93aae076d331e004afa0e3191e017157
EPO Hiding Abuse Under Guise of Privacy
Creative Commons Attribution-No Derivative Works 4.0
THE subject of the above video and of this post may seem old as the problem has been going on for months already. The "f**king president" António Campinos (he is calling himself "the f**king president") won't budge; he ignores the court's ruling and tries to spin his strategy as a compliance with the ruling, in effect covering up for Benoît Battistelli, who gave him the job.
Execution of Judgment No. 4551 (mass emails): Additional constraints without legal basis
Dear colleagues,
In a letter of 30 September 2022, the President alleges that the Office is committed to executing Judgment No. 4551 of the Tribunal as swiftly and comprehensively as possible. Almost four months after the judgment, the Staff Committees are still waiting for its execution. The President has decided to maintain the limit of the number of email recipients to 50 and to add a “new feature” as a precondition for executing the judgment, i.e. to introduce a right for staff to unsubscribe from the CSC mailing lists. He tries to justify the additional constraint imposed on the CSC (and the LSCs) with the right to privacy and data protection.
The Data Protection Officer supports the “new feature” in her opinion of 15 September. For our part, we regret that her independence has led her to ignore the judgment and depart from the letter and spirit of the Service Regulations and the Data Protection Rules.
With this open letter, we hope that the President will finally understand why a right for staff to freely unsubscribe from job-related emails has no legal basis or justification whatsoever and we reiterate the demand made in two previous letters (letter of 28 July and letter of 6 September) for the immediate execution of Judgment No. 4551. Our standpoint was also expressed in this letter of 21 October following a meeting with the administration on the topic.
European Patent Office | 80298 MUNICH | GERMANY
Mr Alain Dumont Chair of the Central Staff Committee
By email to: centalstcom@epo.org
president@epo.org Date: 30.09.2022
Your letters dated 28 July and 6 September 2022
Dear Mr Chair,
Reference is made to your letters dated 28 July and 06 September 2022 regarding the execution of ILOAT J. No. 4551 on mass emails. In this letter, you demand the judgment to be immediately executed and contend that there are no legal or technical requirements preventing such immediate execution.
As you know, the Office is committed to executing the judgments of the Tribunal as swifly and comprehensively as possible, and to draw all consequences from its findings. In the case at hand, this concretely means that the ban on mass emails is to be lifted and that the Staff Committees will now have the possibility to send emails to more than 50 recipients without prior authorisation.
However, as already explained in a letter dated 22 July 2022 and during our meeting on 25 July 2022, there are aspects which need to be addressed before this possibility becomes feasible. The formal opinion of the DPO was therefore sought in relation to the option for staff to unsubscribe from the relevant mailing lists and the changes needed to the Staff Committee’s data protection statement.
First, on the possibility for staff to unsubscribe, there was indeed no such requirement under the previous rules. However, and as explained by the DPO in a formal opinion dated 15 September 2022 (enclosed to this letter), with the adoption of the DPR and the inclusion of Art. 1b in the Service Regulations on 1 January 2022, additional safeguards and rules have been put in place to protect the employees’ right to privacy and the processing of their personal data.
The possibility to unsubscribe will guarantee that staff remain in control of their personal data without limiting the right to free communication and speech of the Staff Committees. In other words, the Staff Committees and other entities will be able to send mass emails, while employees will be given the possibility not to have their email address used for this purpose if they do not wish to, in accordance with the right to privacy and data protection.
This new feature means that separate mailing lists will have to be administered for each entity concerned and it is foreseen that a third-party application will be procured, in order for the maintenance of these lists to be fully automated. The necessary tool will be put in place by 1 November 2022 and staff representatives will be offered training on the use of the tool within this timeframe, should they wish to.
Second, although the Staff Committes will not collect and store personal data while using the mailing lists to send mass emails, using that data for the specific purpose of sending emails constitutes processing. The Data Protection Statement which the Chairs of the CSC and LSCs are currently preparing with the support of the DPO should therefore include the use of the relevant mailing lists for the purpose of sending emails.
