
Complaint to the controller
1. Data subjects may challenge the decision taken under Article 2, paragraph 1, by filing a complaint with the controller within three months of receipt of the decision in accordance with Article 2, paragraph 4, or, in the case of an implicit rejection, of the date of expiry of the time limit for deciding on the request for review.
2. When examining a complaint filed by a data subject, the controller shall invite the data subject, the Data Protection Co-ordinator of the Boards of Appeal and, where appropriate, the deciding board to set out in writing their position on the claims and facts at issue and to provide evidence or comments and arguments on evidence already at hand.
3. Before taking a decision, the controller may consult the support services of the Boards of Appeal and the Data Protection Officer.
4. After examining the complaint, the evidence and any relevant additional written input, the controller shall issue a reasoned decision on the complaint. If the controller finds that the processing of the data subject's personal data by the Boards of Appeal in their judicial capacity was unlawful, they may decide that compensation for material and/or non-material damage be awarded.
5. The data subject, the Data Protection Co-ordinator of the Boards of Appeal and, where appropriate, the deciding board shall be notified of any decision taken by the controller on the complaint.
6. A copy of the decision of the controller shall be provided to the President of the Office and to the Data Protection Officer.
Article 4
Appeal to the Board of Appeal for the judicial processing of personal data
1. Data subjects may challenge the decision taken under Article 3 by filing an appeal with the Board of Appeal for the judicial processing of personal data within three months of receipt of the decision notified in accordance with Article 3, paragraph 5.
2. The members of the Legal Board of Appeal shall be internal members of the Board of Appeal for the judicial processing of personal data. The Chair of the Legal Board of Appeal shall chair the Board of Appeal for the judicial processing of personal data.
3. The Administrative Council, after consulting the President of the Boards of Appeal, may also appoint external members to the Board of Appeal for the judicial processing of personal data. External members shall be legally qualified members of the national courts or quasi-judicial authorities of the Contracting States, who may continue their judicial activities at the national level. They shall be appointed for a term of three years and may be re-appointed. The Regulation on the appointment and conditions of employment of members of the Enlarged Board of Appeal appointed under Article 11, paragraph 5, of the European Patent Convention shall apply, mutatis mutandis, to external members of the Board of Appeal for the judicial processing of personal data. Privileges and immunities granted to members of the Enlarged Board of Appeal appointed under Article 11, paragraph 5, EPC shall apply, mutatis mutandis, to external members of the Board of Appeal for the judicial processing of personal data.
4. The Board of Appeal for the judicial processing of personal data shall consist of three members in a particular appeal.
5. Article 24 EPC shall apply mutatis mutandis to proceedings before the Board of Appeal for the judicial processing of personal data. Members, including the Chair, who were directly involved in the data processing operation deemed to infringe the data subject's rights under the Data Protection Rules may not take part in the ensuing proceedings before the Board of Appeal for the judicial processing of personal data.
6. In the absence of a business distribution scheme for the Board of Appeal for the judicial processing of personal data, the business distribution scheme of the Legal Board of Appeal shall apply mutatis mutandis to the Board of Appeal for the judicial processing of personal data. The Presidium of the Boards of Appeal in its composition in accordance with Rule 12b, paragraph 4, EPC may adopt a business distribution scheme for the Board of Appeal for the judicial processing of personal data.
7. In their decisions the members of the Board of Appeal for the judicial processing of personal data shall not be bound by any instructions.
Article 5
Procedure before the Board of Appeal for the judicial processing of personal data
1. The procedure before the Board of Appeal for the judicial processing of personal data shall be a written procedure, unless the board considers oral proceedings to be expedient.
2. The appeal shall contain the data subject's complete case and set out all the facts, arguments, and evidence relied on for setting aside or amending the decision in accordance with Article 3.
3. The controller shall receive a copy of the appeal and shall have the opportunity to comment on it within a period of one month. Exceptionally, at the request of the controller, this period may be extended by up to two months.
4. The Board of Appeal for the judicial processing of personal data may exercise any power within the competence of the controller under Article 3.
5. The proceedings before the Board of Appeal for the judicial processing of personal data will not be public, unless it decides otherwise for parts of, or the entire proceedings.
6. Any decision by the Board of Appeal for the judicial processing of personal data on the appeal shall be final.
7. The data subject, the Data Protection Co-ordinator of the Boards of Appeal, the President of the Boards of Appeal and, where appropriate, the deciding board shall be notified of any decision by the Board of Appeal for the judicial processing of personal data on the appeal.
8. The Board of Appeal for the judicial processing of personal data shall provide a copy of its final decision to the President of the Office and to the Data Protection Officer. An anonymised version of the final decision will be published, unless the Board of Appeal for the judicial processing of personal data decides otherwise.
Article 6
Rules of Procedure of the Board of Appeal for the judicial processing of personal data
The procedure laid down in Rule 12c, paragraph 2, EPC, shall apply mutatis mutandis to the adoption of the Rules of Procedure of the Board of Appeal for the judicial processing of personal data. These Rules of Procedure shall be subject to the approval of the Administrative Council.
Article 7
Entry into force
This decision shall enter into force on 1 March 2025. Provision is made for a transitional period of six months from the entry into force of this decision. During this period, the data protection documentation whose implementation is contingent on the scope of the independent oversight mechanism will be finalised.
Done at Munich, 11 December 2024
For the Administrative Council
The Chairperson
Josef KRATOCHVÍL