Bonum Certa Men Certa

Privacy Law Isn't Meant to Protect EPO Management From Prosecution/Accountability

Video download link | md5sum 93aae076d331e004afa0e3191e017157 EPO Hiding Abuse Under Guise of Privacy Creative Commons Attribution-No Derivative Works 4.0



Summary: The big EPO scandal of the year -- namely denying communication between staff and the representatives -- is far from resolved and it seems like it'll be dragged on for another year, reaffirming accusations that the EPO not only breaks the law but also refuses to obey court orders when the actions are deemed illegal

THE subject of the above video and of this post may seem old as the problem has been going on for months already. The "f**king president" António Campinos (he is calling himself "the f**king president") won't budge; he ignores the court's ruling and tries to spin his strategy as a compliance with the ruling, in effect covering up for Benoît Battistelli, who gave him the job.



As promised when recording the above video (always done prior to writing the text), here are the previously-unseen communications on the matter. The staff representatives added some more documents for context. The Central Staff Committee wrote:

Execution of Judgment No. 4551 (mass emails): Additional constraints without legal basis



Dear colleagues,

In a letter of 30 September 2022, the President alleges that the Office is committed to executing Judgment No. 4551 of the Tribunal as swiftly and comprehensively as possible. Almost four months after the judgment, the Staff Committees are still waiting for its execution. The President has decided to maintain the limit of the number of email recipients to 50 and to add a “new feature” as a precondition for executing the judgment, i.e. to introduce a right for staff to unsubscribe from the CSC mailing lists. He tries to justify the additional constraint imposed on the CSC (and the LSCs) with the right to privacy and data protection.

The Data Protection Officer supports the “new feature” in her opinion of 15 September. For our part, we regret that her independence has led her to ignore the judgment and depart from the letter and spirit of the Service Regulations and the Data Protection Rules.

With this open letter, we hope that the President will finally understand why a right for staff to freely unsubscribe from job-related emails has no legal basis or justification whatsoever and we reiterate the demand made in two previous letters (letter of 28 July and letter of 6 September) for the immediate execution of Judgment No. 4551. Our standpoint was also expressed in this letter of 21 October following a meeting with the administration on the topic.


6 documents are referenced there.

First of all, it seems clear that the so-called 'privacy' expert of the Office uses Microsoft Office -- in itself part of the EPO's surveillance blunder. This was written using Microsoft Word (likely GDPR violation) by "Data Protection Officer" (so-called) and "Digitally signed by" Microsoft "Mariya KOLEVA". It's the person whose job is to cover up the EPO's severe privacy abuses, which we covered before (it led to legal challenges and investigations, then a bunch of PR charades from the EPO). They work very hard to avoid compliance rather than attain compliance.

The September letter from staff was covered in this video at the time. An additional letter (from July) had been covered in this video back in August.

That leaves us with just 3 letters to share, starting with Campinos in September:

European Patent Office | 80298 MUNICH | GERMANY

Mr Alain Dumont Chair of the Central Staff Committee

By email to: centalstcom@epo.org

president@epo.org Date: 30.09.2022

Your letters dated 28 July and 6 September 2022

Dear Mr Chair,

Reference is made to your letters dated 28 July and 06 September 2022 regarding the execution of ILOAT J. No. 4551 on mass emails. In this letter, you demand the judgment to be immediately executed and contend that there are no legal or technical requirements preventing such immediate execution.

As you know, the Office is committed to executing the judgments of the Tribunal as swifly and comprehensively as possible, and to draw all consequences from its findings. In the case at hand, this concretely means that the ban on mass emails is to be lifted and that the Staff Committees will now have the possibility to send emails to more than 50 recipients without prior authorisation.

However, as already explained in a letter dated 22 July 2022 and during our meeting on 25 July 2022, there are aspects which need to be addressed before this possibility becomes feasible. The formal opinion of the DPO was therefore sought in relation to the option for staff to unsubscribe from the relevant mailing lists and the changes needed to the Staff Committee’s data protection statement.

First, on the possibility for staff to unsubscribe, there was indeed no such requirement under the previous rules. However, and as explained by the DPO in a formal opinion dated 15 September 2022 (enclosed to this letter), with the adoption of the DPR and the inclusion of Art. 1b in the Service Regulations on 1 January 2022, additional safeguards and rules have been put in place to protect the employees’ right to privacy and the processing of their personal data.

