A User’s Guide to the EU-US Privacy Shield

By Thomas Carey. Chair of our Business Practice Group

US companies that rely on seamless receipt of personal data from EU businesses watched in horror as the EU-US Safe Harbor Program was blown up by the EU Court of Justice.

Officials on both sides of the Atlantic have rushed to fill the void.  What emerged, the EU-US Privacy Shield, is a stronger, more demanding set of rules that US companies may follow to avoid enforcement actions from the EU’s data protection authorities (DPAs).

Before it becomes operative, the Privacy Shield must clear a gantlet of regulatory processes that includes review by the EU DPA (which wrapped up on April 13, 2016), the consent of the EU Parliament, and adoption by the European Commission.  This process may be completed as early as June 2016.

The Privacy Shield has vociferous critics in both the US and Europe who remain mistrustful of US intelligence services and their propensity for snooping. On April 13, 2016, this criticism was echoed by the DPAs, who opined that the Privacy Shield is “not acceptable” because it permits mass surveillance of Europeans.   But because several governments have invested substantial resources in the development of the Privacy Shield, it is advisable for US businesses that receive personal data from the EU to seriously consider participating in the program and to plan now for that participation.

The Privacy Shield, like the Safe Harbor program, involves self-certification by companies seeking its protection.   It also is based upon the principles agreed by the EU countries in 1995 (the Privacy Principles):

• Notice to the individuals whose data is being transmitted
• Choice affording the individual the opportunity to opt out
• Security based upon reasonable and appropriate measures to protect the data
• Data integrity – the data must be accurate, complete and current
• Limited purpose – the company must state the purposes of the data collection and abide by its stated purposes (or get fresh consent for an expanded purpose)
• Access– individuals must have the right to obtain the data kept about them within a reasonable period of time
• Accountability for further transfers of data to subcontractors, etc.
• Recourse for individuals whose data has been misused.

Companies seeking the benefit of the Privacy Shield will have to publicly declare their commitment to the Privacy Principles, publicly disclose a privacy policy consistent with those principles and fully implement it.  Adherence to the Privacy Principles may be limited (a) to the extent necessary to meet national security, public interest, or law enforcement requirements; (b) to the extent that statute, regulation, or case law creates conflicting obligations or (c) to the extent expressly permitted by the EU members state affected by the data transfer.

Participants in the Privacy Shield program will be required to verify their compliance with their privacy commitments. This may be done through self-assessment or outside compliance reviews.  Under the self-assessment approach, the verification must indicate that:

• The published privacy policy is accurate, comprehensive, prominently displayed, completely implemented and accessible;
• The privacy policy conforms to the Privacy Shield Principles;
• Individuals are informed of any in-house arrangements for handling complaints and of the independent mechanisms through which they may pursue complaints;
• The company has in place procedures for training employees in the implementation of its privacy policy, and disciplining them for failure to follow it; and
• It has in place internal procedures for periodically conducting objective reviews of compliance with the above. (MORE)

Goodbye OHIM, Hello EUIPO− −Changes to Trademark Law in Europe

By Steven Abreu. A member of our Trademark Practice Group

On March 23, 2016, the European Union’s trademark authority, known as the Office of Harmonization in the Internal Market (OHIM), changed its name to the European Union Intellectual Property Office (EUIPO). This change was just one of several made in an effort to modernize the trademark protection scheme in the EU. While we practice directly in front of the US Trademark Office, many of our clients also choose to protect their brands overseas by participating in Europe’s trademark registration process. As a result, we have been actively discussing the changes with our European associates in order to make sure that our filing and opposition strategy remains current.

