Office for Harmonization in the Internal Market (Trade Marks and Designs)

DATA PROTECTION REGISTER

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 1 of 238

Disclaimer

This document contains OHIM's Data Protection Register established in accordance with articles 24.1.(d), 25 and 26 of Regulation 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (Published in the Official Journal of the European Union OJ L 8 dated 12/01/2001). It is made available to the public for the purpose of direct inspection as provided by article 26 of Regulation 45/2001. It may be further inspected indirectly through the European Data Protection Supervisor (www.edps.europe.eu). This document is subject to exceptions as provided by Article 4 of Regulation 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to EU institutions and bodies documents (OJ L145 dated 31/05/2001). Therefore, notifications of processing operations of personal data covered by one of the exceptions foreseen in Regulation 1049/2001 may be partially or not reproduced in this document. In accordance with Article 10§3 of Regulation 1049/2001, OHIM's Data Protection Register is published in its current version, including its linguistic version, and format.

This document is updated regularly in accordance with the implementation of Regulation 45/2001 within OHIM. Our goal is to keep this information timely and accurate. Any error is to be brought to OHIM's Data Protection Officer's attention, who will endeavour to correct it promptly ([email protected]). Reproduction is authorized, except for commercial purposes, provided that the source and nonauthentic character are acknowledged and that it is mentioned that they have been provided free of charge. Any request concerning the OHIM's Data Protection Register may be addressed directly to OHIM's Data Protection Officer ([email protected]).

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 2 of 238

Short list of notifications of processing operations of personal data DPN-2005-001 DPN-2005-002 DPN-2005-003 DPN-2005-004 DPN-2005-005 DPN-2005-006 DPN-2005-007 DPN-2005-008 DPN-2005-009 DPN-2005-010 DPN-2005-011 DPN-2005-012 DPN-2005-013 DPN-2005-014 DPN-2005-015 DPN-2005-016 DPN-2005-017 DPN-2005-018 DPN-2005-019 DPN-2005-020 DPN-2005-021 DPN-2005-022 DPN-2005-023 DPN-2005-024 DPN-2005-025 DPN-2005-026 DPN-2005-027 DPN-2005-028 DPN-2005-029 DPN-2005-030 DPN-2005-031 DPN-2005-032 DPN-2005-033 DPN-2005-034 DPN-2005-035 DPN-2005-036 DPN-2005-037 DPN-2005-038 DPN-2005-039 DPN-2005-040 DPN-2005-041 DPN-2005-042 DPN-2005-044 DPN-2005-045 DPN-2005-046 DPN-2005-047 DPN-2005-048 DPN-2005-049 DPN-2005-050 DPN-2005-057 DPN-2005-065 DPN-2005-066 DPN-2005-067 DPN-2005-068 DPN-2005-069 DPN-2005-070 DPN-2005-071 DPN-2005-072 DPN-2005-073 DPN-2005-074 DPN-2005-075

Output statistics for operations carried out in ATMDD Work allocation statistics in ATMDD Formalities Service Rapporteur Statistics (MS Excel) Planned Absences (MS Excel) 2nd Board Decision Database (MS Excel) 2nd Board Absence Database (MS Excel) 1st Board Databases (MS Access and MS Excel) Search on Decisions of the Boards of Appeal Decisions of the Boards of Appeal (Paper, MSWord, PDF) Paper File (Paper) Registry Distribution of BoA Decisions (MS Excel) Registry Distribution of CFI Decisions (MS Excel) Final lists for Rapporteurs in case of Reallocation (MS Excel) Registry Tools (MS Excel) DHL Track Report (MS Excel) Vacation (MS Word) Planning of Absence (MS Excel) Graphs and Individual Statistics (Two MS Excel spreadsheets ) Tracking of proof readings of BoA draft and tracking of BoA Abstracts Teleworking Publication of OHIM staff direct phone numbers on the Internet. Customer Care Unit (CCU) MS Access database (Complaints) OHIM Administrative Board & Budget Committee (ABBC) members contact list Word I-reach Document Management System (including OHIM Public Register) – I-reach (to be replaced by Filenet P8) GAERD Absence Planner – MS Excel (will be migrated into MS Access in the future) Contacts DB - MS Access Mailing DB – MS Access OHIM staff legal consultations – MS Excel Market Intelligence (MINT+ MiniMINT) DB - MS Access Publication of OHIM staff direct phone number and email on Internet (update of DPN-2005-021) Staff appraisal 2004-2005 Internal selection procedure of TA and CA Internal Promotion of Officials and Regrading of Temporary Agents TMS-Training database Tramitación de bajas médicas Comisión de invalidez Reconocimiento médico anual Transferencia de expedientes medicos. Visitas de control Flexitime/Absences Payment of salaries & actuarial calculations for EU pension system Selection procedures for recruiting temporary agents Etablissement de listes nominatives dans des tableaux EXCEL Selection procedures for recruiting temporary agents Communication to OHIM’s staff of staff arrivals, mobility and departures Analytical accounting (Excel file) Keying In of Designers names and addresses into Eurodesign’s EXA module Designs Examination Production Figures (Excel file) Social well-being survey “Contactos” - Access Intranet Decisions databases Individual production objectives of the administrative support Task Force File Allocation Follow up Follow up of individual production objectives Interlocutory Revisions in MS Access Proof of use and third party observations – Examination Presentations databases Service Snapshots Statistical Snapshots Individual production objectives of the Task Force on Absolute Grounds. Follow up of individual production objectives inside a Service.

