Community trade mark

Opinion of the European Data Protection Supervisor

on the Proposal for a Directive of the European Parliament and of the Council to approximate the laws of the Member States relating to trade marks (recast) and the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 207/2009 on the Community trade mark

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such 2 data , and in particular Article 28(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION 1.1. Consultation of the EDPS

1. On 27 March 2013, the Commission adopted two legislative Proposals in the field of trade marks: a Proposal for a Directive of the European Parliament and of the Council to approximate the laws of the Member States relating to trade marks (recast) and a Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 207/2009 on the Community trade mark (hereafter jointly referred to as 'the Proposals'). These Proposals were transmitted to the EDPS on that same day.

2. The EDPS takes note that the main aim of these Proposals is to harmonise further all aspects of substantive trade mark law as well as procedural rules within the EU. Although at first sight it may seem that these Proposals do not carry any substantial consequences for data protection, he however notes that both instruments establish a few processing operations, which may have an impact on individuals' right to privacy and data protection. The EDPS therefore regrets that he was not consulted informally prior to the adoption of these Proposals.

3. Pursuant to Article 28(2) of Regulation (EC) No 45/2001, the EDPS wishes to highlight below a few specific issues that the Proposals raise from a data protection perspective. The EDPS recommends that a reference be made in the preamble of the Proposals to the consultation of the EDPS. 1.2. General background

4. The Proposed Directive aims at harmonising further within the EU substantive rules relating to trade marks -including clarifications on the rights conferred by a trade mark and the rules applicable to collective marks- as well as procedural aspects such as registration, fees, and procedures regarding opposition, revocation or declaration of invalidity of a trade mark. It also sets forth provisions enhancing the administrative cooperation of national central industrial property offices between themselves and with the European Union Trade Mark and Design Agency (Articles 52 and 53).

5. The proposed Regulation amends the current legal framework applicable to the Community trade mark set forth in Regulation (EC) No 207/2009. The Office for Harmonisation in the Internal Market ('OHIM') is renamed 'European Trade Marks and Design Agency' ('the Agency'). The proposed Regulation clarifies substantive and procedural rules that apply to the European trade mark. It provides for the establishment by the Agency of a Register and of an electronic database (Article 87). It also clarifies the role and tasks of the Agency, in particular in relation to its cooperation with the national central industrial property offices in the EU (Article 123).

2. ANALYSIS OF THE PROPOSALS 2.1. Personal data processing in the context of trade marks

6. The EDPS notes that the Proposals provide that, during the lifetime of a trade mark, national central industrial property offices and the Agency will, within their respective mandate, be collecting and processing data relating to various identified or identifiable 5 individuals, such as the applicant , the successor in title, the transferee, the licensee, third parties making observations, and third parties making unlawful use of a trade mark. These are personal data within the meaning of Article 2(a) of Directive 95/46/EC and Article 2(a) of Regulation (EC) No 45/2001.

7. The EDPS emphasises that the collection of personal data by the Member States' central industrial property offices and the Agency must respect applicable data protection law. In the case of national offices, they must respect the rules set forth in the national laws implementing Directive 95/46/EC. In the case of the Agency, its processing of personal data is subject to Regulation (EC) No 45/2001.

8. The EDPS underlines that compliance with data protection rules requires national offices and the Agency, amongst others, to provide appropriate information to the data subjects about the processing of their personal data (e.g. for the filing of an application, for the filing of third parties' observations, etc), to ensure the exercise of 7 data subjects' rights , and to notify the processing to data protection supervisory authorities and subject it to prior checking where applicable .

9. The EDPS notes that in the context of infringement proceedings, personal data of third parties making unlawful use of a trade mark may be processed. The processing of personal data in that context may include data about offences or suspicions of offences against specific individuals. The EDPS underlines that according to the EU data protection law the processing of personal data relating to offences, criminal convictions or security measures is subject to stricter conditions, which may include a prior checking by data protection authorities .

10. Against that background, the EDPS welcomes the reference in Article 123(4) of the proposed Regulation to the applicability of Regulation (EC) No 45/2001 as concerns the processing of personal data by the Agency.

