T 0119/11 (Compliance monitoring / Yaszistra Fund III) 06-10-2017
Téléchargement et informations complémentaires:
ELECTRONIC RECORD MANAGEMENT SYSTEM
Inventive step - electronic tag for storing email deletion policy (no
Inventive step - implementation of a non-technical requirement)
Summary of Facts and Submissions
I. This appeal is against the Examining Division's decision to refuse European patent application 99955083.3 for lack of inventive step.
II. The Examining Division was of the view that the invention amounted to using technically trivial means to fulfill a business requirement. In particular, the storage of emails in a database and the creation of an electronic tag that uniquely identified a record were regarded as trivial implementation details.
III. With the statement setting out the grounds of appeal, the appellant requested that the decision under appeal be set aside and that a patent be granted on the basis of the main request or, alternatively, of the auxiliary request filed with the statement setting out the grounds of appeal.
IV. The appellant's arguments in the statement of grounds can be summarised as follows.
It was difficult for large organisations to manage email. Individual employees were often left to manage things themselves, which led to inconsistencies that might expose an organisation to legal liabilities. The organisation might face legal problems on the basis of which emails were kept and which had been deleted.
It was no solution simply to keep copies of all emails because, for example, the emails of low-grade employees did not reflect the organisation's official position in the way those of senior management did. On top of that, it might not be feasible to store everything.
According to the invention, an electronic tag was automatically generated. It uniquely identified a particular email and was based on compliance information taken from a user's profile and workstation, as well as on a reference code. Purge characteristics for the email were determined based on the tag and a compliance policy.
The effect was to provide a stable record of the situation at the time an email was sent. This allowed consistency as well as flexibility.
The skilled person could not arrive at the invention by using a conventional database. Simply storing the emails would not suffice, because insufficient information could be derived from the email itself, while looking up the user in a database would only provide her current status rather than her status at the time the email was created.
The objective technical problem was how to automate an email storage and compliance policy.
While a compliance policy per se might be an administrative matter, an aim to be achieved in a non-technical field could appear in the formulation of a technical problem.
The contribution to the prior art lay in the provision of means for generating a electronic tag based on information taken from a user's profile and workstation at the time an email was sent.
The invention defined in claim 1 according to the auxiliary request provided further features that enhanced functionality by monitoring emails and identifying and resolving instances of non-compliance.
V. The Board arranged to hold oral proceedings and set out its provisional view in a communication sent with the summons. In particular, the Board indicated that the claimed invention did not involve an inventive step.
VI. The appellant informed the Board that it did not intend to be represented at oral proceedings, but no comments in respect of the Board's provisional opinion were submitted.
VII. Oral proceedings were held, in the absence of the duly summoned appellant, in accordance with Article 15(3) ROPBA and Rule 115(2) EPC.
VIII. Claim 1 according to the main request reads as follows.
A system for managing electronic email messages for compliance with a compliance policy in a distributed computing environment, the system comprising:
means for recording an electronic email message in a central database, the central database adapted to be accessed by the distributed computing environment;
means for generating an electronic tag that uniquely identifies an individual electronic email message, the electronic tag being generated based on compliance information taken from the user profile and the workstation specification of the user sending the electronic email message, and a reference code;
storage means for storing the electronic tag in the distributed computing environment;
means for sending the electronic email message to a recipient device via the distributed computing environment; and
a policy compliance monitor for extracting the compliance information stored in the electronic tag and determining purge characteristics for the associated electronic email message based on the extracted compliance information and the compliance policy.
IX. Claim 1 according to the auxiliary request further adds the following:
[A system ...
and the compliance policy];
a policy compliance and reporting module for monitoring and recording user and network system activities, audit procedures and reporting, policy violation procedures/investigations/reporting, and compliance/non-compliance status reporting; and
a policy effectiveness module for analysing information collected from the policy compliance and reporting module to determine if network user compliance policies are effective.
Reasons for the Decision
Background
1. The invention is concerned with emails written in the workplace. There may be legal requirements to retain certain emails, just as there may be personal or business interests in deleting them. Other emails should, for a variety of reasons, be deleted after a given period of time. Organisations need to manage the storage of emails to ensure that those that have to be kept are kept, and those that have to be deleted are deleted.