Finally, it should be noted that Communiqué No. 10 of 29 March 2006 has been superseded by Circular No. 382 and its contents integrated therein. Both this Circular and the general guidelines on mass emails will have to be slightly amended notably to reflect data protection requirements.
The Office trusts the above will shed some light on the steps which still need to be taken before the Staff Committees can effectively start sending mass emails to the staff. A meeting will in any case be organised with PD08 and DPO to keep you updated on the matter and address any question you may have.
Yours sincerely,
António Campinos
Encl.: Formal opinion of the DPO dated 15 September 2022
European Patent Office | 80298 MUNICH | GERMANY
Mr Laurent Germond (PD Employment Law and Social Dialogue) Mr Diego Eguidazu Alonso (CIO) Ms Mariya Koleva (DPO)
By email
Reference: sc22129cl Date: 21/10/2022
Meeting of 19-10-2022 titled “Meeting on the implementation of J. 4551”
Dear colleagues,
Thank you for the meeting of 19 October 2022.
Our participants sat together to summarise the main points as they were understood in the meeting. According to our understanding:
On data protection
- The Data Protection Officer confirmed her position that staff representation is considered as performing “direct marketing” (Article 37(2) DPR) when sending emails, from which staff members must be given the possibility to unsubscribe. - The solution chosen by the administration will involve a third-party provider using a commercial software tool; - The CSC and each LSC will be the delegated controller for using the third-party provider. Each committee needs to have an agreed data protection statement governing its use of the third-party provider. This documentation needs to be finalised and approved before using the third-party provider; - The third-party provider will be the processor responsible for sending a requested mass email; - BIT staff – the same team currently handling the EPO email system – will also be processor by providing the third-party provider with the email addresses of new colleagues joining the EPO in order to have them added to the list(s). Similarly, BIT staff will communicate the email addresses of colleagues terminating service at the EPO to have them removed from these lists; - No benchmark was carried out by the administration towards other International Organisation (IO), as their Data Protection rules are different. The administration stated that some IOs have an ‘unsubscribe’ option, some do not; that some do permit mass email to staff and some do not (no specific names of other IOs were mentioned in either cases); - The same system may be applied to all statutory bodies and the Amicale whenever they desire to make use of the third-party mass-email provider. Discussions to this effect are taking place with the Amicale; - The administration aims to have this system in place by the 1st of November; - The administration confirmed that the 50-recipient limit will remain in the EPO email system;
On the technicalities
- The handling of staff actively unsubscribing or resubscribing is done by the third-party provider. - Neither staff representation nor the administration shall be aware of the content of the mailing-lists stored by the third-party provider; - Specific aliases will be set up for the CSC and each LSC. - Only whitelisted email accounts can send an email request for mass email distribution to this(ese) specific alias(es). The CSC and each respective LSC will decide which (individual) email accounts and/or the (xxx)stcom email account shall be whitelisted; - The format and content of the email shall remain unmodified by the third-party provider and are entirely the responsibility of the staff committee/staff representative sending; - The third-party provider automatically injects a footer containing a link to the data protection statement governing the use of the third-party provider and a link permitting staff to unsubscribe; - Communications from staff representation could include a link to re-subscribe for staff that unsubscribed from the mass mails; - The administration has decided to limit the number of authorised attachments to one only. The system will not allow multiple attachments; links to documents/publications should be used instead. - Inline images (e.g. logos) may be possible, details on size limitations will be communicated once the tool is known; - It is still not yet clear if and how staff committees will be able to receive single identifiable answers from EPO employees who received an email from the third-party provider; - There is no final agreement yet on the third-party provider, so the details of the system that will be put in place are not entirely known yet and shall be communicated as soon as the agreement with the provider is concluded; - At present, it