11. However, he notes that there is no reference to applicable data protection law in the proposed Directive. He therefore advises the legislators to insert in the proposed Directive a substantive provision underlining the need for any processing of personal data carried out by national industrial property offices to respect applicable data protection law, in particular the national laws implementing Directive 95/46/EC. Such a substantive provision is needed from the point of view of legal certainty, to avoid any ambiguity on the fact that the Proposals should not be considered as derogations from the data protection framework which remains fully applicable to the envisaged processing operations.

12. Account should also be taken of the fact that Directive 95/46/EC is currently being revised through ordinary legislative procedure with a view to be replaced by a General 11 Data Protection Regulation , which as a consequence means that the processing operations falling within its scope would become subject to the rules set forth in the Data Protection Regulation when it comes into force. The EDPS therefore recommends inserting in a recital of the proposed Directive a reference to the relevance of the proposed General Data Protection Regulation once adopted by Council and European Parliament. 2.2. Exchanges of information between the Agency and national offices

13. The EDPS notes that, pursuant to recital 37 and Article 52 of the proposed Directive, a cooperation mechanism would be set up between the Agency and Member States' central industrial property offices in order to promote convergence of practices and tools, 'such as the creation and updating of common or connected databases and portals for consultation and search purposes' (recital 37).

14. Similarly, the Explanatory Memorandum for the proposed Regulation states that '[t]he Agency is in the process of developing, together with National Offices, a number of promising tools that offer far better means of conducting priority searches and monitoring the registry for infringements' . Article 123c of the proposed Regulation establishes a cooperation mechanism for the exchange of information between the Agency and national offices. In the frame of this cooperation, Article 123c also provides for the creation of common or connected databases and portals for Unionwide consultation, search and classification purposes, as well as the continuous provision and exchange of data and information, including the feeding of the databases and portals referred to above.

15. The EDPS advises to clarify, in a provision of the proposed Directive and in Article 123c of the proposed Regulation, the scope and purpose(s) of these common or connected databases and portals, and whether or not they would involve the processing of personal data. It should also be clarified whether these common or connected databases and portals bring additional purposes to the original ones of each database and portal, and if so, the justification for these additional purposes. If they aim at the better performance of existing purposes, such as the monitoring of infringements, then that may be sufficient as justification. However, the processing of personal data in those databases and portals for any new purpose would have to be explicitly justified and to respect the purpose limitation principle according to which the data must not be further processed in a way incompatible with the original purpose of collection (Article 6(1)(b) of Directive 95/46/EC and Article 4(1)(b) of Regulation (EC) No 45/2001) .

16. The EDPS underlines that if these common or connected databases and portals involve the processing and exchange of personal data, such processing should be carried out in compliance with applicable data protection law, in particular Regulation (EC) No 45/2001 as regards the processing by the Agency and Directive 95/46/EC as regards the processing by national offices.

17. This also requires, on the one hand, that the modalities for the processing and exchanges of information should be explicitly established in substantive provisions of the Directive and of the Regulation, in particular, who are the authorised recipients of the personal data, the types of data exchanged, the purpose of these exchanges, and the length of the retention of data in these IT systems.

18. On the other hand, national offices and the Agency must ensure that the processing of personal data carried out through these common or connected databases and portals complies with data protection requirements. In particular, the EDPS underlines that the creation of new IT tools may require filing a notification to the appropriate data protection authorities pursuant to Article 18 of Directive 95/46/EC (or the Data Protection Officer in the case of the Agency pursuant to Article 25 of Regulation (EC) No 45/2001), and/or complying with prior checking requirements (pursuant to Article 20 of Directive 95/46/EC and Article 27 of Regulation (EC) No 45/2001). This should be expressly underlined in a provision of the Directive and of the Regulation. 2.3. Other data protection aspects to be considered in the Proposed Regulation The processing of personal data in the Register and in an electronic database

19. Pursuant to Article 87 of the proposed Regulation, the Agency will keep a Register and will maintain an electronic database containing the particulars for registration of European trade marks and the entries made in the Register.

