This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.
Data Protection in Mexico
By Marco Antonio García Euroza. Senior Patent Consultant.
In summary, Data Protection comprises a sui generis intellectual property right related to the clinical data of pharmaceutical or agrochemical products. Clinical data, the information used to demonstrate that a product is safe and effective to be administered, is guarded against unfair use or blocked for third parties who may depend on it during a regulatory approval process.
Data protection is considered by the Trade-Related Intellectual Property (TRIPS) Agreement, the document which sets the basic provisions governing intellectual property matters amongst members of the World Trade Organization, under a nondisclosure approach. Parties are required to avoid the disclosure of the data or protect it against an unfair commercial use (Article 39, paragraph 3, of the TRIPS Agreement).
Although the TRIPS Agreement establishes the basic provisions for data protection, multilateral treaties may require a higher level of protection. For Mexico, the North American Free Trade Agreement (NAFTA) further required it to protect the data by blocking third parties which may rely on it during the regulatory approval process.
During the period when NAFTA was in force, 1994 – 2020, Mexico did not explicitly establish a procedure in its national law for obtaining data protection. It is assumed that these rights were automatically conceded whenever an innovative marketing approval was approved. In addition, interested firms could also obtain these rights through judiciary or administrative proceedings. Upon a favorable decision from the Mexican judiciary or Administrative Court, the Mexican Regulatory Authority was forced to acknowledge this protection and block potential third parties marketing approvals.
In 2018 The Mexican Regulatory Authority replied to a public inquiry on the data protection given from 2013 until 2018. The response shows that data protection was linked either to marketing approvals or new indications.
Now, the NAFTA has been updated to the United States Mexico Canada (USMCA) Agreement and though some elements have been kept from the NAFTA, it establishes new rules for data protection; for example, data protection for agrochemical products is now granted for 10 years. Interested firms must consider these amendments when seeking to obtain data protection in Mexico.
According to the USMCA final provisions, Mexico may take up to five years to implement the obligations in regard to data protection; however, this does not seem to be a hindrance for interested firms as the agreements are currently in force.
Data protection remains a supplementary mechanism through which innovative firms may obtain the exclusivity of their products. There is previous data of its acknowledgment in the country, and, although it may take some time to incorporate it into the national law, interested firms could benefit without waiting for the amendments.
Source: Comisión Federal para la Protección de Riesgos Sanitarios, OFICIO No. CAS/2*OR/4896/2018, 30/04/2018
Read More 0
Principles to Take Into Consideration in Data Protection Compliance
By Manuel Lobato. Patents Lawyer.
Data Protection Compliance: GDPR
The General Data Protection Regulation –GDPR– constitutes a regulation that covers all (or almost all) aspects related to the personal data of European citizens both within Europe and outside it. It is self-sufficient and its rules are applied from the principle of extraterritoriality.
Just as this principle exists, to determine that the data of European citizens are treated in accordance with the standards established by the GDPR, there are also principles of an axiological nature that are scattered throughout the Regulation – although stated in art. 5° -, and that must be considered as mandatory and effective compliance for all those who process personal data.
Here is a brief explanation of these axioms that must be taken into account when implementing a personal data treatment policy:
Lawfulness, transparency, and fairness
The lawfulness in the treatment has to do with the fact that the collection and treatment of personal data must have a legal and justified basis, requiring the consent of the interested party, or legal provision failing that. The objectives of the regulation must also be borne in mind.
Regarding transparency and fairness, it refers to two behaviors that must be displayed by the person in charge of the treatment and/or the person in charge in relation to the owner of the data who has to be sufficiently informed of what the data processor and/or controller will with the data, how they will treat said data and the communication of the data owner regarding their rights of information, modification, rectification and deletion as a guarantee, always keeping in mind the purpose for which the data was collected.
Purpose
The collection and processing of personal data must have a lawful, legitimate, transparent, and explicit purpose, which must be informed to the owner of the data so that they can fully understand what they will do with the personal information that belongs to the owner. This principle is related to the previous one.
