text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM(2013) 162 final. 4 COM(2013) 161 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: For instance,

text: Article 38(1)

text: (b) of the proposed Directive provides that the application for registration of a trade mark shall contain information identifying the applicant.

text: Pursuant to Articles

text: of Directive 95/46/EC and Articles

text: of Regulation (EC) No 45/2001. 7 In accordance with Articles

text: of Directive 95/46/EC and Articles

text: of Regulation (EC) No 45/2001. 8 In accordance with EU national laws implementing Articles

text: and

text: of Directive 95/46/EC and Articles

text: and

text: of Regulation (EC) No 45/2001. 9 See EU national laws implementing

text: Article 8(5) of Directive 95/46/EC

text: and

text: Article 10(5) of Regulation (EC) No 45/2001

text: . 10 See EU national laws implementing

text: Article 20 of Directive 95/46/EC

text: and

text: Article 27 of Regulation (EC) No 45/2001

text: . 11 COM(2012) 11 final.

text: See paragraph on searches, page 6. 13 See also

text: Article 29

text: Working Party Opinion 03/2013 on purpose limitation adopted on 02.04.2013, available at: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf.

text: Joined Cases

text: and

text: , Volker und Markus Schecke GbR v Land Hessen; Eifert v Land Hessen, [2012] All E.R. (EC) 127, CJ, paras 56-64. 15 On the issue of the indexing of individuals' names and surnames by an internet search engine service provider, see Opinion of Advocate General Jääskinen delivered on 25 June 2013 in

text: Case C-131/12

text: Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González, in particular para. 97 and 119.

identifier: EDPS yttrande (2013)

amnesord:
Regulation 45/2001
Internal Market
Transparency

publisher: Europeiska datatillsynsmannen

sprak: en

title: Community trade mark

serie: yttranden

text: Opinion of the European Data Protection Supervisor

type: stycke

text: on the Proposal for a Directive of the European Parliament and of the Council to approximate the laws of the Member States relating to trade marks (recast) and the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EC) No 207/2009

text: on the Community trade mark

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such 2 data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 27 March 2013, the Commission adopted two legislative Proposals in the field of trade marks: a Proposal for a Directive of the European Parliament and of the Council to approximate the laws of the Member States relating to trade marks (recast) and a Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EC) No 207/2009

text: on the Community trade mark (hereafter jointly referred to as 'the Proposals'). These Proposals were transmitted to the EDPS on that same day.

text: 2. The EDPS takes note that the main aim of these Proposals is to harmonise further all aspects of substantive trade mark law as well as procedural rules within the EU. Although at first sight it may seem that these Proposals do not carry any substantial consequences for data protection, he however notes that both instruments establish a few processing operations, which may have an impact on individuals' right to privacy and data protection. The EDPS therefore regrets that he was not consulted informally prior to the adoption of these Proposals.

text: 3. Pursuant to

text: Article 28(2) of Regulation (EC) No 45/2001

text: , the EDPS wishes to highlight below a few specific issues that the Proposals raise from a data protection perspective. The EDPS recommends that a reference be made in the preamble of the Proposals to the consultation of the EDPS. 1.2. General background

text: 4. The Proposed Directive aims at harmonising further within the EU substantive rules relating to trade marks -including clarifications on the rights conferred by a trade mark and the rules applicable to collective marks- as well as procedural aspects such as registration, fees, and procedures regarding opposition, revocation or declaration of invalidity of a trade mark. It also sets forth provisions enhancing the administrative cooperation of national central industrial property offices between themselves and with the European Union Trade Mark and Design Agency (Articles

text: and

text: 5. The proposed Regulation amends the current legal framework applicable to the Community trade mark set forth in

text: Regulation (EC) No 207/2009

text: . The Office for Harmonisation in the Internal Market ('OHIM') is renamed 'European Trade Marks and Design Agency' ('the Agency'). The proposed Regulation clarifies substantive and procedural rules that apply to the European trade mark. It provides for the establishment by the Agency of a Register and of an electronic database (

text: Article 87

text: ). It also clarifies the role and tasks of the Agency, in particular in relation to its cooperation with the national central industrial property offices in the EU (

text: Article 123

text: 2. ANALYSIS OF THE PROPOSALS 2.1. Personal data processing in the context of trade marks

text: 6. The EDPS notes that the Proposals provide that, during the lifetime of a trade mark, national central industrial property offices and the Agency will, within their respective mandate, be collecting and processing data relating to various identified or identifiable 5 individuals, such as the applicant , the successor in title, the transferee, the licensee, third parties making observations, and third parties making unlawful use of a trade mark. These are personal data within the meaning of

text: Article 2

text: (a) of Directive

text: and

text: Article 2

text: (a) of

text: Regulation (EC) No 45/2001

text: 7. The EDPS emphasises that the collection of personal data by the Member States' central industrial property offices and the Agency must respect applicable data protection law. In the case of national offices, they must respect the rules set forth in the national laws implementing Directive

text: . In the case of the Agency, its processing of personal data is subject to

text: Regulation (EC) No 45/2001

text: 8. The EDPS underlines that compliance with data protection rules requires national offices and the Agency, amongst others, to provide appropriate information to the data subjects about the processing of their personal data (e.g. for the filing of an application, for the filing of third parties' observations, etc), to ensure the exercise of 7 data subjects' rights , and to notify the processing to data protection supervisory authorities and subject it to prior checking where applicable .

text: 9. The EDPS notes that in the context of infringement proceedings, personal data of third parties making unlawful use of a trade mark may be processed. The processing of personal data in that context may include data about offences or suspicions of offences against specific individuals. The EDPS underlines that according to the EU data protection law the processing of personal data relating to offences, criminal convictions or security measures is subject to stricter conditions, which may include a prior checking by data protection authorities .

text: 10. Against that background, the EDPS welcomes the reference in Article 123(4) of the proposed Regulation to the applicability of

text: Regulation (EC) No 45/2001

text: as concerns the processing of personal data by the Agency.

text: 11. However, he notes that there is no reference to applicable data protection law in the proposed Directive. He therefore advises the legislators to insert in the proposed Directive a substantive provision underlining the need for any processing of personal data carried out by national industrial property offices to respect applicable data protection law, in particular the national laws implementing Directive

text: . Such a substantive provision is needed from the point of view of legal certainty, to avoid any ambiguity on the fact that the Proposals should not be considered as derogations from the data protection framework which remains fully applicable to the envisaged processing operations.

text: 12. Account should also be taken of the fact that Directive

text: is currently being revised through ordinary legislative procedure with a view to be replaced by a General 11 Data Protection Regulation , which as a consequence means that the processing operations falling within its scope would become subject to the rules set forth in the Data Protection Regulation when it comes into force. The EDPS therefore recommends inserting in a recital of the proposed Directive a reference to the relevance of the proposed General Data Protection Regulation once adopted by Council and European Parliament. 2.2. Exchanges of information between the Agency and national offices

text: 13. The EDPS notes that, pursuant to recital 37 and Article 52 of the proposed Directive, a cooperation mechanism would be set up between the Agency and Member States' central industrial property offices in order to promote convergence of practices and tools, 'such as the creation and updating of common or connected databases and portals for consultation and search purposes' (recital 37).

text: 14. Similarly, the Explanatory Memorandum for the proposed Regulation states that '[t]he Agency is in the process of developing, together with National Offices, a number of promising tools that offer far better means of conducting priority searches and monitoring the registry for infringements' .

text: Article 123

text: c of the proposed Regulation establishes a cooperation mechanism for the exchange of information between the Agency and national offices. In the frame of this cooperation,

text: Article 123

text: c also provides for the creation of common or connected databases and portals for Unionwide consultation, search and classification purposes, as well as the continuous provision and exchange of data and information, including the feeding of the databases and portals referred to above.

text: 15. The EDPS advises to clarify, in a provision of the proposed Directive and in

text: Article 123

text: c of the proposed Regulation, the scope and purpose(s) of these common or connected databases and portals, and whether or not they would involve the processing of personal data. It should also be clarified whether these common or connected databases and portals bring additional purposes to the original ones of each database and portal, and if so, the justification for these additional purposes. If they aim at the better performance of existing purposes, such as the monitoring of infringements, then that may be sufficient as justification. However, the processing of personal data in those databases and portals for any new purpose would have to be explicitly justified and to respect the purpose limitation principle according to which the data must not be further processed in a way incompatible with the original purpose of collection (

text: Article 6(1)

text: (b) of Directive

text: and

text: Article 4(1)

text: (b) of

text: Regulation (EC) No 45/2001

text: 16. The EDPS underlines that if these common or connected databases and portals involve the processing and exchange of personal data, such processing should be carried out in compliance with applicable data protection law, in particular

text: Regulation (EC) No 45/2001

text: as regards the processing by the Agency and Directive

text: as regards the processing by national offices.

text: 17. This also requires, on the one hand, that the modalities for the processing and exchanges of information should be explicitly established in substantive provisions of the Directive and of the Regulation, in particular, who are the authorised recipients of the personal data, the types of data exchanged, the purpose of these exchanges, and the length of the retention of data in these IT systems.

text: 18. On the other hand, national offices and the Agency must ensure that the processing of personal data carried out through these common or connected databases and portals complies with data protection requirements. In particular, the EDPS underlines that the creation of new IT tools may require filing a notification to the appropriate data protection authorities pursuant to

text: Article 18 of Directive 95/46/EC

text: (or the Data Protection Officer in the case of the Agency pursuant to

text: Article 25 of Regulation (EC) No 45/2001

text: ), and/or complying with prior checking requirements (pursuant to

text: Article 20 of Directive 95/46/EC

text: and

text: ). This should be expressly underlined in a provision of the Directive and of the Regulation. 2.3. Other data protection aspects to be considered in the Proposed Regulation The processing of personal data in the Register and in an electronic database

text: 19. Pursuant to Article 87 of the proposed Regulation, the Agency will keep a Register and will maintain an electronic database containing the particulars for registration of European trade marks and the entries made in the Register.

text: Article 26 of Regulation (EC) No 207/2009

text: describes the conditions with which applications for a Community trade mark must comply and lists information identifying the applicant as part of the application. Article 87 of the proposed Regulation is, however, not clear about the extent to which the Register and the electronic database contain personal data beyond the data identifying the applicant. It provides that the Register "shall contain those particulars the registration or inclusion of which is provided for by this Regulation or by a delegated act adopted pursuant to this Regulation". The EDPS notes that many modalities of the registration procedure are to be defined later in delegated acts. For instance, pursuant to

text: Articles 35

text: (a) and 24(a), the details regarding the content of the application referred to in

text: Article 26(1)

text: or the procedure for entering a transfer would be specified in delegated acts. As explained in section 1 above, it can be assumed that at least data regarding the identity of several persons (including the transferee, etc) will be processed in that context.

text: 21. The EDPS considers that since personal data are processed in the context of the registration of an application, and in particular as they are recorded and stored in the Register and in an electronic database, specific modalities of the processing should be set forth in the Proposal itself and not in delegated acts. These modalities must ensure that the data are processed in accordance with the data quality principles set forth in

text: Article 4 of Regulation (EC) No 45/2001

text: , which provides amongst others that the data collected must be adequate, relevant and not excessive for the purpose for which they are collected and/or further processed. The EDPS therefore advises specifying in a provision of the Regulation the types of personal data to be processed in the Register and the electronic database, the purpose of their processing, the categories of recipients who are authorised access to the data (with the specification of which data), the data retention time-limit(s), and the modalities for the information and the exercise of data subjects' rights in view of the rules set forth in

text: Articles 11

text: to 19 of

text: Regulation (EC) No 45/2001

text: . Publication of information

text: 22. Article 87(3) of the proposed Regulation provides that the contents of the electronic database may be made available to the public, on the basis of specific modalities adopted by the Executive Director of the Agency. Article 89 of the proposed Regulation also provides for the publication of entries made in the Register as well as other particulars in periodical publications.

text: 23. The EDPS notes that the proposed Regulation does not state explicitly that such publication could include personal data. However, published information concerning trade marks may include personal information of the proprietor of the trade mark. The EDPS underlines that a careful assessment must be carried out before any personal data is disclosed to the public. Attention is to be drawn to the Schecke ruling in which the Court of Justice underlined that, in order to strike a proper balance between the various interests at stake, the EU institutions must take into consideration methods of publishing information which would be consistent with the objective of such publication, while at the same time causing less interference with the individuals rights to respect for their private life and to protection of their personal data . It should therefore be assessed whether the disclosure of personal data would be necessary and proportionate to the purpose pursued. If, under these conditions, it is the intention of the legislators to provide for the publication of personal data, the EDPS recommends including explicit provisions to that effect in the proposed Regulation. As a minimum, a substantive provision should clarify what kind of personal data may be made public and for what purpose(s).

text: 24. Furthermore, the EDPS draws attention to similar concerns that should be taken into consideration if the cooperation between the Agency and national offices would also include means to disclose to the public national and EU court decisions relating to trade marks. In such case, it must also be ensured that before any personal data is disclosed to the public, there is an appropriate consideration of methods of publishing information that are consistent with the objective of such publication, while at the same time causing less interference with individuals rights to respect for their private life and to protection of their personal data. Due account should be taken of whether or not the court decisions have already been disclosed to the public at national or EU level and of the manner and conditions in which such disclosure took place.

text: 25. In this view, the EDPS takes note of the current practice of OHIM to publish on its website judgments of the Court of Justice of the EU and of the Community trade mark courts. Without prejudice to the method actually used by OHIM for such publication, the EDPS would like to underline as a matter of principle that the publication on the internet of court decisions containing names and surnames of individuals which enables their indexing by external internet search engines service providers may cause an interference with individuals' right to respect for their private life and to protection 15 of their personal data . If the court decision mentioning the name and surname of an individual can be indexed on external internet search engines, this may allow any type of queries based on that name and surname to generate a link to that decision, although such queries may not have originally the purpose of researching any past court decision and/or conviction about that person. Account should be taken of the fact that the indexing of the judgment (and personal data contained therein) on an internet search engine would not be circumscribed within any time limit and would thus enable the search and access to the personal data for an unlimited duration even after the sentence has been expunged by the individual, and where relevant data has been removed from his/her criminal record. Furthermore, a distinction should be drawn between the publication of court decisions on the internet for the first time (i.e. there was no publication of the court decision on the internet by the relevant court or official journal) and the further publication of court decisions which have already been published on the internet by the relevant court, e.g. on the CJEU website, or the official journal. In the latter case, it must be ensured that the conditions of the initial publication are respected (e.g. where the initial publication technically prohibits the indexing of decisions (and personal data contained therein) by external internet search engines).

text: 26. As a result, the EDPS recommends clarifying in a substantive provision of the proposed Regulation whether or not the means of cooperation would include the publication of court decisions. If so, this substantive provision should define the conditions under which the publication of court decisions may take place. In this respect, the EDPS recommends that the publication of judgements on the internet by the Agency and/or national central industrial property offices should take place under the condition that the indexing of judgments (and personal data contained therein) on external internet search engines is technically prohibited or otherwise that it is considered whether the publication should be done on a no name basis.

text: 3. CONCLUSIONS .

text: 27. Although these Proposals deal with the harmonisation of substantive trade mark law as well as procedural rules within the EU and, at first sight, do not seem to have substantial consequences for data protection, they however establish a few processing operations which may have an impact on individuals' rights to privacy and data protection.

text: 28. The EDPS underlines that the collection and processing of personal data by the Member States' central industrial property offices and the Agency in the performance of their tasks must be carried out in compliance with applicable data protection law, in particular the national laws implementing Directive

text: and

text: Regulation (EC) No 45/2001

text: 29. As to the proposed Directive, the EDPS recommends to:  insert a substantive provision underlining the need for any processing of personal data carried out by national industrial property offices to respect applicable data protection law, in particular national laws implementing Directive

text: , and add a reference to the proposed General Data Protection Regulation in a recital;  underline in a substantive provision that any processing of personal data by the Agency in the context of the cooperation between national offices and the Agency is subject to compliance with the rules set forth in

text: Regulation (EC) No 45/2001

text: ;  clarify in a substantive provision whether the common or connected databases and portals planned under

text: Article 52

text: and recital 37 involve the processing of personal data as well as their scope and purpose(s), in particular whether they bring additional purposes to the original ones of each database and portal, and if so, what is the legal basis for these additional purposes;  clearly establish in a substantive provision the modalities for the exchanges of information through the common or connected databases and portals, in particular by determining the authorised recipients of personal data, the types of data, the purpose of such exchanges, and the length of the retention of the data in those IT systems.

text: 30. As to the proposed Regulation, the EDPS recommends to:  set forth the modalities for the processing of personal data in the Register and the electronic database in a substantive provision of the Proposal and not in delegated acts;  insert a substantive provision specifying the types of personal data to be processed in the Register and the electronic database, the purpose of their processing, the categories of recipients who are authorised access to the data (with the specification of which data), the data retention time-limit(s), and the modalities for the information and the exercise of data subjects' rights;  clarify in

text: Article 123

text: c whether or not the exchanges of information between the Agency and national offices would include personal data, and if so, which ones. It should also specify (i) that exchanges of personal data between the Agency and national offices must be carried out in compliance with applicable data protection law, in particular

text: Regulation (EC) No 45/2001

text: as regards the processing by national offices, (ii) the purpose of such exchanges, in particular whether they bring additional purposes to the original ones of each database and portal, and if so, what is the legal basis for these additional purposes, and (iii) the types of data exchanged, the authorised recipients of the data, and the length of the retention of data in these IT systems;  assess the necessity and proportionality of disclosing personal data in the context of the publication of information contained in the electronic database. If it is the intention of the legislators to provide for the publication of personal data for carefully assessed purposes, the EDPS recommends including explicit provisions to that effect in the proposed Regulation. As a minimum, a substantive provision should clarify what kind of personal data may be made public and for what purpose(s);  clarify in a substantive provision whether or not the means of cooperation would include the publication of court decisions relating to trade marks. If so, this substantive provision should define the conditions under which the publication of court decisions may take place. In this respect, the EDPS recommends that the publication of judgements on the internet by the Agency and/or national central industrial property offices should take place under the condition that the indexing of judgments (and personal data contained therein) on external internet search engines is technically prohibited or otherwise that it is considered whether the publication should be done on a no name basis. Done at Brussels, 11 July 2013 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor

type: vagledning

utgivare: edps