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 3 of 238

DPN-2005-076 DPN-2005-077 DPN-2005-078 DPN-2006-001 DPN-2006-002 DPN-2006-003 DPN-2006-004 DPN-2006-006 DPN-2006-009 DPN-2006-010 DPN-2006-011 DPN-2006-013 DPN-2006-016 DPN-2006-017 DPN-2006-020 DPN-2006-022 DPN-2006-023 DPN-2006-028 DPN-2007-001 DPN-2007-002 DPN-2007-003 DPN-2007-004 DPN-2007-005 DPN-2007-006 DPN-2007-007 DPN-2007-008 DPN-2007-009 DPN-2007-010 DPN-2007-011 DPN-2007-012 DPN-2007-014 DPN-2007-015 DPN-2007-016 DPN-2007-017 DPN-2007-018 DPN-2007-019 DPN-2007-020 DPN-2007-021 DPN-2007-022 DPN-2007-023 DPN-2007-025 DPN-2007-026 DPN-2007-027 DPN-2007-028 DPN-2007-029 DPN-2007-030 DPN-2007-031 DPN-2007-032 DPN-2007-033 DPN-2007-034 DPN-2007-035 DPN-2007-036 DPN-2007-037 DPN-2007-038 DPN-2007-042 DPN-2007-043 DPN-2007-046 DPN-2007-047 DPN-2007-048 DPN-2007-049 DPN-2007-050 DPN-2007-051 DPN-2007-052 DPN-2008-001 DPN-2008-002

Language check management tool Excel spreadsheet for the follow-up of complaints transmitted by the Customer Care Unit Key user resources tracking tool Teleworking survey of March 2006 ATMDD & TMD staff Language & Professional Profile Database Transfer of personal data of community staff to member states Transfer of personal data of Community Staff to Poland ABC Survey "Paying shuttle service" Management of absences of the Staff of the Office Internal selection of OHIM’s middle managers (MM) UPDATED Office space survey EuroClass Stagiaires Silent monitoring of incoming calls at Switchboard and Information Centre level. TMRD and TMCD Production Statistics GESTION ET CONSULTATION DES DOSSIERS PERSONNELS Disclosure of OHIM diaries Certification Procedure Quality Management System - Quality Checks QMD Photos Business cards and compliment cards Internal Audits OHIM's Data Protection Register Legal consultancy for private matters of our staff Activities during school holidays: farm school, teens’ camp Social activities: Special offers Quality control of linguistic team Table “SYCOPAT” Translation and revision requests Social Assistance Social Financial Aids OHIM Award Prize TADCOR Minisite CTM and Design Courts Judges’ Seminars organisation (IP Academy) T4T site Administrative Archiving Procedure - ARCAD Loaning of Books Loaning of original documents + 3 dimensional objects related to CTM & RCD applications from the Archives Quality control of the RCD bulletin (Merged into DPN-2012-009) Residence permits - Transfer of personal data of Community Staff to Spanish Foreign Affairs Ministry OLA’s feasability project Service Desk Quality Control Staff Committee’s Internal Call for Interests Database of the CTM Download Licensees and Database of the CTM Download users’ e-mails Distribution of Alicante News Events of the Office List of attendees to OHIM booth during Annual Meetings & trade fairs INTA and other meetings invitations to Members OAMI Organigramme External distribution of publications Statistics in relation to e-business Alicante News Statistics - Owner & Representative ranking figures Mailing Call Centre Technology Early retirement without reduction of pension rights Goods and Services Database CFI/ECJ Info Service, Informing about CFI and ECJ judgments Training Survey Reimbursement of language stays expenses After School Nursery Incidents and Change Requests Management Publication of list of EPIS with photo Tasks statistics (BoA Registry) Survey for the management of the Gymnasium