However, this principle also has another face, which is related to the application of the limitation in terms of purpose. The truth is that the person in charge and / or in charge of the processing of personal data cannot use them for a different purpose than the one that was informed to the owner and on which they consent was obtained, much less, for purposes incompatible with the law, the Regulation and its provisions.
Minimization of data
Based on this principle, the data that is collected and processed should be those that, based on the evaluation of the purpose, constitute the minimum and essential to carry out a project that involves its collection and treatment.
Accuracy in data recording
The importance of the principle of accuracy in personal data lies in the fact that, when dealing with rights that belong to natural people, their erroneous assignment, and in addition, their relationship with people who are not the true owners, can bring damage to them.
In addition, this principle also allows strict control to the owner of the so-called ARCO rights -access, rectification, cancellation, and opposition.
Temporal limitation in the conservation of personal data
This principle is related to the principle of data minimization but from its temporal aspect. The data should not be kept for longer than is necessary to fulfill the purpose for which they were collected. Once the cause of their collection and treatment has disappeared, they must be destroyed and, at the very least, apply a process of dissociation of the data in relation to the owner.
However, the different laws may establish exceptions to the principle of time limitation: for a public interest, for scientific or academic purposes, or because the law establishes an obligation of the person responsible to maintain them for a long time, despite the purpose having been fulfilled (eg: tax issues).
One manifestation of this principle is the so-called “Right to Be forgotten”.
Integrity and Confidentiality
Both principles have to do with the fact that both the person in charge mainly and the person in charge of the processing of personal data must maintain a proactive attitude when collecting and treating.
Furthermore, data processors and controllers’ have a proactive responsibility and both must take all necessary measures to avoid data breaches. In Argentina, the responsibility of the data controller is objective, through the application of the theory of risk.
In Moeller IP Advisors we can assist you in complying with all these principles in case you or your company decide to launch our own product or service in the European Union.
Please contact our expert’s team through our CRMs Ms. Vivianne Cardoso and/or Ms. María Ximena Amado.
Read More 0
IP – Internet Protocol – Is Not Personal Data – an Argentinean Court Rules
By Manuel Lobato. Patents Lawyer.
The Federal Court of the Argentine province of Córdoba, on December 29, 2020, in the file FCB 88747/2018/1 / CA1, issued a judgment, from which it confirmed the decision of the 1st Instance Judge who declared that the IP address is not personal data.
The official defense of the accused filed an appeal in order to revoke the judicial decision of the federal judge of 1 ° instance that rejected the proposal for nullity against the measure carried out by the Prosecutor, from which she requested reports to different agencies -among them the Federal Administration of Public Revenues and companies that provide internet services-, which involved the use of the defendant’s IP address, from which information was extracted, regarding changes of addresses, issuance of invoices-making state date of issue, name of the purchaser, type of invoice, voucher number, point of sale and IP address- and economic activities that involved it, as well as its full name and address.
The reports, as recorded in the case and was the basis for the appeal, were requested without a prior court order.
The Official Defender relied on art. 18 of the Argentine Constitution -which protects private correspondence- and the laws No. 25,326 of Protection of Personal Data and No. 25,520 of National Intelligence, to found that the IP is personal data and that its violation is comparable to the interception of telephone communications.
The prosecutor, for her part, requested the rejection of the nullity claim filed by the defense, broadening her position that: 1) the information requested is exempt from fiscal secrecy; 2) that the Public Prosecutor’s Office, based on said exception, has the faculties to request it directly from the AFIP – Argentinean Taxes Bureau-, as long as the prosecutor herself directs the investigation; 3) and that the IP address is simply an interface that allows, among other issues, to establish who is the internet service provider company, not being able to expressly know the user’s activities.
The judge of first instance rejected the proposal of nullity of the accused’s defense, arguing that in no way is equivalent to the act of telephone interception, the request for ownership of the IP to internet service providers, basing its criteria on judicial precedents and legal interpretations, especially of the personal data protection law, art. 5, part 2, sections b and c, outlining that certain data even have less protection than others.