2. As the application puts it, there is a need for an email system to track, sort, index, manage, authenticate, purge and store email messages, with other documents, in a database to insure that the email messages retained in the database may be the email messages an organization chooses to retain as their official records versus unorganized messages that may have the potential to create a liability for the organization (published application, page 2, lines 15 - 19).
3. The invention stores what it calls an electronic tag that uniquely identifies an email (or other document). The tag is based on the user's profile and workstation. Based on the information in the tag, emails are monitored for compliance with the organization's policies.
Inventive step
4. The principles on the basis of which inventive step is to be assessed are well established and set out in section I.D of Case Law of the Boards of Appeal of the European Patent Office, 8th Edition, 2016.
An important factor in the present case is the treatment of technical features that implement some non-technical requirement. The relevant subsection of the Case Law Book is 9.1. The Comvik approach is discussed in subsection 9.1.3.
The main request
5. Claim 1 defines a system that is able to store an email in a database, send the email to a recipient, generate and store an electronic tag, and determine, on the basis of information in the tag, when the email may or should be deleted.
6. The application starts from a workplace email system. It can send and store emails. Emails can be kept or deleted. This is a reasonable starting point for the assessment of inventive step.
7. The invention differs from that starting point in that it provides means (an electronic tag) for storing, for each email, the data relevant to a deletion policy and for extracting that data (a policy compliance monitor) to determine when the email should be deleted. The data is based on information in a user's profile, the workstation used, and a reference code that might be no more than an identifier of a sort of email and of the user (page 10, lines 29 - 32 of the published application).
8. The policies themselves, and in particular the choice of what information (such as a user's job description), are not technical. They are a matter of law or of business or perhaps of personal preferences. Under the Comvik approach, the implementation of such policies can be given to the technically-skilled person as a non-technical requirement.
9. The appellant's argument regarding a stable record of information gathered at the time an email is sent does not reflect the claim, which does not specify any particular time for the creation of the tag or the gathering of information in it. However, even if the argument were accepted, it would not help, because the choice of what information is to be stored is dictated by the non-technical policy.
10. In the Board's view, the requirement given to the technically-skilled person is to provide for the tracking of emails so that they can be linked with the correct deletion policy.
11. To fulfil this requirement, there is no choice but to provide means for identifying which emails belong to which policies. That requires the storage of some data. The system will require some modification to do that, and the technically-skilled person might have to solve some technical problem in making the modifications. The means of storage and monitoring, however, are specified only to the extent that they are able to implement the non-technical requirements. There is no specification of how they are implemented technically. Thus, the modifications necessitated by the invention are just those imposed by the non-technical requirements. The implementation does not solve any technical problem beyond fulfilling the requirement given to the technically-skilled person.
12. As claim 1 does not go beyond the definition of features that are strictly necessary to fulfil a non-technical requirement, the combination of features it defines would have been obvious for the technically-skilled person who has the task of fulfilling it.
13. The main request, therefore, cannot be allowed (Article 56 EPC).
The auxiliary request
14. Claim 1 defines two additional modules. They are a "policy compliance and reporting module" and a "policy effectiveness module". Their purposes are to spot violations of a policy and report on them, and to measure the efficacy of policies.
15. These two modules are defined only in terms of their function in the non-technical compliance scheme. There is no technical definition of how they perform their functions.
16. If an email is deleted in spite of a legal requirement to retain it, that is not a technical matter. If a policy (say) that all emails should be kept for a minimum of six years is effective in ensuring compliance with (say) some legal requirement, that is not a technical matter. The functions of the additional modules are not technical.
17. Given the non-technical requirement of fulfilling those non-technical functions, in addition to those discussed above with regard to the main request, the technically skilled person is obliged, if he is to carry out his task, to provide the features defined in claim 1. The combination of features, therefore, would have been obvious.
18. The auxiliary request, therefore, cannot be allowed.
Order
For these reasons it is decided that:
The appeal is dismissed.