Bonum Certa Men Certa

Privacy Law Isn't Meant to Protect EPO Management From Prosecution/Accountability

Video download link | md5sum 93aae076d331e004afa0e3191e017157 EPO Hiding Abuse Under Guise of Privacy Creative Commons Attribution-No Derivative Works 4.0



Summary: The big EPO scandal of the year -- namely denying communication between staff and the representatives -- is far from resolved and it seems like it'll be dragged on for another year, reaffirming accusations that the EPO not only breaks the law but also refuses to obey court orders when the actions are deemed illegal

THE subject of the above video and of this post may seem old as the problem has been going on for months already. The "f**king president" António Campinos (he is calling himself "the f**king president") won't budge; he ignores the court's ruling and tries to spin his strategy as a compliance with the ruling, in effect covering up for Benoît Battistelli, who gave him the job.



As promised when recording the above video (always done prior to writing the text), here are the previously-unseen communications on the matter. The staff representatives added some more documents for context. The Central Staff Committee wrote:

Execution of Judgment No. 4551 (mass emails): Additional constraints without legal basis



Dear colleagues,

In a letter of 30 September 2022, the President alleges that the Office is committed to executing Judgment No. 4551 of the Tribunal as swiftly and comprehensively as possible. Almost four months after the judgment, the Staff Committees are still waiting for its execution. The President has decided to maintain the limit of the number of email recipients to 50 and to add a “new feature” as a precondition for executing the judgment, i.e. to introduce a right for staff to unsubscribe from the CSC mailing lists. He tries to justify the additional constraint imposed on the CSC (and the LSCs) with the right to privacy and data protection.

The Data Protection Officer supports the “new feature” in her opinion of 15 September. For our part, we regret that her independence has led her to ignore the judgment and depart from the letter and spirit of the Service Regulations and the Data Protection Rules.

With this open letter, we hope that the President will finally understand why a right for staff to freely unsubscribe from job-related emails has no legal basis or justification whatsoever and we reiterate the demand made in two previous letters (letter of 28 July and letter of 6 September) for the immediate execution of Judgment No. 4551. Our standpoint was also expressed in this letter of 21 October following a meeting with the administration on the topic.


6 documents are referenced there.

First of all, it seems clear that the so-called 'privacy' expert of the Office uses Microsoft Office -- in itself part of the EPO's surveillance blunder. This was written using Microsoft Word (likely GDPR violation) by "Data Protection Officer" (so-called) and "Digitally signed by" Microsoft "Mariya KOLEVA". It's the person whose job is to cover up the EPO's severe privacy abuses, which we covered before (it led to legal challenges and investigations, then a bunch of PR charades from the EPO). They work very hard to avoid compliance rather than attain compliance.

The September letter from staff was covered in this video at the time. An additional letter (from July) had been covered in this video back in August.

That leaves us with just 3 letters to share, starting with Campinos in September:

European Patent Office | 80298 MUNICH | GERMANY

Mr Alain Dumont Chair of the Central Staff Committee

By email to: centalstcom@epo.org

president@epo.org Date: 30.09.2022

Your letters dated 28 July and 6 September 2022

Dear Mr Chair,

Reference is made to your letters dated 28 July and 06 September 2022 regarding the execution of ILOAT J. No. 4551 on mass emails. In this letter, you demand the judgment to be immediately executed and contend that there are no legal or technical requirements preventing such immediate execution.

As you know, the Office is committed to executing the judgments of the Tribunal as swifly and comprehensively as possible, and to draw all consequences from its findings. In the case at hand, this concretely means that the ban on mass emails is to be lifted and that the Staff Committees will now have the possibility to send emails to more than 50 recipients without prior authorisation.

However, as already explained in a letter dated 22 July 2022 and during our meeting on 25 July 2022, there are aspects which need to be addressed before this possibility becomes feasible. The formal opinion of the DPO was therefore sought in relation to the option for staff to unsubscribe from the relevant mailing lists and the changes needed to the Staff Committee’s data protection statement.