Finally, the Court confirmed the rejection of the nullity claim based on the following arguments: 1) that the appealed resolution was issued in accordance with the law and properly founded; 2) That the judge a quo made a correct interpretation of why the request for ownership of the IP is not comparable to telephone interception; 3) That the prosecutor did not exceed the functions that the procedural law grants her when requesting information on the ownership of the IP; 4) That the Court takes the arguments provided by the Prosecutor’s Office by accepting that the IP address does not allow access to personal data or correspondence of its owner, so it is not comparable to telephone interception; 5) That the personal data protection law on does not apply to the case and that the rights that it protects are not absolute when there are exceptions to the general principle of the obligation to obtain the consent of the owner (art. 5 °, 2nd part, subsections b and c); 5) That the data collected is nominative and does not affect the privacy of the owner; 6) That, finally, judicial authorization is not required to carry out the evidentiary diligence carried out by the Prosecutor’s Office since the privacy of the holder is not being violated.
Read More
0
The Case Schrems and the Fall of the Privacy Shield. First Part
By Manuel Lobato. Patents Lawyer.
Background of the case
The young Austrian Maximiliano Schrems – law student and resident in Ireland – made a complaint in 2011 to the Irish Commissioner for Data Protection against the social network Facebook, for transfer of their data from the servers of Facebook in Ireland to the servers of Facebook Inc. located in the United States for further processing.
In his claim, Schrems – based on the facts and evidence provided by Edward Snowden through which, the former agent revealed how the United States operated in global surveillance-, alleged that said country did not offer adequate protection to the personal data that received from users in the countries that are members of the EU, and did not even contain a process for the selection and treatment of these data, but rather took them in large quantities and thus processed them, using them for purposes other than those that truly informed the users of the social network –in their eagerness to fight terrorism-.
This motivated Schrems to request a ban on his data being transferred to the servers of Facebook Inc. The Irish body rejected Schrems’ proposal, based on Decision 2000/520 / EC, of July 26, 2000S, considering that The United States complied with an adequate level of protection. However, Schrems appealed this decision to the highest court in Ireland – the High Court -, which finally held that the United States made excessive interference with the personal data that was transferred to its territory.
The decision of the CJEU. Schrems´ I judgment.
The High Court asked the European Court to issue a preliminary ruling regarding the issue of whether said decision -2000/520/EC- is valid and whether it makes it impossible – or not – for the national authorities of the countries of the European Union to carry out a correct control regarding the personal data that is transferred from an European country – in this case, Ireland – to a third state. Finally, the European Court ruled that, although the EC decision 2000/520 prescribes that the United States has an adequate level of protection, the truth is that also the national organizations responsible for ensuring the protection of the data of its inhabitants, they are empowered to carry out this control, although the invalidity of a Decision – in this case, the one adopted by the European Commission – can only be declared by the CJEU.
Finally, the European Court, in order to rule as it did –declaring the invalidation of the EC decision-, taking into account, not what was established by the Commission’s Decision, but, in factual terms, whether the privacy of the data owners was protected when transferred to the United States. In other words, when making such an assessment, the third country is not required to have a regulatory framework and a level of protection identical to that of the EU; more than anything, that this third country provides an adequate protection framework for the data of the holders.
For all these reasons, it declared Decision 520/2000 invalid based on the following arguments:
1) That there was an interference with the right to privacy;
2) Declared that said interference meant a violation of the essential content of the right to privacy.
Decision 1250/2016.
Due to the judgment issued by the CJEU that invalidated decision 520/2000 of the European Commission regarding what is known as “safe harbor”, regarding the transfer of data to the United States, it was adopted within this framework, the so-called decision 1250/2016, better known as “Privacy Shield”.
The purpose of this decision is summarized as follows:
– Acknowledges that the EU-EE Privacy Shield comprised of the privacy principles applicable to certified United States organizations (companies) and related commitments made by the Department of Commerce and other United States authorities, it provides an adequate level of protection for personal data transferred from the EU to these organizations.