20. Article 26 of Regulation (EC) No 207/2009 describes the conditions with which applications for a Community trade mark must comply and lists information identifying the applicant as part of the application. Article 87 of the proposed Regulation is, however, not clear about the extent to which the Register and the electronic database contain personal data beyond the data identifying the applicant. It provides that the Register "shall contain those particulars the registration or inclusion of which is provided for by this Regulation or by a delegated act adopted pursuant to this Regulation". The EDPS notes that many modalities of the registration procedure are to be defined later in delegated acts. For instance, pursuant to Articles 35(a) and 24(a), the details regarding the content of the application referred to in Article 26(1) or the procedure for entering a transfer would be specified in delegated acts. As explained in section 1 above, it can be assumed that at least data regarding the identity of several persons (including the transferee, etc) will be processed in that context.

21. The EDPS considers that since personal data are processed in the context of the registration of an application, and in particular as they are recorded and stored in the Register and in an electronic database, specific modalities of the processing should be set forth in the Proposal itself and not in delegated acts. These modalities must ensure that the data are processed in accordance with the data quality principles set forth in Article 4 of Regulation (EC) No 45/2001, which provides amongst others that the data collected must be adequate, relevant and not excessive for the purpose for which they are collected and/or further processed. The EDPS therefore advises specifying in a provision of the Regulation the types of personal data to be processed in the Register and the electronic database, the purpose of their processing, the categories of recipients who are authorised access to the data (with the specification of which data), the data retention time-limit(s), and the modalities for the information and the exercise of data subjects' rights in view of the rules set forth in Articles 11 to 19 of Regulation (EC) No 45/2001. Publication of information

22. Article 87(3) of the proposed Regulation provides that the contents of the electronic database may be made available to the public, on the basis of specific modalities adopted by the Executive Director of the Agency. Article 89 of the proposed Regulation also provides for the publication of entries made in the Register as well as other particulars in periodical publications.

23. The EDPS notes that the proposed Regulation does not state explicitly that such publication could include personal data. However, published information concerning trade marks may include personal information of the proprietor of the trade mark. The EDPS underlines that a careful assessment must be carried out before any personal data is disclosed to the public. Attention is to be drawn to the Schecke ruling in which the Court of Justice underlined that, in order to strike a proper balance between the various interests at stake, the EU institutions must take into consideration methods of publishing information which would be consistent with the objective of such publication, while at the same time causing less interference with the individuals rights to respect for their private life and to protection of their personal data . It should therefore be assessed whether the disclosure of personal data would be necessary and proportionate to the purpose pursued. If, under these conditions, it is the intention of the legislators to provide for the publication of personal data, the EDPS recommends including explicit provisions to that effect in the proposed Regulation. As a minimum, a substantive provision should clarify what kind of personal data may be made public and for what purpose(s).

24. Furthermore, the EDPS draws attention to similar concerns that should be taken into consideration if the cooperation between the Agency and national offices would also include means to disclose to the public national and EU court decisions relating to trade marks. In such case, it must also be ensured that before any personal data is disclosed to the public, there is an appropriate consideration of methods of publishing information that are consistent with the objective of such publication, while at the same time causing less interference with individuals rights to respect for their private life and to protection of their personal data. Due account should be taken of whether or not the court decisions have already been disclosed to the public at national or EU level and of the manner and conditions in which such disclosure took place.

25. In this view, the EDPS takes note of the current practice of OHIM to publish on its website judgments of the Court of Justice of the EU and of the Community trade mark courts. Without prejudice to the method actually used by OHIM for such publication, the EDPS would like to underline as a matter of principle that the publication on the internet of court decisions containing names and surnames of individuals which enables their indexing by external internet search engines service providers may cause an interference with individuals' right to respect for their private life and to protection 15 of their personal data . If the court decision mentioning the name and surname of an individual can be indexed on external internet search engines, this may allow any type of queries based on that name and surname to generate a link to that decision, although such queries may not have originally the purpose of researching any past court decision and/or conviction about that person. Account should be taken of the fact that the indexing of the judgment (and personal data contained therein) on an internet search engine would not be circumscribed within any time limit and would thus enable the search and access to the personal data for an unlimited duration even after the sentence has been expunged by the individual, and where relevant data has been removed from his/her criminal record. Furthermore, a distinction should be drawn between the publication of court decisions on the internet for the first time (i.e. there was no publication of the court decision on the internet by the relevant court or official journal) and the further publication of court decisions which have already been published on the internet by the relevant court, e.g. on the CJEU website, or the official journal. In the latter case, it must be ensured that the conditions of the initial publication are respected (e.g. where the initial publication technically prohibits the indexing of decisions (and personal data contained therein) by external internet search engines).