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 4 of 238

DPN-2008-003 DPN-2008-004 DPN-2008-005 DPN-2008-006 DPN-2008-007 DPN-2008-008 DPN-2008-009 DPN-2009-001 DPN-2009-002 DPN-2009-003 DPN-2009-005 DPN-2009-006 DPN-2009-007 DPN-2009-009 DPN-2009-010 DPN-2010-001 DPN-2010-002 DPN-2010-003 DPN-2010-005 DPN-2010-007 DPN-2010-008 DPN-2010-009 DPN-2011-001 DPN-2011-002 DPN-2011-003 DPN-2011-004 DPN-2011-005 DPN-2011-006 DPN-2011-007 DPN-2011-009 DPN-2011-010 DPN-2012-001 DPN-2012-002 DPN-2012-003 DPN-2012-004 DPN-2012-005 DPN-2012-006 DPN-2012-007 DPN-2012-008 DPN-2012-009 DPN-2012-010 DPN-2012-011 DPN-2013-001 DPN-2013-002 DPN-2013-003 DPN-2013-004 DPN-2013-005 DPN-2013-006 DPN-2013-007 DPN-2013-008 DPN-2013-009 DPN-2013-010 DPN-2013-011 DPN-2013-012 DPN-2013-013 DPN-2014-002 DPN-2014-003 DPN-2014-004 DPN-2014-005 DPN-2014-006 DPN-2014-007 DPN-2014-008 DPN-2014-009 DPN-2014-010 DPN-2014-011

Improvement Idea Form Rules concerning Elections and Appointment to the Staff Committee Internal mobility Probationary period Report Establishment of annual appraisal reports (Updated by DPN-2015-001) Organisation of training activities for staff members Quality Management System - Ex ante quality checks Employee Opinion Survey Customer Relationship Management System (CRM) Questionnaire to those involved in quality control TMD Production Statistics (Replaced by DPN-2013-003) Usage of user names and emails into Clarity Photographs for Web site Empirical analysis of correlations between work system variables and decision making Management of personal data of staff on general HR database (Updated by DPN-2014-010) Business Objects (BO) repository administration Google Analytics Control and management of sickness leaves (Update of DPN-2005-035) Quality Management System, ex-post quality check of TM decisions (Updated by DPN-2012-009) Details invoices by month (late) Upgrade of the Library Management System Infrastructure Audit Survey Management of requests related to credit cards for staff going on mission Installation of a “Localizator GPS” in the car fleet of OHIM Reference check of Candidates on OHIM reserve lists (merged in DPN-2012-007) informal procedure relating to the Anti-harassment Policy Selection and appointment of confidential counsellors among certified mediators Selection and appointment by the SC of confidential counsellors Selection and appointment procedures of managers User Satisfaction Survey Mediation in inter partes proceedings Excel database of OHIM staff going on mission Ad Hoc Satisfaction Surveys Administrative investigations and disciplinary proceedings at OHIM E-mail address polling Videoconferencing system Reporting on interactions with external users Recruitment procedures Medical files (Update of DPN-2005-037 & DPN-2005-039) Quality Management System, Ex Post Quality Checks (EPQC) (Update of DPN-2010-005) Psychosocial risk assessment Survey Sustainable Mobility Plan OHIM Academy Learning Portal (OALP) Listado del personal de la obra - coordinación seguridad y salud Follow up of individual production and timeliness Procurement procedures Livechat Tmclass Attestation procedure (ex-C and ex-D categories) Working time management, Flexi-time and Leave (Update of DPN-2005-040) "Quien es quien” - Tabla de personal UTEs, Proyecto AE4 2 Tmview Designview FBP Area Customer Feedback Survey 2013 Missions Multi-functionality database Events Platform User Satisfaction Survey: Seconded National Experts (SNE) Programme Acuerdo entre la Consellería de Sanidad y la OAMI: Vacunas Traineeship Programme Satisfaction Survey Verification procedure of telecommunication services bills in case of excessive costs Survey of fiscal non-residents on Spanish tax issues Teleworking (Update of DPN-2006-008) Prevention and management of conflicts of interests Management of personal data of staff on general HR database (update of DPN-2009-010) Orphan Works database