– This means that personal data can be freely transferred to organizations in the United States included in the “Privacy Shield List”, which is prepared and published by the United States Department of Commerce.
– The application of the Privacy Shield guarantees the right to respect for privacy and the right to the protection of personal data of all persons in the EU whose personal data is transferred through the Privacy Shield.
– It also guarantees legal certainty for companies that rely on your application to transfer personal data from the EU to US organizations certified by the Privacy Shield.
Precisely this decision is the one that was declared invalid in the judgment of the Schrems II Case, issued by the CJEU on 07/16/2020, which will be subsequently commented.
Sources:
https://eur-lex.europa.eu/legal-content/ES/LSU/?uri=CELEX%3A32016D1250
https://www.boe.es/doue/2016/207/L00001-00112.pdf
https://www.redalyc.org/jatsRepo/3376/337655201009/html/index.html
https://www.researchgate.net/publication/321792394
Read More 0
Minimizing The Data Risks
By Manuel Lobato. Patents Lawyer.
Guide of Impact on the Personal Data Protection
On January 29, to commemorate the International Data Protection Day, the control authorities of the countries of Argentina and Uruguay prepared a Guide for the study of Impact on the Personal Data Protection. Hose main objectives are:
1) minimize the risks of projects faced by entities –publics and privates- that manage personal data.
2) the implementation and standardization of preventive rules to which these entities must comply when carrying out said projects.
3) By developing an Impact Assessment, comply with current regulations on the matter.
Personal data
The document begins by enunciating general concepts within which the one that stands out the most, is the meaning of ¨personal data¨ -because of its breadth-, encompassing all kinds of information, not only of individuals but also legal entities, in line with current regulations in the countries of Argentina and Uruguay.
Then, the need and importance of carrying out risk assessments that could affect personal data through its treatment is determined in the different projects or operations carried out by both public and private entities. These evaluations require going through different phases ranging from internal/operational matters, through regulations and security measures to be adopted, until finally reaching the preparation of the guide that will serve as the basis for the treatment of personal data that will be involved in the development of the activities carried out by the company.
Finally, and from the previous phases, the risk analysis that involves the development of the project or operation for the treatment of the data, through the phases of its development, is prepared. It should be noted that not only personal data is involved in any project, but other constitutional rights recognized such as the right to honor, self-image and privacy are collaterally achieved.
Implementation of an EIPD
As a corollary, the implementation of an EIPD in each project that a company develops and that involves the use of personal data is necessary to fully comply with local regulations on data protection. In the event that the risks of data collection and processing are high, it should be weighed if the measures developed, manage to minimize them, or if, on the contrary, they also pose a high risk, to which alternative ways of managing the data should be sought. In this way, the law and its postulates comply.
Source: https://www.argentina.gob.ar/sites/default/files/guia_final.pdf
Read More 4
The CJEU gives a “like” to Data Protection
By Maria Sol Porro. Trademarks Lawyer and University Professor.
Conflict about the processing of data protection
Last August, the CJEU settled a new conflict about the processing of data protection, Facebook and the popular “like” icon.
Data protection case
The conflict took place when ¨Fashion ID¨, a German e-commerce company that sells clothing, inserted the “like” Facebook button on its website. This insertion seems to have the consequence that, when a visitor visits the “Fashion ID” website, personal data of that visitor is transmitted to Facebook Ireland. As it was analyzed in this ruling, this transmisión of data is made without the said visitor being aware of it and regardless of whether they are a member of the Facebook social network or if they clicked on the “like” button.
For this reason, ¨Verbraucherzentrale NRW¨, a German public association defending the interests of consumers, made a complaint against ¨Fashion ID¨ for having transmitted to Facebook Ireland personal data of visitors to its website. On one hand, without the consent of the latter and, on the other, breaching the information obligations established in the provisions related to the protection of personal data.
Resolution of the case
Having reached the conflict in the German Court of First Instance, the matter was finally sent to the EU Court of Justice in order to find a final resolution.