First, on the possibility for staff to unsubscribe, there was indeed no such requirement under the previous rules. However, and as explained by the DPO in a formal opinion dated 15 September 2022 (enclosed to this letter), with the adoption of the DPR and the inclusion of Art. 1b in the Service Regulations on 1 January 2022, additional safeguards and rules have been put in place to protect the employees’ right to privacy and the processing of their personal data.

The possibility to unsubscribe will guarantee that staff remain in control of their personal data without limiting the right to free communication and speech of the Staff Committees. In other words, the Staff Committees and other entities will be able to send mass emails, while employees will be given the possibility not to have their email address used for this purpose if they do not wish to, in accordance with the right to privacy and data protection.

This new feature means that separate mailing lists will have to be administered for each entity concerned and it is foreseen that a third-party application will be procured, in order for the maintenance of these lists to be fully automated. The necessary tool will be put in place by 1 November 2022 and staff representatives will be offered training on the use of the tool within this timeframe, should they wish to.

Second, although the Staff Committes will not collect and store personal data while using the mailing lists to send mass emails, using that data for the specific purpose of sending emails constitutes processing. The Data Protection Statement which the Chairs of the CSC and LSCs are currently preparing with the support of the DPO should therefore include the use of the relevant mailing lists for the purpose of sending emails.

Finally, it should be noted that Communiqué No. 10 of 29 March 2006 has been superseded by Circular No. 382 and its contents integrated therein. Both this Circular and the general guidelines on mass emails will have to be slightly amended notably to reflect data protection requirements.

The Office trusts the above will shed some light on the steps which still need to be taken before the Staff Committees can effectively start sending mass emails to the staff. A meeting will in any case be organised with PD08 and DPO to keep you updated on the matter and address any question you may have.

Yours sincerely,

António Campinos

Encl.: Formal opinion of the DPO dated 15 September 2022


"Formal opinion of the DPO" as in wasting EPO money coming up with excuses to not obey court rulings. A friend of Campinos gets that money. Quite frankly as usual...

Here are two replies from the staff representatives, starting with the 21st of October:

European Patent Office | 80298 MUNICH | GERMANY

Mr Laurent Germond (PD Employment Law and Social Dialogue) Mr Diego Eguidazu Alonso (CIO) Ms Mariya Koleva (DPO)

By email

Reference: sc22129cl Date: 21/10/2022

Meeting of 19-10-2022 titled “Meeting on the implementation of J. 4551”

Dear colleagues,

Thank you for the meeting of 19 October 2022.

Our participants sat together to summarise the main points as they were understood in the meeting. According to our understanding:

On data protection

- The Data Protection Officer confirmed her position that staff representation is considered as performing “direct marketing” (Article 37(2) DPR) when sending emails, from which staff members must be given the possibility to unsubscribe. - The solution chosen by the administration will involve a third-party provider using a commercial software tool; - The CSC and each LSC will be the delegated controller for using the third-party provider. Each committee needs to have an agreed data protection statement governing its use of the third-party provider. This documentation needs to be finalised and approved before using the third-party provider; - The third-party provider will be the processor responsible for sending a requested mass email; - BIT staff – the same team currently handling the EPO email system – will also be processor by providing the third-party provider with the email addresses of new colleagues joining the EPO in order to have them added to the list(s). Similarly, BIT staff will communicate the email addresses of colleagues terminating service at the EPO to have them removed from these lists; - No benchmark was carried out by the administration towards other International Organisation (IO), as their Data Protection rules are different. The administration stated that some IOs have an ‘unsubscribe’ option, some do not; that some do permit mass email to staff and some do not (no specific names of other IOs were mentioned in either cases); - The same system may be applied to all statutory bodies and the Amicale whenever they desire to make use of the third-party mass-email provider. Discussions to this effect are taking place with the Amicale; - The administration aims to have this system in place by the 1st of November; - The administration confirmed that the 50-recipient limit will remain in the EPO email system;