The possibility to unsubscribe will guarantee that staff remain in control of their personal data without limiting the right to free communication and speech of the Staff Committees. In other words, the Staff Committees and other entities will be able to send mass emails, while employees will be given the possibility not to have their email address used for this purpose if they do not wish to, in accordance with the right to privacy and data protection.

This new feature means that separate mailing lists will have to be administered for each entity concerned and it is foreseen that a third-party application will be procured, in order for the maintenance of these lists to be fully automated. The necessary tool will be put in place by 1 November 2022 and staff representatives will be offered training on the use of the tool within this timeframe, should they wish to.

Second, although the Staff Committes will not collect and store personal data while using the mailing lists to send mass emails, using that data for the specific purpose of sending emails constitutes processing. The Data Protection Statement which the Chairs of the CSC and LSCs are currently preparing with the support of the DPO should therefore include the use of the relevant mailing lists for the purpose of sending emails.

Finally, it should be noted that Communiqué No. 10 of 29 March 2006 has been superseded by Circular No. 382 and its contents integrated therein. Both this Circular and the general guidelines on mass emails will have to be slightly amended notably to reflect data protection requirements.

The Office trusts the above will shed some light on the steps which still need to be taken before the Staff Committees can effectively start sending mass emails to the staff. A meeting will in any case be organised with PD08 and DPO to keep you updated on the matter and address any question you may have.

Yours sincerely,

António Campinos

Encl.: Formal opinion of the DPO dated 15 September 2022


"Formal opinion of the DPO" as in wasting EPO money coming up with excuses to not obey court rulings. A friend of Campinos gets that money. Quite frankly as usual...

Here are two replies from the staff representatives, starting with the 21st of October:

European Patent Office | 80298 MUNICH | GERMANY

Mr Laurent Germond (PD Employment Law and Social Dialogue) Mr Diego Eguidazu Alonso (CIO) Ms Mariya Koleva (DPO)

By email

Reference: sc22129cl Date: 21/10/2022

Meeting of 19-10-2022 titled “Meeting on the implementation of J. 4551”

Dear colleagues,

Thank you for the meeting of 19 October 2022.

Our participants sat together to summarise the main points as they were understood in the meeting. According to our understanding:

On data protection

- The Data Protection Officer confirmed her position that staff representation is considered as performing “direct marketing” (Article 37(2) DPR) when sending emails, from which staff members must be given the possibility to unsubscribe. - The solution chosen by the administration will involve a third-party provider using a commercial software tool; - The CSC and each LSC will be the delegated controller for using the third-party provider. Each committee needs to have an agreed data protection statement governing its use of the third-party provider. This documentation needs to be finalised and approved before using the third-party provider; - The third-party provider will be the processor responsible for sending a requested mass email; - BIT staff – the same team currently handling the EPO email system – will also be processor by providing the third-party provider with the email addresses of new colleagues joining the EPO in order to have them added to the list(s). Similarly, BIT staff will communicate the email addresses of colleagues terminating service at the EPO to have them removed from these lists; - No benchmark was carried out by the administration towards other International Organisation (IO), as their Data Protection rules are different. The administration stated that some IOs have an ‘unsubscribe’ option, some do not; that some do permit mass email to staff and some do not (no specific names of other IOs were mentioned in either cases); - The same system may be applied to all statutory bodies and the Amicale whenever they desire to make use of the third-party mass-email provider. Discussions to this effect are taking place with the Amicale; - The administration aims to have this system in place by the 1st of November; - The administration confirmed that the 50-recipient limit will remain in the EPO email system;

On the technicalities

- The handling of staff actively unsubscribing or resubscribing is done by the third-party provider. - Neither staff representation nor the administration shall be aware of the content of the mailing-lists stored by the third-party provider; - Specific aliases will be set up for the CSC and each LSC. - Only whitelisted email accounts can send an email request for mass email distribution to this(ese) specific alias(es). The CSC and each respective LSC will decide which (individual) email accounts and/or the (xxx)stcom email account shall be whitelisted; - The format and content of the email shall remain unmodified by the third-party provider and are entirely the responsibility of the staff committee/staff representative sending; - The third-party provider automatically injects a footer containing a link to the data protection statement governing the use of the third-party provider and a link permitting staff to unsubscribe; - Communications from staff representation could include a link to re-subscribe for staff that unsubscribed from the mass mails; - The administration has decided to limit the number of authorised attachments to one only. The system will not allow multiple attachments; links to documents/publications should be used instead. - Inline images (e.g. logos) may be possible, details on size limitations will be communicated once the tool is known; - It is still not yet clear if and how staff committees will be able to receive single identifiable answers from EPO employees who received an email from the third-party provider; - There is no final agreement yet on the third-party provider, so the details of the system that will be put in place are not entirely known yet and shall be communicated as soon as the agreement with the provider is concluded; - At present, it is foreseen to have a central list (all staff), and then a list per place of employment (Munich, The Hague, Vienna and Berlin). Further segmentation (e.g. staff per DG, or staff in Haar or Brussels) is presently not foreseen. Requests to this effect should be brought forward to the DPO but staff representation is asked to take care not to have too many different lists setup; - Rather than segmenting, the administration suggested to e.g. start an email with a sentence to this effect “This email is specifically relevant for staff in xxx” – which would allow other staff to decide whether or not to read further; - There is currently no provision for a ‘mail merge’ system – not in place at the EPO for any service at present. Should this be needed (e.g. for setting up a survey which sends an individualised email to each account), then a specific request to this effect needs to be made. This is considered as falling outside of the remit of mass emails;

Miscellanea

- The Service Regulations including Circular 382 will be adapted. It is in preparation for the agenda for the GCC of 22 November, and shall be in place before the end of 2022. Principles of the necessary amendments are known and should not be blocking the implementation of the chosen solution; - Once the provider has been chosen, the details and limitations of the system shall be shared on e.g. handling of answers, limitations to (inline) images, technical documentation; - The possibility to segment/target emails needs to be elaborated upon; - Each committee is requested to have an approved data protection statement in place before the system can be put in operation; - The PowerPoint presentation that was given at the start of the meeting will be shared with the participants.

The CSC standpoint

The Office has obviously not yet finalised its proposal for a solution. However, we fail to see how it could be considered an implementation of Judgment 4551, in which the Tribunal recalled (considerations 10 and 12) that freedom of communication implies the right to freely choose the means by which communications are sent to all staff.

The meeting was nevertheless useful in that it reveals some concrete features of the “solution” that the Office contemplates to implement the Judgment, as announced in the President’s letter of 30 September 2022. It is our duty to stress that it relies on the wrong assumption that the CSC would send emails to staff “for marketing purposes”. On the contrary, the CSC insists that sending emails is a task carried out in the exercise of the official activities of a statutory body of the EPO, which is therefore lawful without any need for an “unsubscribe” constraint imposed by the administration.

In conclusion, the implementation presented in the meeting is incompatible with the ruling of the Tribunal.

Yours sincerely,

Alain Dumont

Chairman of the Central Staff Committee .cc Mr António Campinos, President of the EPO


About a week later another letter was sent:

European Patent Office | 80298 MUNICH | GERMANY Mr António Campinos President of the EPO

By email

OPEN LETTER

Reference: sc22130cl Date: 28/10/2022

Demand for immediate execution of Judgment No.4551 (emails)

Dear Mr President,

In your letter of 30 September 2022, you allege that the Office is committed to executing Judgment No. 4551 of the Tribunal as swiftly and comprehensively as possible. Almost four months after the judgment, the Staff Committees are still waiting for its execution, i.e. restauration of the status quo ante as in Communiqué No. 10 of 29 March 2006, as ruled by the Tribunal.

It appears that you decided to maintain the limit of the number of email recipients to 50 and to add a “new feature” as a precondition for executing the judgment, i.e. to introduce a right for staff to unsubscribe from the relevant mailing lists. You try to justify the additional constraint imposed on the CSC with the right to privacy and data protection.

Official activities and the right to object

We note that you obviously chose to not invoke data protection and respect for private life before the ILOAT, so that there is actually no place for additional privacy pleadings at this stage. Nevertheless, we note the following:

● The CSC1 is not just an entity “like other entities”: it is a statutory body2 performing the functions assigned to it in Chapter of the Service Regulations3. They mainly consist in representing the interests of all staff and contributing to the smooth running of the service by providing a channel for the expression of opinion by the staff. The duties undertaken by its members are deemed to be part of their normal service and you must grant them the resources and facilities required to exercise their functions. Consequently, there can be no doubt that using official email addresses (...@epo.org) of employees for communicating with them is a processing for an official activity4.

___________ 1 The same applies to the four Local Staff Committees. 2 See Article 2(1) ServRegs. 3 See in particular Article 34 ServRegs. 4 The Data Protection Officer admits to this in her opinion, on page 5.




● The Service Regulations already contain provisions to protect fundamental rights and freedoms as well as personal data of employees in the course of their official activities, by giving them the right to object to the processing of any personal data relating to their particular situation5. This right, as currently codified, guarantees the balance of fundamental rights, including the right to privacy. We are committed to respecting this essential right like any other statutory body. However, obliging us to give employees an additional right not to have their official email address (...@epo.org) used if “they do not wish” to receive our emails (regardless of any particular individual situation) is an additional right different from the statutory right to object. It imposes on us an unnecessary and abusive precondition and therefore violates our right to freely choose the means by which communications are sent to all staff, as confirmed in the judgment6. In short, there is no need and no legal basis for any additional limitation on our right to communicate.

On 19 October, your administration has convened us to a meeting and disclosed their proposal, which is essentially to hire an external service provider managing distribution lists without us knowing how the lists will look like. Again, they mispresented the right to unsubscribe as subsumed under the right to object. We have already informed them that the implementation presented in the meeting was incompatible with the ruling of the Tribunal7.

The Data Protection Officer’s opinion You have sought the formal opinion of the Data Protection Officer (DPO) on two questions. We regret that her independence has led her to ignore the judgment and depart from the letter and spirit of the Service Regulations and the Data Protection Rules (DPR):

Question a: would a mass email sent to staff without any possibility for them to unsubscribe comply with the EPO data protection framework? The DPO does not answer the question with a clear “no”. Instead, she recommends that the way to balance the fundamental rights of data subjects to privacy and data protection with the fundamental right of freedom of speech would be to foresee an opt-out alternative because “the purpose and objective to inform the data subjects can be effectively accomplished using another less intrusive option (a different channel to

____ 5 See Article 1b(5) ServRegs: “Where personal data might lawfully be processed because processing is necessary to carry out tasks in the exercise of the official activities of the European Patent Organisation..., a data subject shall nevertheless be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject.” [emphasis added]. See also its implementing Article 23(1) DPR. 6 See considerations 10 and 12 in the judgment. 7 See our letter (sc22129cl) of 21 October 2022.




inform), namely by publishing the communications on a dedicated page on intranet.” This is in clear contradiction with the judgment8.

Question b: would a mass email sent to staff with an unsubscription option made available to them comply with the EPO data protection framework? In her three-line answer, the DPO associates an additional right to unsubscribe to the right to object. This contradicts the letter and the spirit of Article 1b(5) ServRegs and Article 5.a. DPR, according to which processing of email addresses for official activities is a priori lawful without that additional right comparable to free consent in accordance with Article 5.d.DPR. It also makes communication by email entirely dependent on the wish of employees.

Wider-ranging consequences

For reasons of equal treatment, the DPO recommends extending the additional right to unsubscribe also to communications coming from other statutory bodies9. Since a right to unsubscribe would belong to every employee as a data subject, there would be no legal basis for refusing this right to any recipient of any email sent for an official purpose, regardless of the number of simultaneous recipients. This would make job-related communication by email dysfunctional.

Conclusion

We therefore reiterate the demand made in two previous letters for the immediate execution of Judgment No. 4551, in its entirety and without any additional obstacles, which have no legal basis or justification whatsoever.