After analyzed the case, the CJEU ruled that the administrator of an Internet site with the aforementioned “like” button on its website may be responsible, together with the social network, for the collection and transmission to Facebook of the personal data of visitors to its site.
In this case, it is particular, the joint responsibility is due to the fact that, on one side, the insertion by “Fashion ID” of the “like” button of Facebook on its website allows the fashion site to optimize the advertising for its products by making them more visible on the social network.
On the other hand, Facebook Ireland obtains as a counterpart the power to have this data for its own commercial purposes.
Therefore, such processing operations are carried out in the economic interest of both, “Fashion ID” and Facebook Ireland. Therefore, the company ¨Fashion ID¨, as a co-responsible entity for certain consumer data processing operations that access to its website, must request prior consent for operations in which as co-responsible collects and transmits personal data. However, the CJEU clarified that it will not be responsible, in principle, for the further processing of such personal data made solely by Facebook.
Prior consent to data protection
Furthermore, the CJEU also analyzed for this case one of the exceptions to the obligation to obtain prior consent: ¨legitimate interest¨.
In these cases, the court pointed out that both, the administrator of the website in question and the provider, must pursue a legitimate interest with the collection and transmission of data, which will make such operations justified. So the legitimate interest that justifies one of the actions will not justify the other one.
Conclusion: General Data Protection Regulation
In conclusion, and as we have mentioned in other blog posts since the entry into force of the General Data Protection Regulation last year, the European Union has been implementing through its laws and judicial decisions a strict line of thinking about how It intends that the data of its citizens be treated.
Therefore, any activity that is not within these guidelines cannot be carried out freely, making good legal advice important to avoid sanctions or any other obstacles.
Contact us if you need intellectual property legal advice.
Source: curia.europa.eu
Read More
1
GDPR and BREXIT
By Maria Sol Porro, Trademark Lawyer
General Data Protection Regulation (GDPR)
On May 25, 2018 the European Union, after its approval in Parliament and its European Council, came into force the General Data Protection Regulation (GDPR), in order to unify the regulations of all the Member States on the matter. Faced with this new regulation, which affects both, citizens and European companies, the complex exit of the United Kingdom from the Union, for which a new date has been set for October 31st* of this year, is one of the biggest concerns for the community companies that operate in the Anglo-Saxon country.
Hypotheses about Brexit
Faced with this situation, different hypotheses are presented taking into account whether the English House of Commons decides to leave the EU with an agreement, also known as the “Soft Brexit”, or without agreement, giving way to a “Hard Brexit”.
Soft Brexit
In the event that the exit situation happens within an agreement, or the so-called “Soft Brexit”, the GDPR will continue to be applicable during the transition period set by the aforementioned agreement, creating a period of transposition of laws as a result. From that date, the United Kingdom would have until December 31st, 2021 to sign new treaties with the European Union, including those related to data protection.
Hard Brexit
On the other hand, if no exit agreement is reached, it would lead to what is known as “Hard Brexit”, whereby the UK’s relationship with the EU would be similar to that maintain with the United States, where “safe harbor” agreements are required as well as the compliance with another series of requirements to allow the acquisition and handling of data of European citizens and companies.
In other words, a legal vacuum would be created for all European companies that currently operate with data in the United Kingdom for a period of time, until the signing of new agreements on the subject.
Conclusion about GDPR and Brexit
Therefore, taking into account the present scenario and the continuous postponement of the famous Brexit, during the current year, it is certain that the departure of the United Kingdom from the EU will not be calm and peaceful, affecting different aspects of the community system, such as the protection and control in the exchange of data.
Thus, the most advisable for companies that handle European data is to comply with both the GDPR and the previous regulations, the Organic Law of Protection of Personal Data (LOPD), to avoid any type of conflict during this transition.
* After the postponement of Brexit for 04/12/2019, the departure from Great Britain is delayed until 10/31/19, in order to offer six months extra time to reach an agreement that allows an orderly departure.