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 5 of 238

DPN-2014-012 DPN-2014-013 DPN-2014-014 DPN-2015-001 DPN-2015-002 DPN-2015-003 DPN-2015-004 DPN-2015-005 DPN-2015-006 DPN-2015-007 DPN-2015-008 DPN-2015-009 DPN-2015-010

Enforcement database ACRIS database OD Contribution to Events Missions & Training Staff Appraisal (Update of DPN-2008-007) Prevention and management of conflicts of interests for AB/BC members Open space survey Request of information to OHIM Temporary and Contract Staff Events, meetings, etc, organized by ICLAD Ideas Powered Organisation and management of events by the Academy Work allocation statistics in OD and CSD (Update of DPN-2005-002) RCD-Download CTM-Download

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 6 of 238

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 7 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-001 (ATMDD 01)

Organisational Entity:

ATMDD

Processing Operations:

Output statistics for operations carried out in ATMDD

Purposes:

To enable the activities of the Department to be managed and to ensure that the requirements of the Staff Regulation can be met (in particular Articles 34, 43 and 45).

Categories of Data:

Not provided.

Processor:

Immediate line managers, their superiors, the Director and Deputy Director of ATMDD and their secretaries.

Retention Period:

None

Data Subjects:

All ATMDD staff

Information to Data Subjects: When and Data Subjects are informed:

This notification will be made available to all staff.

Right to Block Data:

None

Right to Erase Data:

None

Legal Basis:

Staff Regulation, in particular Articles 34, 43 and 45.

Legal Instrument: Recipients:

Immediate line managers, their superiors, the Director and Deputy Director of ATMDD and their secretaries

Transfer to Third Parties

NO

Security Measures: EDPS Reference:

2004-0287

Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 8 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-002 (ATMDD 02)

Organisational Entity:

ATMDD

Processing Operations:

Work allocation statistics in ATMDD Formalities Service

Purposes:

To enable a fair and allocation of workload. To enable the management of the service.

Categories of Data:

Allocated workload.

Processor: Retention Period: Data Subjects:

Members of ATMDD Formalities Service

Information to Data Subjects:

Yes

When and Data Subjects are informed:

This notifications will be made available to the staff.

Right to Block Data:

None

Right to Erase Data:

None

Legal Basis:

Staff Regulation, Articles 34, 43 and 45

Legal Instrument: Recipients:

Inmediate line managers, Head of Service and Department

Transfer to Third Parties

NO

Security Measures: EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 9 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-003 (BoA 01)

Organisational Entity:

BOA

Processing Operations:

Rapporteur Statistics (MS Excel)

Purposes:

Monitoring and follow-up output of decisions of the Boards of Appeal.

Categories of Data:

Number of Decisions taken by Member. Also shows data grouped by Board.

Processor:

Administrative Assistant to Senior Registrar, IT-Coordinator.

Retention Period: Data Subjects:

Members of the Boards of Appeal.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects are sent the information once it has been compiled.

Right to Block Data:

Immediate.

Right to Erase Data:

Immediate

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Decision no ADM-02-35 of 30 October 2002

Recipients:

Members of the Boards of Appeal, President of the Boards of Appeal, DASS, President of the Office.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0294

Notification Status:

REGISTERED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 10 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-004 (BoA 02)

Organisational Entity:

BOA

Processing Operations:

Planned Absences (MS Excel)

Purposes:

Ensuring Board staff knows when other Board staff are absent.

Categories of Data:

Dates of leave by person.

Processor:

Secretaries assigned by President of the Boards of Appeal.

Retention Period: Data Subjects:

Members, Heads of Service and the President’s staff.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects are requested to provide the information and are sent the weekly table.

Right to Block Data: Right to Erase Data: Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Decision no ADM-02-35 of 30 October 2002

Recipients:

Members of the Boards of Appeal, President’s staff, Secretaries of the Boards of Appeal.

Transfer to Third Parties

NO

Security Measures:

NO

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

ABSENCES

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 11 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-005 (BoA 03)

Organisational Entity:

BOA

Processing Operations:

2nd Board Decision Database (MS Excel)

Purposes:

Monitoring the handling of decision tasks of the 2nd Board of Appeal.

Categories of Data:

Details of decisions taken and pending by Members and Legal Assistants.

Processor:

Secretaries assigned by Chairperson of 2nd Board.

Retention Period: Data Subjects:

Members of the 2nd Board of Appeal, Legal Assistants of the 2nd Board of Appeal.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects have access to the information.

Right to Block Data:

Indefinite.

