Regulation of the European Parliament and of the Council on geographical indication protection for craft and industrial products and amending Regulations of the European Parliament and of the Council and Council Decision

02 June 2022

Opinion 10/2022

on the Proposal for Regulation on geographical indication protection for craft and industrial products

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725

1

Executive Summary

On 13 April 2022, the European Commission adopted a Proposal for a Regulation on geographical indication protection for craft and industrial products and amending Regulations (EU) 2017/1001 and (EU) 2019/1753 and Council Decision (EU) 2019/1754 (hereafter ‘the Proposal’).

This proposal aims to complement the EU protection system for geographical indications, which already exist for agricultural products and foodstuffs, wines and spirits, and at enabling the effective fulfilment of obligations stemming from the EU accession to the Geneva Act of the Lisbon Agreement.

The EDPS positively notes that the Proposal determines the roles of the Commission, the EUIPO and the competent authorities of Member States with regard to the processing of personal data in the procedures under this Proposal.

The EDPS recommends clarifying whether the different controllers involved in the processing of personal data will act as joint controllers or not. If so, the EDPS recommends to provide for an arrangement as envisaged by Articles 28 EUDPR and/or Article 26 GDPR. In this regard, the EDPS recalls that detailed arrangements to ensure compliance with data protection requirements, where necessary, may also be defined by way of an implementing act.

The EDPS notes that the Proposal foresees the creation of a publicly accessible electronic register of geographical indications for craft and industrial products. In this regard, the EDPS recommends a clear delineation of the categories of data which will be processed. The EDPS recommends to specify in the Proposal itself any categories of personal data involved. Finally, the EDPS considers that the chosen data retention period for the documentation related to the cancellation of geographical indications should be further justified.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 13 April 2022, the European Commission adopted a Proposal for a Regulation on geographical indication protection for craft and industrial products and amending Regulations (EU) 2017/1001 and (EU) 2019/1753 of the European Parliament and of the Council and Council Decision (EU) 2019/1754 ( ‘the Proposal’).

2. The objective of the Proposal is to establish a directly applicable geographical indication (‘GI’) protection for craft and industrial (‘CI’) products at EU level. It also aims to ensure that producers can benefit from the international framework for the registration and protection of GIs ('Lisbon system') .

3. The Proposal complements existing EU protection for GIs in the agricultural domain. It follows similar approaches taken on the eligibility conditions and the protection of GIs for agricultural products and foodstuffs, wines and spirits as set out in: - Regulation (EU) No 1151/2012 of the European Parliament and of the Council on quality schemes for agricultural products and foodstuffs, - Regulation (EU) 2019/787 of the European Parliament and of the Council on the definition, description, presentation and labelling of spirit drinks, and - Regulation (EU) No 1308/2013 of the European Parliament establishing a common organisation of the markets in agricultural products .

4. The Proposal would amend Regulation (EU) 2017/1001 on the European Parliament and of the Council on the European Union trade mark concerning possible conflicts between GIs and trade marks and specify additional tasks for the European Union Intellectual Property Office (‘EUIPO’). It also proposes an amendment to Council Decision (EU) 2019/1754 on the accession of the European Union to the Geneva Act of the Lisbon Agreement on Appellations of Origin and Geographical Indications, in order to establish a connection between the EU GI protection system for CI products and the Lisbon system .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 April 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 63 of the Proposal. The comments and recommendations in this Opinion are limited to the provisions in the Proposal that are most relevant from a data protection perspective.

2. General Comments

6. The establishment of a directly applicable GI protection for CI products at Union level implies the processing of personal data, in particular where it is necessary to identify individuals in the course of the procedures for registration, approval of amendments, cancellation, opposition, granting of transitional periods and control .

7. The registration procedure consists in a ‘two-stage system’, with a first stage at the level of Member States , where national authorities would play a first examination role over agreed product specifications and GI applications. The second stage would be at EU level , with the EUIPO in charge of the Union level registration and acting as competent authority under the Geneva Act.