Here are seven things to know about the new regulations now in effect:

• In addition to the change of the name of the office, the name of the resulting registration, previously known as a Community Trademark (CTM), has changed to a European Union Trademark (EUTM).
• Because of the name changes to the office and the registration, the European authorities have been warning their customers to expect a spike in the activity of scammers and unofficial publication services that may seek to take advantage of the confusion that the name change may create.
• Previously an application could be filed in the European Union in one, two or three international trademark classes for the same filing fee, namely, 1,050 euros. The fact that three classes could be included in the application for the same price as one class led many applicants to file in three classes of goods and services even if the mark was being used in only one or two classes. This was especially true of European-based applicants. Now  a base application in one class costs 900 euros and each additional class 150 euros. We believe the price changes will lead to fewer applications in three classes when only one class is truly of interest.
• Trademark registrations in Europe are vulnerable to cancellation on the basis of non-use after a five-year grace period expires. Under the prior regulations the five-year clock began at the date of the registration. Under the new regulations it starts ticking from the earliest priority date in the application (either the filing date or the date of any priority claim).
• Requirements for the description of goods and services in Europe are far more lax than the USPTO’s requirement of specificity and definiteness. In Europe some applicants employed a filing strategy that used class subheadings as a shorthand to designate any and all goods or services falling under that subheading. By using all the subheadings, applicants believed that they could cover the entire class. However, a recent European decision in the IP Translator case put a stop to that practice and held that subheadings covered only the goods which were logically described in the heading itself. The new regulations provide applicants who used the subheading strategy a six-month window in which to name the specific goods they wish to protect under each subheading. Since we have routinely advised against this strategy, this change should not affect our clients’ rights. (MORE)

How Should the PTO Interpret Patent Claims? The Federal Circuit Weighs In, Yet Again

By Bruce Sunstein. A member of our Patent Practice Group

 

The claims of a patent determine its power. Unlicensed activities that fall within the scope of a patent’s claims can be subject to royalties or an injunction, but when claims cover subject matter deemed to be within the prior art, the claims can be invalidated.

How a claim is interpreted can often make the difference between whether it is so narrow that it is not infringed, or broad enough to cover a third party’s activity (so as to give the patent owner damages or an injunction or both) or so broad that it covers prior art (so as to be invalid).

For the patent owner, the claims of an ideal patent are a little like the porridge of Goldilocks and the Three Bears. They should be in the middle between too much and too little—but in this case, we are talking about breadth of claims instead of the temperature of porridge. Ideally for the patent owner, the claims are broad enough to cover any product or method that may be used by a competitor, but narrow enough to avoid covering prior art that would invalidate the claims.

How a patent claim is interpreted, of course, depends on the words used in the claim. But the interpretation of a claim also depends on where the claim is being interpreted. If a claim is interpreted by a court, one set of rules comes into play, but if by the Patent and Trademark Office (the “PTO”), another set of rules comes into play.

The dissimilar impact wrought by these two sets of rules was highlighted in a February 22, 2016 decision by the Federal Circuit Court of Appeals, PPC Broadband, Inc. v. Corning Optical Communications RF, LLC . The case involved appeals from a number of PTO proceedings, called IPRs (Inter Partes Reviews), in which claims of two patents owned by PPC Broadband were attacked by Corning Optical and invalidated on the basis that they covered subject matter in the prior art. (MORE)

Inter Partes Review – Heads I Win, Tails You Lose

By Robert Asher. Co-Chair of our Patent Practice Group

 

Inter partes review is, plain and simple, a tool for killing patents.  In light of rules implemented by the USPTO and judicial interpretations of the America Invents Act, it would be careless to refer to these proceedings as a litigation alternative. Litigation in courts offers opposing parties an opportunity to discover and present evidence in support of their respective positions. At the end of the litigation, a judgment typically resolves the contested issues between the parties. If Congress intended inter partes review (IPR) to result in an equivalent sense of closure for patent owners, that goal remains frustratingly elusive.

By way of background, IPR was passed into law to replace previous inter partes reexamination challenges to patents in the patent office.  Inter partes reexaminations were getting bogged down by the filing of unlimited new patent claims and claim amendments, multiple patent examiner actions and multiple levels of appeal.

By contrast, IPR commences at the level of the Patent Trial and Appeal Board (PTAB), severely limits the ability to amend claims, and proceeds according to strict time limits.  To satisfy the rapid timetable when presented with multiple grounds for challenging claims of a patent, the PTAB will often “institute,” i.e., go forward with, an IPR on only some of the grounds and as to only some of the patent claims.