26. As a result, the EDPS recommends clarifying in a substantive provision of the proposed Regulation whether or not the means of cooperation would include the publication of court decisions. If so, this substantive provision should define the conditions under which the publication of court decisions may take place. In this respect, the EDPS recommends that the publication of judgements on the internet by the Agency and/or national central industrial property offices should take place under the condition that the indexing of judgments (and personal data contained therein) on external internet search engines is technically prohibited or otherwise that it is considered whether the publication should be done on a no name basis.

3. CONCLUSIONS .

27. Although these Proposals deal with the harmonisation of substantive trade mark law as well as procedural rules within the EU and, at first sight, do not seem to have substantial consequences for data protection, they however establish a few processing operations which may have an impact on individuals' rights to privacy and data protection.

28. The EDPS underlines that the collection and processing of personal data by the Member States' central industrial property offices and the Agency in the performance of their tasks must be carried out in compliance with applicable data protection law, in particular the national laws implementing Directive 95/46/EC and Regulation (EC) No 45/2001.

29. As to the proposed Directive, the EDPS recommends to:  insert a substantive provision underlining the need for any processing of personal data carried out by national industrial property offices to respect applicable data protection law, in particular national laws implementing Directive 95/46/EC, and add a reference to the proposed General Data Protection Regulation in a recital;  underline in a substantive provision that any processing of personal data by the Agency in the context of the cooperation between national offices and the Agency is subject to compliance with the rules set forth in Regulation (EC) No 45/2001;  clarify in a substantive provision whether the common or connected databases and portals planned under Article 52 and recital 37 involve the processing of personal data as well as their scope and purpose(s), in particular whether they bring additional purposes to the original ones of each database and portal, and if so, what is the legal basis for these additional purposes;  clearly establish in a substantive provision the modalities for the exchanges of information through the common or connected databases and portals, in particular by determining the authorised recipients of personal data, the types of data, the purpose of such exchanges, and the length of the retention of the data in those IT systems.

30. As to the proposed Regulation, the EDPS recommends to:  set forth the modalities for the processing of personal data in the Register and the electronic database in a substantive provision of the Proposal and not in delegated acts;  insert a substantive provision specifying the types of personal data to be processed in the Register and the electronic database, the purpose of their processing, the categories of recipients who are authorised access to the data (with the specification of which data), the data retention time-limit(s), and the modalities for the information and the exercise of data subjects' rights;  clarify in Article 123c whether or not the exchanges of information between the Agency and national offices would include personal data, and if so, which ones. It should also specify (i) that exchanges of personal data between the Agency and national offices must be carried out in compliance with applicable data protection law, in particular Regulation (EC) No 45/2001 as regards the processing by the Agency and Directive 95/46/EC as regards the processing by national offices, (ii) the purpose of such exchanges, in particular whether they bring additional purposes to the original ones of each database and portal, and if so, what is the legal basis for these additional purposes, and (iii) the types of data exchanged, the authorised recipients of the data, and the length of the retention of data in these IT systems;  assess the necessity and proportionality of disclosing personal data in the context of the publication of information contained in the electronic database. If it is the intention of the legislators to provide for the publication of personal data for carefully assessed purposes, the EDPS recommends including explicit provisions to that effect in the proposed Regulation. As a minimum, a substantive provision should clarify what kind of personal data may be made public and for what purpose(s);  clarify in a substantive provision whether or not the means of cooperation would include the publication of court decisions relating to trade marks. If so, this substantive provision should define the conditions under which the publication of court decisions may take place. In this respect, the EDPS recommends that the publication of judgements on the internet by the Agency and/or national central industrial property offices should take place under the condition that the indexing of judgments (and personal data contained therein) on external internet search engines is technically prohibited or otherwise that it is considered whether the publication should be done on a no name basis. Done at Brussels, 11 July 2013 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor