EDPS Opinion 26/2023 on the Proposal for a Regulation on standard essential patents

19 June 2023

Opinion 26/2023 on the Proposal for a Regulation on standard essential patents and amending Regulation (EU) 2017/1001

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council amending Directive 2014/49/EU as regards the scope of deposit protection, use of deposit guarantee schemes funds, cross-border cooperation, and transparency (COM(2023) 228 final). This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 27 April 2023 the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on standard essential patents and amending Regulation (EU) 2017/1001.

The Proposal aims at (i) making available detailed information on standard essential patents (SEPs) and existing fair, reasonable and non-discriminatory (‘FRAND’) terms and conditions to facilitate licensing negotiations; (ii) raise awareness of SEP licensing in the value chain and (iii) provide for an alternative dispute resolution mechanism for setting FRAND terms and conditions. The Proposal would create a competence centre within European Union Intellectual Property Office (EUIPO), which would be tasked to administer databases, a register and the procedures for essentiality checks of SEPs and the FRAND determination.

The EDPS notes that the Proposal would entail processing of personal data, notably personal data relating SEP holders and/or their legal representive, as well as personal data relating to evaluators and conciliators. For this reason, the EDPS recommends specifying in a recital that the processing of personal data in accordance with this Regulation shall be subject to the EUDPR and to Regulation (EU) 2016/679 (‘the GDPR’).

Regarding the register and databases managed by EUIPO, the Proposal should clearly set out the specific purpose(s) for which personal data may be made available and provide for a procedure ensuring that only third parties who demonstrate a legitimate interest have access to such data. The Proposal should also specify in the enacting terms the role of EUIPO as controller under the EUDPR.

Finally, the EDPS invites the EU legislator to consider whether the 18-month retention period could be prescribed as a rule for personal data (regardless of the submission of a request), and, in any case, to specify who would be entitled to lodge such a request for removal of personal data to EUIPO.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 27 April 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on standard essential patents and amending Regulation (EU) 2017/1001 (‘the Proposal’).

2. The overall objectives of the Proposal are to: (i) ensure that end users, including small businesses and EU consumers benefit from products based on the latest standardised technologies; (ii) make the EU attractive for standards innovation; and (iii) encourage both standard essential patents (‘SEP’) holders and implementers to innovate in the EU, make and sell products in the EU and be competitive in non-EU markets. The initiative aims to incentivise participation by European firms in the standard development process and the broad implementation of such standardised technologies, particularly in IoT industries .

3. In this context, the initiative seeks to: (i) make available detailed information on SEPs and existing fair, reasonable and non-discriminatory (‘FRAND’) terms and conditions to facilitate licensing negotiations; (ii) raise awareness of SEP licensing in the value chain and (iii) provide for an alternative dispute resolution mechanism for setting FRAND terms and conditions .

4. To achieve these objectives, the Proposal includes provisions that establish a competence center within the European Union Intellectual Property Office (‘the EUIPO competence center’), which would be tasked setting up and managing, inter alia, a roster of evaluators 5 6 and conciliators , establishing and maintaining a register of SEPs (‘the register’) and establishing and maintaining an electronic database for SEPs (‘the database’) .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 19 April 2023 pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 50 of the Proposal.

2. General remarks

6. The EDPS welcomes the Commission’s Proposal, providing for enhanced transparency with regard to information necessary for SEP licensing; registration of SEPs; procedures for evaluating the essentiality of registered SEPs and procedures for determination FRAND terms and conditions for a SEP licence.

7. The EDPS notes that the Proposal would entail processing of personal data, notably personal data relating to SEP holders and/or their legal representive, as well as personal data relating to evaluators and conciliators.

8. Recital 14 of the Proposal specifies that the EUIPO competence centre should be the subject of Union rules on access to documents and data protection. As the Proposal would also entail processing of personal data by other entities, the EDPS recommends specifying in the recital that any processing of personal data in accordance with the Regulation shall be subject to the EUDPR and to Regulation (EU) 2016/679 (‘the GDPR’) . The applicability of the EUDPR is triggered by the role of EUIPO as controller for the processing of personal data relating to the register and to the database. The applicability of the GDPR is triggered by the processing of personal data by entities which are not Union institutions, offices, bodies or agencies (e.g., SEP holders, patent pools).