By statute, the PTAB’s institution decision is not subject to appeal.  The PTAB has therefore had unfettered discretion in deciding which patent claims, and which grounds for challenge, it will consider in an IPR.  The Federal Circuit Court of Appeals recently addressed the question of whether the PTAB can limit the scope of an IPR in this manner.

In Synopsys, Inc. v. Mentor Graphics Corp., the Federal Circuit examined the statute governing IPRs and found the different wording in two of its provisions highly significant. A proceeding may not be instituted, under 35 U.S.C. § 314(a), unless “there is a reasonable likelihood that the petitioner would prevail with respect to at least 1 of the claims challenged in the petition.”

In addressing the end-point of an instituted IPR, however, the statute provides that the final written decision must issue with respect to “any patent claim challenged by the petitioner.” 35 U.S.C.§ 318(a).  Because Section 318(a) does not use the language “the claims challenged in the petition,” the PTAB may, said the court, issue a final decision only as to the claims and grounds on which it instituted review.(More)

May Sellers of Patented Products Retain Rights after a Sale?

By Samuel Petuchowski, Ph.D.. A member of our Patent Practice Group

A question of patent law, now likely bound for the Supreme Court’s last word, concerns whether a patent owner retains any say over subsequent use and resale of a patented product once the product has been sold. That question arose recently in Lexmark International, Inc. v. Impression Products, Inc., a case that occasioned a flurry of amicus curiae briefs in the Federal Circuit Court of Appeals. The Federal Circuit, convening the full court at its own initiative, has delivered the opinion that “it depends.”

US law traditionally disfavors encumbering the sale of goods with conditions on any future sale – so called restraints on alienation. For example, the first-sale doctrine under the Copyright Act entitles the purchaser of a copy of a copyrighted work to sell or otherwise dispose of that work without authorization from the copyright owner. 17 U.S.C. § 109(a).

The US Patent Act, however, contains no such provision.  But an uncodified judicial principle of long standing (enunciated by the Supreme Court in 1853) provides for “exhaustion” of a patent owner’s rights in a patented article as soon as the patent owner sells it. Oddly, the exhaustion doctrine, as interpreted thus far, does not apply if the product is sold by a licensee and the restrictions are imposed by the patentee under the license. One of the issues argued in Lexmark was whether that distinction should stand.  Lexmark makes and sells printers and toner cartridges that contain patented features. Impression acquires used Lexmark cartridges, refurbishes them, and then resells them–in competition with Lexmark. Lexmark sued Impression for patent infringement.

The trial court in Lexmark acknowledged the Federal Circuit’s 1992 ruling in Mallinckrodt Inc. v. Medipart, Inc. that upheld a restriction—against reuse by the customer—imposed on the sale of a patented article (a nebulizer used for taking X-rays) when the restriction was otherwise lawful and within the scope of the patent grant^[i]. The lower court held, however, that the Mallinckrodt decision had been effectively overridden by the Supreme Court’s unanimous 2002 decision in Quanta Computer, Inc. v. LG Electronics, Inc. The district court read Quanta as disallowing a restriction built into sales of a product subject to a patent, although in the Quanta case, the product was sold by a licensee of the patent owner rather than by the patentee itself.

Several facts in the Lexmark case sharpened the issues that came before the Federal Circuit on appeal, and those for which review is now being sought in the Supreme Court. For one thing, Lexmark has a two-tier pricing policy, whereby toner cartridges may be purchased either at full price, in which case no restriction on reuse or resale is imposed, or at a 20% discount, subject to an express single-use/no-resale restriction that requires the purchaser to return the used cartridge only to Lexmark. Moreover, the discounted single-use cartridges contain a special chip that must be replaced if the cartridge is conditioned for reuse, so no one can reasonably assert that they lacked notice of the condition attached to the sale. All of the cartridges subject to litigation, as it now stands, are of the discounted, single-use/no-resale variety.

A second twist is that some of the Lexmark toner cartridges reconditioned and resold by Impression were acquired outside the US.  Patent exhaustion principles that are recognized under US law might not shield an importer from an assertion of patent infringement for the act of importing a patented article into the United States. And, indeed, the Federal Circuit adhered to its earlier holding in Jazz Photo Corp. v. International Trade Comm’n (2001) that when a patentee sells, or authorizes the sale of, a product outside the US, it does not authorize the buyer to import that product into the US. (More)

The EU Reveres Data Privacy, the US Puts National Security First, and US Businesses are Caught in the Middle

By Thomas Carey. Chair of our Business Practice Group

Imagine that you run a small software company that has developed point-of-sale software for amusement parks, zoos and other entertainment venues.  You’re based in North Carolina with no overseas offices.  If you think you need have no concern about European privacy law, you’d be wrong.  That company, CenterEdge Software, is one of more than 4,500 US companies that have registered for the protection afforded by the US-EU Safe Harbor Program.

CenterEdge’s software is in use in Europe, it is used to collect information about individuals and the company’s exposure to EU law is significant.  Similarly, many other US-based companies, such as cellphone app developers and websites that sell to EU customers, need to be aware of developments in EU privacy laws.

The right to privacy is explicitly recognized in the EU by virtue of the European Convention on Human Rights.  The EU restricts the transfer of data about EU individuals to countries that do not ensure an adequate level of protection of that data.  While a few non-EU countries have been designated as having an adequate level of protection, the United States has not.

This affects US companies that have operations in Europe or that process data about individual residents of the EU on behalf of European customers.  For example, credit card processors, software companies, relocation companies, advertisers, financial institutions and service companies have all had to pay attention to EU data privacy regulations.  Soon, the EU law will apply to anyone who directs sales activity to EU residents whether they have a presence in Europe or not.

There are ways for EU companies to transfer data to entities in countries like the United States that are deemed to have inadequate privacy protections.  For example, the EU company can enter into contracts having the exact terms spelled out in so-called “Model Clauses” promulgated by the EU Commission.  Another method is available for transfers between corporate affiliates if they enter into binding corporate resolutions.  Another method involves obtaining the “unambiguous consent” of the individuals involved.
 

The US-EU Safe Harbor Framework

Construction.  In 2000, the US and the EU adopted another way to permit data transfers to US entities:  the US-EU Safe Harbor Framework. This arrangement was negotiated by the United States Commerce Department and the European Commission.  Under that framework, a US company could certify its adherence to certain basic principles of EU privacy laws, designate a privacy officer to receive inquiries or complaints from EU citizens, and appoint a third party to hear privacy complaints of EU citizens who are not satisfied with the response from that privacy officer.  Having taken those steps, the company could then be registered on a list maintained by the US Commerce Department.  This procedure has been adopted by over 4,500 US companies.

In negotiating the Safe Harbor Framework, the US insisted that the safeguards of the program be subject to an override in favor of investigations for purposes of law enforcement and national security.  This US policy choice eventually led to the unravelling of the EU-US Safe Harbor.

Deconstruction.  The first loose thread appeared in the fall of 2011, when a Facebook privacy lawyer addressed a class at the Santa Clara Law School.  Max Schrems, an Austrian law student who was in the class, was surprised to see how badly Facebook underestimated the stringency of EU privacy law.
(Read the entire article)

Don't Miss a Deadline in Your Inter Partes Review

An inter partes review is a litigation proceeding brought before the Patent Trial and Appeal Board (“PTAB”) to challenge the patentability of claims in a patent.  A successful inter partes review can cause cancellation of the patent claims so as to prevent future assertion of these claims, wiping out any pending verdict related to these claims and preventing the patent owner from seeking additional claims that are not patentably distinct from those claims found to be unpatentable.  The challenge to patentability in an inter partes review can be based only on the theory that the claims are anticipated or rendered obvious by one or more prior art patents or printed publications.

This comprehensive  flowchart shows a typical timeline for IPR proceedings with key deadlines that guide the reader from before the filing of a petition for an IPR all the way to the appeals process after conclusion of an IPR.

We recommend contacting an attorney before relying on any deadlines for Inter Partes Review reached using this flowchart.


Please see the Inter Partes Review web page for general information regarding Inter Partes Review.

For more information, contact Robert Asher.