is foreseen to have a central list (all staff), and then a list per place of employment (Munich, The Hague, Vienna and Berlin). Further segmentation (e.g. staff per DG, or staff in Haar or Brussels) is presently not foreseen. Requests to this effect should be brought forward to the DPO but staff representation is asked to take care not to have too many different lists setup; - Rather than segmenting, the administration suggested to e.g. start an email with a sentence to this effect “This email is specifically relevant for staff in xxx” – which would allow other staff to decide whether or not to read further; - There is currently no provision for a ‘mail merge’ system – not in place at the EPO for any service at present. Should this be needed (e.g. for setting up a survey which sends an individualised email to each account), then a specific request to this effect needs to be made. This is considered as falling outside of the remit of mass emails;
Miscellanea
- The Service Regulations including Circular 382 will be adapted. It is in preparation for the agenda for the GCC of 22 November, and shall be in place before the end of 2022. Principles of the necessary amendments are known and should not be blocking the implementation of the chosen solution; - Once the provider has been chosen, the details and limitations of the system shall be shared on e.g. handling of answers, limitations to (inline) images, technical documentation; - The possibility to segment/target emails needs to be elaborated upon; - Each committee is requested to have an approved data protection statement in place before the system can be put in operation; - The PowerPoint presentation that was given at the start of the meeting will be shared with the participants.
The CSC standpoint
The Office has obviously not yet finalised its proposal for a solution. However, we fail to see how it could be considered an implementation of Judgment 4551, in which the Tribunal recalled (considerations 10 and 12) that freedom of communication implies the right to freely choose the means by which communications are sent to all staff.
The meeting was nevertheless useful in that it reveals some concrete features of the “solution” that the Office contemplates to implement the Judgment, as announced in the President’s letter of 30 September 2022. It is our duty to stress that it relies on the wrong assumption that the CSC would send emails to staff “for marketing purposes”. On the contrary, the CSC insists that sending emails is a task carried out in the exercise of the official activities of a statutory body of the EPO, which is therefore lawful without any need for an “unsubscribe” constraint imposed by the administration.
In conclusion, the implementation presented in the meeting is incompatible with the ruling of the Tribunal.
Yours sincerely,
Alain Dumont
Chairman of the Central Staff Committee .cc Mr António Campinos, President of the EPO
European Patent Office | 80298 MUNICH | GERMANY Mr António Campinos President of the EPO
By email
OPEN LETTER
Reference: sc22130cl Date: 28/10/2022
Demand for immediate execution of Judgment No.4551 (emails)
Dear Mr President,
In your letter of 30 September 2022, you allege that the Office is committed to executing Judgment No. 4551 of the Tribunal as swiftly and comprehensively as possible. Almost four months after the judgment, the Staff Committees are still waiting for its execution, i.e. restauration of the status quo ante as in Communiqué No. 10 of 29 March 2006, as ruled by the Tribunal.
It appears that you decided to maintain the limit of the number of email recipients to 50 and to add a “new feature” as a precondition for executing the judgment, i.e. to introduce a right for staff to unsubscribe from the relevant mailing lists. You try to justify the additional constraint imposed on the CSC with the right to privacy and data protection.
Official activities and the right to object
We note that you obviously chose to not invoke data protection and respect for private life before the ILOAT, so that there is actually no place for additional privacy pleadings at this stage. Nevertheless, we note the following:
● The CSC1 is not just an entity “like other entities”: it is a statutory body2 performing the functions assigned to it in Chapter of the Service Regulations3. They mainly consist in representing the interests of all staff and contributing to the smooth running of the service by providing a channel for the expression of opinion by the staff. The duties undertaken by its members are deemed to be part of their normal service and you must grant them the resources and facilities required to exercise their functions. Consequently, there can be no doubt that using official email addresses (...@epo.org) of employees for communicating with them is a processing for an official activity4.