8. The EDPS welcomes the reference to the right to protection of personal data in Recitals 10 and 11, as well as the need for the Member States to comply with Regulation (EU) 2016/679 (‘GDPR’) , and for the Commission and the EUIPO to comply with the EUDPR.

3. Specific Comments

3.1 Determination of roles and responsibilities

9. The EDPS positively notes that Article 4 of the Proposal determines the roles of the Commission, the EUIPO and the competent authorities of Member States under EU data protection law. Article 4(1) designates the Commission and the EUIPO as ‘controllers’ within the meaning of Article 3(9) of the EUDPR and the competent authorities of Member States as ‘controllers’ within the meaning of Article 4(7) of the GDPR. Each entity shall be considered a controller in relation to the processing of personal data in the procedures for which they would be competent in accordance with the Proposal.

10. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who shall be responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice.

11. In line with Articles 28 EUDPR and 26 GDPR, where two or more controllers together determine the purposes and means of the processing, they shall be joint controllers. This specification makes it clear that the concept of controllership does not necessarily refer to one single entity, but can also involve multiple parties playing a role in a processing operation. As a result, and as confirmed by the CJEU, each of the actors involved have obligations under data protection law . Insofar as the various actors act as joint controllers, they ‘shall in transparent manner determine their respective responsibilities for compliance with their data protection obligations, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information (...)’. In case of joint controllers, the distribution of tasks between them has to be specified by means of an arrangement between them.

12. The EDPS recommends clarifying in the Proposal whether controllers mentioned in Article 4 of the Proposal should be considered as ‘joint controllers’ or not. If so, the EDPS recommends to provide for an arrangement as envisaged by Articles 28 EUDPR and/or Article 26 GDPR. In this regard, the EDPS recalls that detailed arrangements to ensure compliance with data protection requirements, where necessary, may also be defined by way of an implementing act.

13. A further clarification of the roles may be particularly relevant in relation to the ‘direct registration’ procedure foreseen in Article 15 of the Proposal, where applications from a producer group of a Member State for registration, cancellation or amendment of a product specification of a geographical indication can be addressed directly to the EUIPO. In such cases, the Member State may be requested by the EUIPO to provide assistance ‘in particular for the examination process’ .

3.2 The Union register of geographical indications for craft and industrial products

14. The EDPS notes that a publicly accessible electronic Union register of geographical indications for craft and industrial products shall be developed, kept and maintained by the EUIPO. According to the Proposal, the registered name and the class of the product, as well as the reference to the instrument registering the name and the indication of the country or countries of origin shall be registered . The Commission may also adopt implementing acts defining the content and presentation of the register . However, the EDPS recommends to further specify in the Proposal itself the different categories of data that the Union register will contain as well as the purposes for the processing of personal data. Given potential data protection implications, the EDPS recalls the need to be consulted on such implementing acts.

15. Article 26(7) of the Proposal provides for the retention of documentation related to the registration of geographical indications for the period of validity of the geographical indication and, in case of cancellation, for 10 years thereafter. The EDPS recalls that pursuant to storage limitation principle, personal data can be kept ‘for no longer than is necessary for the purposes for which the personal data are processed’. The EDPS considers that a justification is needed to substantiate the proportionality of the chosen retention period, in particular as regards the retention of documentation related to the cancellation of the registration in respect of GIs. Absent further justification, the envisaged retention period of 10 years does not seem to comply with the requirement of storage limitation insofar as the processing of personal data is concerned.

4. Conclusion

16. In light of the above, the EDPS:  welcomes the explicit designation of controllers in relation to the processing of personal data in the procedures laid down by the Proposal;  recommends clarifying whether or not the controllers should be considered as ‘joint controllers’ within the meaning of Articles 28 EUDPR and 26 GDPR;  recommends to specify in the Proposal any categories of data to be included in the Union register of geographical indications for craft and industrial products;  considers that the proposed retention period for documentation related to the cancellation of GIs registration should be further justified or reduced insofar as it concerns personal data. Brussels, 02 June 2022 Wojciech Rafał Wiewiórowski (e-signed) 7