Sincerely yours,

The CSC

Yours sincerely, Alain Dumont

Chairman of the Central Staff Committee

____ 8 See consideration 12 in the judgment: “... In the present case, the alternative means offered by the Organisation consisted in an intranet webpage on the Organisation’s website. This is, manifestly, a less viable means of communication and, moreover, it is under the supervision and the management of the Organisation, and not under the complete control by and availability for the staff representatives”. 9 As in Article 2 ServRegs: for instance the GCC, the Appeals Committee, the Data Protection Board...


As a quick recap, this "data protection" charade of the EPO was introduced to cover up severe privacy violations by the EPO and that same charade is now being used to cover up the abuse. They try to have it both ways.

Recent Techrights' Posts

Topics We Lacked Time to Cover
Due to a Microsoft event (an annual malware fest for lobbying and marketing purposes) there was also a lot of Microsoft propaganda
EPO Education: Workers Resort to Legal Actions (Many Cases) Against the Administration
At the moment the casualties of EPO corruption include the EPO's own staff
 
Links 22/11/2024: Dynamic Pricing Practice and Monopoly Abuses
Links for the day
Microsofters Try to Defund the Free Software Foundation (by Attacking Its Founder This Week) and They Tell People to Instead Give Money to Microsoft Front Groups
Microsoft people try to outspend their critics and harass them
[Meme] EPO for the Kids' Future (or Lack of It)
Patents can last two decades and grow with (or catch up with) the kids
Gemini Links 22/11/2024: ChromeOS, Search Engines, Regular Expressions
Links for the day
This Month is the 11th Month of This Year With Mass Layoffs at Microsoft (So Far It's Happening Every Month This Year, More Announced Hours Ago)
Now they even admit it
Links 22/11/2024: Software Patents Squashed, Russia Starts Using ICBMs
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, November 21, 2024
IRC logs for Thursday, November 21, 2024
Gemini Links 21/11/2024: Alphabetising 400 Books and Giving the Internet up
Links for the day
Links 21/11/2024: TikTok Fighting Bans, Bluesky Failing Users
Links for the day
Links 21/11/2024: SpaceX Repeatedly Failing (Taxpayers Fund Failure), Russian Disinformation Spreading
Links for the day
Richard Stallman Earned Two More Honorary Doctorates Last Month
Two more doctorate degrees
KillerStartups.com is an LLM Spam Site That Sometimes Covers 'Linux' (Spams the Term)
It only serves to distract from real articles
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, November 20, 2024
IRC logs for Wednesday, November 20, 2024
Gemini Links 20/11/2024: Game Recommendations, Schizo Language
Links for the day
Growing Older and Signs of the Site's Maturity
The EPO material remains our top priority
Did Microsoft 'Buy' Red Hat Without Paying for It? Does It Tell Canonical What to Do Now?
This is what Linus Torvalds once dubbed a "dick-sucking" competition or contest (alluding to Red Hat's promotion of UEFI 'secure boot')
Links 20/11/2024: Politics, Toolkits, and Gemini Journals
Links for the day
Links 20/11/2024: 'The Open Source Definition' and Further Escalations in Ukraine/Russia Battles
Links for the day
[Meme] Many Old Gemini Capsules Go Offline, But So Do Entire Web Sites
Problems cannot be addressed and resolved if merely talking about these problems isn't allowed
Links 20/11/2024: Standing Desks, Broken Cables, and Journalists Attacked Some More
Links for the day
Links 20/11/2024: Debt Issues and Fentanylware (TikTok) Ban
Links for the day
Jérémy Bobbio (Lunar), Magna Carta and Debian Freedoms: RIP
Reprinted with permission from Daniel Pocock
Jérémy Bobbio (Lunar) & Debian: from Frans Pop to Euthanasia
Reprinted with permission from Daniel Pocock
This Article About "AI-Powered" is Itself LLM-Generated Junk
Trying to meet quotas by making fake 'articles' that are - in effect - based on plagiarism?
Recognizing invalid legal judgments: rogue Debianists sought to deceive one of Europe's most neglected regions, Midlands-North-West
Reprinted with permission from Daniel Pocock
Google-funded group distributed invalid Swiss judgment to deceive Midlands-North-West
Reprinted with permission from Daniel Pocock
Gemini Links 20/11/2024: BeagleBone Black and Suicide Rates in Switzerland
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, November 19, 2024
IRC logs for Tuesday, November 19, 2024