3. The register and the database

9. According to Article 4(3) of the Proposal, the register of standard essential patents will contain the name, address and contact details of the SEP holder as well as the name, address and contact details of the SEP holder’s legal representatives in the Union, where relevant.

10. Article 4(6) provides that the EUIPO competence centre must collect, organise, make public and store the items referred to in paragraphs (3) and (4), including any personal data for the purposes of this Regulation. Moreover, Article 4(7) of the Proposal states that the EUIPO competence centre must keep the register easily accessible for public inspection. It adds that the data must be considered to be of public interest and may be accessed by any third party free of charge.

11. The EDPS understands that making available contact details of SEP holders and/or their legal representatives may be necessary to achieve the objectives of the Proposal, including the objective of facilitating licensing. As the publication of personal data constitutes an interference with the right to data protection, however, the Proposal should clearly specify the specific purposes for which personal data may be made available . Moreover, the EDPS considers that a procedure should be put in place to ensure that only third parties who demonstrate a legitimate interest have access to personal data.

12. Having regard to the database, to be established under Article 5 of the Proposal, the EDPS notes that this may also contain personal data, notably of conciliators, as specified under Article 5(2)(i).

13. Article 5(2) specifies that the information listed in this paragraph must be accessible to any third party subject to the registration with the EUIPO competence centre, whereas Article 5(4) specifies that public authorities, including courts, shall have full access to the information in the database free of charge, subject to registration with the competence centre. Also in this case, the EDPS recommends specifying the purpose of the data access, as well as that only registered third parties who demonstrate a legitimate interest will be provided with access to personal data.

14. Finally, since the EUIPO competence centre, establishing and maintaining the register (and the database) will be established within EIUPO, as EUIPO administrative Unit , the Proposal should specify in the enacting terms of the Proposal the role of EUIPO as controller within the meaning of Article 3(8) of the EUDPR.

4. Common provisions on the register and the database

15. The EDPS notes that Article 6(2) of the Proposal states that the EUIPO competence centre must keep the files for 10 years after the removal of the registration of the SEP. The same paragraph specifies that, upon request, personal data may be removed from the register or the database after 18 months from the expiry of the SEP or removal of the SEP from the register.

16. The Proposal does not elaborate why personal data should be kept in the register for a period of 10 years. The EDPS therefore invites the legislature to consider whether an 18month retention period could be prescribed as a rule for personal data regardless of the submission of a request, with the possibility to extend the retention period, where necessary, to safeguard the rights of individuals (e.g., in the context of possible exercise of legal claims). If the current provision were to be maintained, the Proposal should: (a) clearly set out the rationale for establishing a 10-year retention period; and (b) specify who would be entitled to lodge the request for removal of personal data to the EUIPO competence centre. In any event, the EDPS considers that the request for removal in accordance with Article 6(2) of the Proposal should be without prejudice to the data subject’s right to erasure in accordance with Article 19 EUDPR.

5. Exercise of delegation of powers by the Commission

17. Finally the EDPS notices that, under Article 67 of the Proposal, the Commission would be empowered to adopt a delegated act referred to in Articles 1(4), 4(5) and 66(4) of the Proposal. Having regard to Article 4(5), related to items to be entered in the register, the EDPS recalls that, when a proposal for legislation has a possible impact on the protection of personal data, the European Commission has to submit it to the EDPS for consultation in accordance with Article 42(1) EUDPR.

6. Conclusions

18. In light of the above, the EDPS makes the following recommendations: (1) to specify in Recital 14 that the processing of personal data in accordance with this Regulation shall be subject to the EUDPR and to Regulation (EU) 2016/679 (‘the GDPR’); (2) to specify in Article 4 the specific purposes for which personal data may be made available and to provide for a procedure ensuring that only third parties who demonstrate a legitimate interest have access to personal data; (3) to specify in Article 5 the specific purpose for which personal data may be made available and to specify that only registered third parties who demonstrate a legitimate interest will be provided with access to personal data; (4) to specify in the enacting terms of the Proposal the role as controller of EUIPO under the EUDPR; (5) to consider whether an 18-month retention period could be prescribed as a rule for personal data regardless of the submission of a request, and, in any case, to specify who would be entitled to lodge such a request for removal of personal data to EUIPO. Brussels, 19 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7