Text
11 September 2018
Re: DISCLOSURE OF PERSONAL DATA OF PATENT AND TRADEMARK APPLICANTS AND INVENTORS
Dear [Redacted]:
We write in response to your request for an advisory opinion seeking clarification on the sharing of personal data of patent and trademark applicants and inventors by the Intellectual Property Office (IPOPHL) to the World Intellectual Property Office (WIPO) and the First IP Consultancy and Technical Services Co. (First IP) vis-à-vis the provisions of the Data Privacy Act of 20121 (DPA) and its Implementing Rules and Regulations2 (IRR). You also inquired if a data sharing agreement is needed should disclosure be allowed.
We understand that the WIPO is an international organization created to promote worldwide protection of intellectual property creations. It is requesting for personal data of patent and trademark applicants and inventors registered with the IPOPHL, in particular, their names, addresses, e-mail addresses, telephone numbers, and nationalities. The requested data shall be used for the Committee in Development and Intellectual Property (CDIP) project on the ASEAN Design Study. Specifically, the requested data is needed to understand the role of industrial designs in business strategies being done by high, low, and middle income countries.
We understand further that First IP, a private firm, is also requesting the list of inventors and applicants and their contact details from the Visayas region. The purpose is to identify the inventors in the region in order to organize them under the Visayas Chapter of the Filipino Inventor Society.
Discussion
Publicly Available Data; Pending Patent and Trademark Applications
Based on your separate email clarification, you made a distinction between published or registered applications for patent and trademarks, and those which are still pending evaluation.
We understand that all patent and trademark applications that are already published or registered are publicly available information, and the same may be viewed in your website and library. With this, personal data of registered and published applicants and inventors may be disclosed to WIPO as these are already publicly available information and WIPO’s processing is for research.
Note that personal information that will be processed for research purpose, intended for a public benefit, subject to the requirements of applicable laws, regulations, or ethical standards is excluded from the scope of the DPA, to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned.3
Considering the principle of proportionality, where the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose, IPOPHL may share the information limited to that which is necessary to the research purpose of WIPO.
It is likewise advisable for IPOPHL to include an appropriate statement on its privacy notice regarding the data to be shared with the WIPO. The principle of transparency dictates that the data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised.4 Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and plain language.5
As to First IP’s request, you may direct them to the appropriate website and/or repository of the personal data that they require which is available to the public in general. As their processing is for the purpose of soliciting new members for their organization, they would have the responsibility of obtaining the consent of these inventors and applicants should First IP proceed to contact them individually.
For the pending patent and trademark applications, we understand that these are kept confidential pursuant to internal policies. You confirmed that the information and other matters related to pending applications are held in utmost secrecy, until such time that they are published or registered in accordance with the novelty requirement under the Intellectual Property Code.
Thus, the disclosure of the personal data relating to pending patent and trademark applicants and inventors to the WIPO and to First IP may only be allowed if said applicants and inventors have given their consent, specific to the respective declared purpose of the data sharing.6
Data Sharing
Under the IRR, data sharing is defined as the disclosure or transfer to a third party of personal data under the custody of a personal information controller or personal processor.7 In the case of the latter, such disclosure or transfer must have been upon the instructions of the personal information controller concerned.8
Data sharing may be allowed under any of the conditions set forth in the DPA and its IRR, as when it is expressly authorized by law provided that there are adequate safeguards for data privacy and security, and the data privacy principles of transparency, legitimate purpose are adhered to.9 Furthermore, data sharing may be allowed in the private sector if the consent of the data subject is obtained, and the specific conditions under the IRR are met.10
Note also that data collected from parties other than the data subject for the purpose of research may be allowed when the personal data is publicly available, or has the consent of the data subject, as long as adequate safeguards are in place and no decision directly affecting the data subject will be made on the basis of the data collected or processed.11
Hence, the execution of separate data sharing agreements with both WIPO and First IP, respectively, is highly recommended for the sharing of personal data relating to the pending patent and trademark applicants and inventors to ensure that there are adequate safeguards for data privacy and security implemented by both parties. For proper guidance, please refer to NPC Circular No. 2016-02 – Data Sharing Agreements Involving Government Agencies.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMOND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information In Information And Communications Systems In The Government And The Private Sector, Creating For This Purpose A National Privacy Commission, And For Other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173, (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩
-
Id. ↩
-
Id. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, § 20 (a). ↩