Source: www.zonamovilidad.es
Read More 0
Free Trade Agreement: Implications for patents and designs
By Marta Garcia
The European Union (EU) and the four founding members of sub-regional trade bloc Mercosur (Argentina, Brazil, Paraguay, and Uruguay) have been negotiating a free trade agreement (FTA) for the last 17 years as part of a broader Association Agreement between the two regions.
After a pause in the EU-Mercosur negotiations in 2012, these were re-launched in May 2016. Since then, there have been several rounds of negotiations, with the pace picking up in recent months.
The current EU proposal for the FTA comprises a chapter on intellectual property rights (IPR) covering standards concerning copyright, trademarks, designs, geographical indications, patents and plant varieties, as well as a section regarding IPR enforcement.
Regarding industrial designs, the EU proposal establishes in its Article 6.1 that the parties shall implement the Geneva Act to the Hague Agreement Concerning the International Registration of Industrial Designs (which establishes an international system – the Hague System – that allows industrial designs to be protected in multiple countries or regions with minimal formalities). Regarding the term of protection, under article 6.3 of the EU proposal, the duration of protection available shall amount to 25 years from the date of filing of the application. Additionally, article 6.6 establishes that a design shall also be eligible for protection under copyright law as from the date on which the design was created or fixed in any form.
The report from the 30th negotiation round in November 2017 states that the agreement section on designs was tentatively completed. However, the actual text in the final agreement will be a result of negotiations between the EU and Mercosur.
The chapter regarding patents states that the parties shall comply with the Patent Cooperation Treaty (PCT), of which neither Argentina and Paraguay norUruguay are yet part.
Out of the three non-PCT Mercosur members, as we previously reported here, only the Uruguayan Parliament is currently discussing its adhesion to the PCT.
Regarding Argentina, it is worth mentioning that a Memorandum of Understanding (MoU) on technical co-operation was signed by the European Patent Office (EPO) and the Argentine PTO (INPI) in May 2017, which was recently discussed during the visit of the EPO President BenoîtBattistelli to Argentina last February. One of the aims of the MoU is to encourage the use of the PCT system and raise awareness about its benefits.
Article 8.2 – Patents and Public Health – of the EU proposal’s IPR chapter expresses the EU’s commitment to the World Trade Organization (WTO) Doha Declaration on the Trade Related Aspects of Intellectual Property (TRIPS) and Public Health, stating the following:
“The Parties recognize the importance of the declaration on the TRIPS Agreement and Public Health, adopted on 14 November 2001 (hereinafter referred to as the “Doha Declaration”) by the Ministerial Conference of the WTO. In interpreting and implementing the rights and obligations under this Chapter, the Parties shall ensure consistency with the Doha Declaration.”
Notwithstanding the above, the EU proposal text on IPR includes articles on patent term extensions and data exclusivity, probably two of the sections on which positions between the EU and Mercosur are farthest apart.
Articles 8.4 and 8.5 of the EU proposal establish extensions of the patent term to compensate for unreasonable delays in the grant of marketing approval of a medicinal product or a plant protection product.The period of extension is the period that elapses between the filing of the application for a patent and the first authorization to place the product on the respective market, reduced by a period of 5 years. There is no proposal of extension due to unreasonable delays by national patent offices in granting the patent.
Regarding data protection, Articles 10.2 of the EU proposal establishes that parties shall not permit any other applicant to market the same or a similar medicinal product, on the basis of the marketing approval granted to the party which had provided the results of pre-clinical tests or of clinical trials for a period of […] years (not specified in the proposal) from the date of marketing approval.
According to the report from the 28th negotiation round in July 2017, “some divergences of views remain, notably regarding the level of protection as compared to TRIPS and certain international Treaties of which Mercosur countries are not yet members. Mercosur noted their concerns on patents and regulatory data.” Additionally, the last published report from the 30th negotiation round in December 2017 states that “on protection of regulatory test data in patents, the EU tabled a revised proposal but positions are still apart.”
Check back to Moeller’s blog to see updates about any developments on this matter.
Source: http://ec.europa.eu
Read More
0