On the technicalities

- The handling of staff actively unsubscribing or resubscribing is done by the third-party provider. - Neither staff representation nor the administration shall be aware of the content of the mailing-lists stored by the third-party provider; - Specific aliases will be set up for the CSC and each LSC. - Only whitelisted email accounts can send an email request for mass email distribution to this(ese) specific alias(es). The CSC and each respective LSC will decide which (individual) email accounts and/or the (xxx)stcom email account shall be whitelisted; - The format and content of the email shall remain unmodified by the third-party provider and are entirely the responsibility of the staff committee/staff representative sending; - The third-party provider automatically injects a footer containing a link to the data protection statement governing the use of the third-party provider and a link permitting staff to unsubscribe; - Communications from staff representation could include a link to re-subscribe for staff that unsubscribed from the mass mails; - The administration has decided to limit the number of authorised attachments to one only. The system will not allow multiple attachments; links to documents/publications should be used instead. - Inline images (e.g. logos) may be possible, details on size limitations will be communicated once the tool is known; - It is still not yet clear if and how staff committees will be able to receive single identifiable answers from EPO employees who received an email from the third-party provider; - There is no final agreement yet on the third-party provider, so the details of the system that will be put in place are not entirely known yet and shall be communicated as soon as the agreement with the provider is concluded; - At present, it is foreseen to have a central list (all staff), and then a list per place of employment (Munich, The Hague, Vienna and Berlin). Further segmentation (e.g. staff per DG, or staff in Haar or Brussels) is presently not foreseen. Requests to this effect should be brought forward to the DPO but staff representation is asked to take care not to have too many different lists setup; - Rather than segmenting, the administration suggested to e.g. start an email with a sentence to this effect “This email is specifically relevant for staff in xxx” – which would allow other staff to decide whether or not to read further; - There is currently no provision for a ‘mail merge’ system – not in place at the EPO for any service at present. Should this be needed (e.g. for setting up a survey which sends an individualised email to each account), then a specific request to this effect needs to be made. This is considered as falling outside of the remit of mass emails;

Miscellanea

- The Service Regulations including Circular 382 will be adapted. It is in preparation for the agenda for the GCC of 22 November, and shall be in place before the end of 2022. Principles of the necessary amendments are known and should not be blocking the implementation of the chosen solution; - Once the provider has been chosen, the details and limitations of the system shall be shared on e.g. handling of answers, limitations to (inline) images, technical documentation; - The possibility to segment/target emails needs to be elaborated upon; - Each committee is requested to have an approved data protection statement in place before the system can be put in operation; - The PowerPoint presentation that was given at the start of the meeting will be shared with the participants.

The CSC standpoint

The Office has obviously not yet finalised its proposal for a solution. However, we fail to see how it could be considered an implementation of Judgment 4551, in which the Tribunal recalled (considerations 10 and 12) that freedom of communication implies the right to freely choose the means by which communications are sent to all staff.

The meeting was nevertheless useful in that it reveals some concrete features of the “solution” that the Office contemplates to implement the Judgment, as announced in the President’s letter of 30 September 2022. It is our duty to stress that it relies on the wrong assumption that the CSC would send emails to staff “for marketing purposes”. On the contrary, the CSC insists that sending emails is a task carried out in the exercise of the official activities of a statutory body of the EPO, which is therefore lawful without any need for an “unsubscribe” constraint imposed by the administration.

In conclusion, the implementation presented in the meeting is incompatible with the ruling of the Tribunal.

Yours sincerely,

Alain Dumont

Chairman of the Central Staff Committee .cc Mr António Campinos, President of the EPO


About a week later another letter was sent:

European Patent Office | 80298 MUNICH | GERMANY Mr António Campinos President of the EPO

By email

OPEN LETTER

Reference: sc22130cl Date: 28/10/2022

Demand for immediate execution of Judgment No.4551 (emails)

Dear Mr President,

In your letter of 30 September 2022, you allege that the Office is committed to executing Judgment No. 4551 of the Tribunal as swiftly and comprehensively as possible. Almost four months after the judgment, the Staff Committees are still waiting for its execution, i.e. restauration of the status quo ante as in Communiqué No. 10 of 29 March 2006, as ruled by the Tribunal.

It appears that you decided to maintain the limit of the number of email recipients to 50 and to add a “new feature” as a precondition for executing the judgment, i.e. to introduce a right for staff to unsubscribe from the relevant mailing lists. You try to justify the additional constraint imposed on the CSC with the right to privacy and data protection.

Official activities and the right to object

We note that you obviously chose to not invoke data protection and respect for private life before the ILOAT, so that there is actually no place for additional privacy pleadings at this stage. Nevertheless, we note the following:

● The CSC1 is not just an entity “like other entities”: it is a statutory body2 performing the functions assigned to it in Chapter of the Service Regulations3. They mainly consist in representing the interests of all staff and contributing to the smooth running of the service by providing a channel for the expression of opinion by the staff. The duties undertaken by its members are deemed to be part of their normal service and you must grant them the resources and facilities required to exercise their functions. Consequently, there can be no doubt that using official email addresses (...@epo.org) of employees for communicating with them is a processing for an official activity4.

___________ 1 The same applies to the four Local Staff Committees. 2 See Article 2(1) ServRegs. 3 See in particular Article 34 ServRegs. 4 The Data Protection Officer admits to this in her opinion, on page 5.




● The Service Regulations already contain provisions to protect fundamental rights and freedoms as well as personal data of employees in the course of their official activities, by giving them the right to object to the processing of any personal data relating to their particular situation5. This right, as currently codified, guarantees the balance of fundamental rights, including the right to privacy. We are committed to respecting this essential right like any other statutory body. However, obliging us to give employees an additional right not to have their official email address (...@epo.org) used if “they do not wish” to receive our emails (regardless of any particular individual situation) is an additional right different from the statutory right to object. It imposes on us an unnecessary and abusive precondition and therefore violates our right to freely choose the means by which communications are sent to all staff, as confirmed in the judgment6. In short, there is no need and no legal basis for any additional limitation on our right to communicate.

On 19 October, your administration has convened us to a meeting and disclosed their proposal, which is essentially to hire an external service provider managing distribution lists without us knowing how the lists will look like. Again, they mispresented the right to unsubscribe as subsumed under the right to object. We have already informed them that the implementation presented in the meeting was incompatible with the ruling of the Tribunal7.

The Data Protection Officer’s opinion You have sought the formal opinion of the Data Protection Officer (DPO) on two questions. We regret that her independence has led her to ignore the judgment and depart from the letter and spirit of the Service Regulations and the Data Protection Rules (DPR):

Question a: would a mass email sent to staff without any possibility for them to unsubscribe comply with the EPO data protection framework? The DPO does not answer the question with a clear “no”. Instead, she recommends that the way to balance the fundamental rights of data subjects to privacy and data protection with the fundamental right of freedom of speech would be to foresee an opt-out alternative because “the purpose and objective to inform the data subjects can be effectively accomplished using another less intrusive option (a different channel to

____ 5 See Article 1b(5) ServRegs: “Where personal data might lawfully be processed because processing is necessary to carry out tasks in the exercise of the official activities of the European Patent Organisation..., a data subject shall nevertheless be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject.” [emphasis added]. See also its implementing Article 23(1) DPR. 6 See considerations 10 and 12 in the judgment. 7 See our letter (sc22129cl) of 21 October 2022.




inform), namely by publishing the communications on a dedicated page on intranet.” This is in clear contradiction with the judgment8.

Question b: would a mass email sent to staff with an unsubscription option made available to them comply with the EPO data protection framework? In her three-line answer, the DPO associates an additional right to unsubscribe to the right to object. This contradicts the letter and the spirit of Article 1b(5) ServRegs and Article 5.a. DPR, according to which processing of email addresses for official activities is a priori lawful without that additional right comparable to free consent in accordance with Article 5.d.DPR. It also makes communication by email entirely dependent on the wish of employees.

Wider-ranging consequences

For reasons of equal treatment, the DPO recommends extending the additional right to unsubscribe also to communications coming from other statutory bodies9. Since a right to unsubscribe would belong to every employee as a data subject, there would be no legal basis for refusing this right to any recipient of any email sent for an official purpose, regardless of the number of simultaneous recipients. This would make job-related communication by email dysfunctional.

Conclusion

We therefore reiterate the demand made in two previous letters for the immediate execution of Judgment No. 4551, in its entirety and without any additional obstacles, which have no legal basis or justification whatsoever.

Sincerely yours,

The CSC

Yours sincerely, Alain Dumont

Chairman of the Central Staff Committee

____ 8 See consideration 12 in the judgment: “... In the present case, the alternative means offered by the Organisation consisted in an intranet webpage on the Organisation’s website. This is, manifestly, a less viable means of communication and, moreover, it is under the supervision and the management of the Organisation, and not under the complete control by and availability for the staff representatives”. 9 As in Article 2 ServRegs: for instance the GCC, the Appeals Committee, the Data Protection Board...


As a quick recap, this "data protection" charade of the EPO was introduced to cover up severe privacy violations by the EPO and that same charade is now being used to cover up the abuse. They try to have it both ways.

Recent Techrights' Posts

Why Virtually All the Wikileaks Copycats, Forks, and Rivals Basically Perished
Cryptome is like the "grandpa" of them all
In the United Kingdom Google Search Rises to All-Time High, Microsoft Fell Nearly 1.5% Since the LLM Hype Began
Microsoft is going to need actual products or it will gradually vanish from the market
When Wikileaks Sources Were Actually Murdered and Wikileaks Was Still a Wiki
when Wikileaks was a young site and still an actual wiki
Why the Media is Dying (It Sucks, No Mentally Healthy People Will Tolerate This for Long)
linking to actual news articles helps fuel the spam, too
 
Links 24/07/2024: Many New Attacks on Journalists, "Private Companies Own The Law"
Links for the day
Gemini Links 24/07/2024: Face à Gaïa, Emacs Timers for Weekly Event, Chromebook Survives Water Torture
Links for the day
A Total Lack of Transparency: Open and Free Technology Community (OFTC) Fails to Explain Why Over 60% of Users Are Gone (Since a Week Ago)
IRC giants have fallen
Trying to Put Out the Fire at Microsoft
Microsoft is drowning in debt while laying off loads of staff, hoping it can turn things around
GNU/Linux Growing at Vista 11's Expense
it's tempting to deduce many people who got PCs with Vista 11 preinstalled are deleting it, only to replace it with GNU/Linux
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, July 23, 2024
IRC logs for Tuesday, July 23, 2024
[Meme] Was He So Productive He Had to be Expelled Somehow? (After He Was Elected and Had Given Many Years of Work to Earn a Board Seat)
Things like these seem to lessen the incentive to devote one's life to Free software projects
GNOME Foundation is Causing Itself More Embarrassment With Secrecy Than With Full Transparency
It also arouses suspicion and hostility towards Codes of Conduct, which gave rise to 'secret courts' governed by large corporations
Links 23/07/2024: NetherRealm Layoffs and Illegitimate Patent 'Courts' (Illegal)
Links for the day
Gemini Links 23/07/2024: AM Radio, ngIRCd, and Munin
Links for the day
A Lot of GNU/Linux Growth on the Client Side is Owing to India (Where GNU/Linux Has Reached 16%)
A lot of this happened in recent years
Insulting Free Software Users in Social Control Media (Proprietary, Bloated With Opaque JavaScript) is Like Insulting Amish on TV
Why bother? Don't take the bait.
statCounter: Dutch GNU/Linux Usage Surged 1% in Summer
Microsoft is running out of things to actually sell
Microsoft's "Results" Next Week Will be Ugly (But It'll Lie About Them, as Usual)
Where can Microsoft find income rather than losses as its debt continues to grow and layoffs accelerate?
Julian Assange is Still Being Dehumanised in Media Whose Owners Wikileaks Berated (With Underlying Facts or Leaks)
Wikileaks and Free software aren't the same thing. Nevertheless, the tactics used to infiltrate or discredit both ought to be understood.
A Month Later
We're optimistic on many fronts
Links 23/07/2024: Downsizing and Microsoft and Still Damage Control
Links for the day
Gemini Links 23/07/2024: Friends and Solitaire
Links for the day
Censorship in Eklektix's Linux Weekly News (LWN)
Medieval system of speech, where the monarchs (Linux Foundation) dictate what's permissible to say
10 Years of In-Depth EPO Coverage at Techrights (Many Others Have Abandoned the Topic)
Listen to staff
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, July 22, 2024
IRC logs for Monday, July 22, 2024
[Meme] The Latest in the Microsoft Windows Blame Game
Microsoft found the culprit and came to everyone's rescue!
Links 22/07/2024: Overworking and Performance Issues From Europe
Links for the day
Microsoft Eliminates 67% of the Building Occupancy - That's Some Truly Massive Layoffs
Half a dozen floors? Microsoft cuts that down to two.
[Meme] Signs of a Dying Patent Office
"Bribe the media to say you excel"
This Month's General Consultative Committee (GCC) Webchat ('Meeting') Covered the European Patent Office's Attacks on Its Own Interpreters
The Central Staff Committee is currently circulating a report with appendices about the GCC meeting [sic] (webchat) that took place less than a fortnight ago
A Byzantine European Patent Office Where Staff Must Beg for Help With Contraception (Worse Than the Rest of Europe)
The Central Staff Committee (EPO staff representation) has just circulated a report
[Teaser] EPO Run by Children
"Daddy, why was I born?"
Let's Encrypt About to Fall Below 100 (Capsules) in Geminispace, It's Basically in a Freefall
The "self-signed" portion keeps growing
Gemini Links 22/07/2024: Spacewalk Dies and Old Computer Challenge in the Rear View
Links for the day
For the First Time Since May Linux.com (Linux Foundation) Published Something. It's All Spam.
Can we trust the Linux Foundation to look after anything at all? Look what it turned this once-thriving site into.
Honduras: Windows Down, Android Peaking Again
Honduras does not have many stakes in Microsoft
[Meme] Twitter (X) Will Reject the Concept of a Female President
Twitter (X) is controlled by misogynists, who socially control (or socially-engineer) their fake concept of "media"
Second Family Photo of Julian Assange Since His Release (First Since His Birthday)
His wife shows the 4 of them for the first time (2 hours ago)
Protesters in Kenya Need Software That is Free (Libre) and Supports Real Encryption in Order to Avoid Capture and Torture (Sometimes Execution)
There's more to fight over than economic issues
The Ludicrous Idea That GNU/Linux is a "Poor Man's" Operating System
Seeing the trends in countries such an Norway, it ought to be abundantly clear that adoption of GNU/Linux has nothing to do with poverty
Links 22/07/2024: Internet Optimism and Kamala Harris Policies Debated
Links for the day
Something is Happening at OFTC
It looks like it shrank by 20,000 users
GNU/Linux Usage in Guadeloupe Rises Closer to International Average, Based on Web Data Collected by statCounter
It should be noted that the estimates of GNU/Linux usage are now in 4.5% territories
The Impact of OFTC's Latest Changes on the Perceived Scale of IRC Globally
IRC is still one of the more potent alternatives to the social control media conglomerates
New: Why They Really Went After Assange
Uploaded by Chris Hedges
Links 21/07/2024: Health, Politics, and Kamala Harris in Focus
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, July 21, 2024
IRC logs for Sunday, July 21, 2024
A Drop in Half (From 208 to 104): Sharp Decline in Number of Gemini Capsules That Use Let's Encrypt CA Since December
Gemini is increasing its independence from Certificate Authorities (CAs)