___________ 1 The same applies to the four Local Staff Committees. 2 See Article 2(1) ServRegs. 3 See in particular Article 34 ServRegs. 4 The Data Protection Officer admits to this in her opinion, on page 5.
● The Service Regulations already contain provisions to protect fundamental rights and freedoms as well as personal data of employees in the course of their official activities, by giving them the right to object to the processing of any personal data relating to their particular situation5. This right, as currently codified, guarantees the balance of fundamental rights, including the right to privacy. We are committed to respecting this essential right like any other statutory body. However, obliging us to give employees an additional right not to have their official email address (...@epo.org) used if “they do not wish” to receive our emails (regardless of any particular individual situation) is an additional right different from the statutory right to object. It imposes on us an unnecessary and abusive precondition and therefore violates our right to freely choose the means by which communications are sent to all staff, as confirmed in the judgment6. In short, there is no need and no legal basis for any additional limitation on our right to communicate.
On 19 October, your administration has convened us to a meeting and disclosed their proposal, which is essentially to hire an external service provider managing distribution lists without us knowing how the lists will look like. Again, they mispresented the right to unsubscribe as subsumed under the right to object. We have already informed them that the implementation presented in the meeting was incompatible with the ruling of the Tribunal7.
The Data Protection Officer’s opinion You have sought the formal opinion of the Data Protection Officer (DPO) on two questions. We regret that her independence has led her to ignore the judgment and depart from the letter and spirit of the Service Regulations and the Data Protection Rules (DPR):
● Question a: would a mass email sent to staff without any possibility for them to unsubscribe comply with the EPO data protection framework? The DPO does not answer the question with a clear “no”. Instead, she recommends that the way to balance the fundamental rights of data subjects to privacy and data protection with the fundamental right of freedom of speech would be to foresee an opt-out alternative because “the purpose and objective to inform the data subjects can be effectively accomplished using another less intrusive option (a different channel to
____ 5 See Article 1b(5) ServRegs: “Where personal data might lawfully be processed because processing is necessary to carry out tasks in the exercise of the official activities of the European Patent Organisation..., a data subject shall nevertheless be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject.” [emphasis added]. See also its implementing Article 23(1) DPR. 6 See considerations 10 and 12 in the judgment. 7 See our letter (sc22129cl) of 21 October 2022.
inform), namely by publishing the communications on a dedicated page on intranet.” This is in clear contradiction with the judgment8.
● Question b: would a mass email sent to staff with an unsubscription option made available to them comply with the EPO data protection framework? In her three-line answer, the DPO associates an additional right to unsubscribe to the right to object. This contradicts the letter and the spirit of Article 1b(5) ServRegs and Article 5.a. DPR, according to which processing of email addresses for official activities is a priori lawful without that additional right comparable to free consent in accordance with Article 5.d.DPR. It also makes communication by email entirely dependent on the wish of employees.
Wider-ranging consequences
For reasons of equal treatment, the DPO recommends extending the additional right to unsubscribe also to communications coming from other statutory bodies9. Since a right to unsubscribe would belong to every employee as a data subject, there would be no legal basis for refusing this right to any recipient of any email sent for an official purpose, regardless of the number of simultaneous recipients. This would make job-related communication by email dysfunctional.
Conclusion
We therefore reiterate the demand made in two previous letters for the immediate execution of Judgment No. 4551, in its entirety and without any additional obstacles, which have no legal basis or justification whatsoever.
Sincerely yours,
The CSC
Yours sincerely, Alain Dumont
Chairman of the Central Staff Committee
____ 8 See consideration 12 in the judgment: “... In the present case, the alternative means offered by the Organisation consisted in an intranet webpage on the Organisation’s website. This is, manifestly, a less viable means of communication and, moreover, it is under the supervision and the management of the Organisation, and not under the complete control by and availability for the staff representatives”. 9 As in Article 2 ServRegs: for instance the GCC, the Appeals Committee, the Data Protection Board...