Right to Erase Data:

Indefinite.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Article 4 of the Rules of Procedure of the Boards of Appeal, Decisions of the Authority of the Boards, Article 43 of the Staff Regulations.

Recipients:

Members of the 2nd Board of Appeal, Legal Assistants of the 2nd Board of Appeal, Secretaries of the 2nd Board of Appeal.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0295

Notification Status:

ARCHIVED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 1/0201

Page 12 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-006 (BoA 04)

Organisational Entity:

BOA

Processing Operations:

2nd Board Absence Database (MS Excel)

Purposes:

Ensuring 2nd Board staff know when other 2nd Board staff are absent.

Categories of Data:

Dates and type of leave by person.

Processor:

Secretaries assigned by Chairperson of 2nd Board.

Retention Period: Data Subjects:

Staff of the 2nd Board of Appeal.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects have access to the information.

Right to Block Data:

Indefinite.

Right to Erase Data:

Indefinite.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Decision no ADM-02-35 of 30 October 2002

Recipients:

Members of the 2nd Board of Appeal, Legal Assistants of the 2nd Board of Appeal, Secretaries of the 2nd Board of Appeal.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

ABSENCES

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 13 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-007 (BoA 05)

Organisational Entity:

BOA

Processing Operations:

1st Board Databases (MS Access and MS Excel)

Purposes:

Tracking the processing of appeal files. Providing statistics regarding decisions taken and pending cases of the 1st Board of Appeal.

Categories of Data:

Details regarding current location/state of appeal file, and indicating the assigned person and the date of the assignment. Statistics on the number of decisions taken and pending by Members and Legal Assistants.

Processor:

Secretaries assigned by Chairperson of 1st Board .

Retention Period: Data Subjects:

Members of the 1st Board of Appeal, Legal Assistants of the 1st Board of Appeal.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects are sent the information once it has been compiled.

Right to Block Data:

Indefinite.

Right to Erase Data:

Indefinite.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Article 4 of the Rules of Procedure of the Boards of Appeal, Decisions of the Authority of the Boards, Article 43 of the Staff Regulations.

Recipients:

Members of the 1st Board of Appeal. Legal Assistants of the 1st Board of Appeal. Secretaries of the 1st Board of Appeal. IT-Coordinator of the Boards of Appeal.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0296

Notification Status:

ARCHIVED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 14 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-008 (BoA 06)

Organisational Entity:

BOA

Processing Operations:

Search on Decisions of the Boards of Appeal

Purposes:

Allows research on the case law of the Boards of Appeal decisions.

Categories of Data:

Name and address of parties and representatives Name of Members and Registrar

Processor:

Selected DASS staff.

Retention Period:

No time limit decided

Data Subjects:

Parties and representative in appeal proceedings, Member of the Boards of Appeal, Registrar of the Boards of Appeal.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Clients have to send the information as part of the Notice of Appeal. Members are assigned to cases. Registrar is assigned by the regulations.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Rules 48 and 50 of Commission Regulation (EC) No 2868/95

Recipients:

Intranet: Staff of the Office Internet: The general public.

Transfer to Third Parties

YES

Security Measures:

NO

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SEARCH TOOL / REGISTER

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0201

Page 15 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-009 (BoA 07)

Organisational Entity:

BOA

Processing Operations:

Decisions of the Boards of Appeal (Paper, MSWord, PDF)

Purposes:

Permits a decision to be sent to the client.

Categories of Data:

Name and address of parties and representatives Name of Members and Registrar

Processor:

Staff of the Boards of Appeal.

Retention Period: Data Subjects:

Parties and representative in appeal proceedings, Member of the Boards of Appeal, Registrar of the Boards of Appeal.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Clients have to send the information as part of the Notice of Appeal. Members are assigned to cases. Registrar is assigned by the regulations.

Right to Block Data:

Indefinite.

Right to Erase Data:

Indefinite.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Rule 50 Commission Regulation (EC) No 2868/95

Recipients:

Decision is sent to the clients. Decision is available to all staff of the OHIM and is published.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 16 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-010 (BoA 08)

Organisational Entity:

BOA

Processing Operations:

Paper File (Paper)

Purposes:

Permits a decision to be made on the Appeal.

Categories of Data:

Name, address, payment details, correspondence of parties and representatives. Name of Members and Registrar.

Processor:

Staff of the Boards of Appeal.

Retention Period:

Until the case is closed as "Final". Then it is sent to ARCAD (Archives).

Data Subjects:

Parties and representative in appeal proceedings, Member of the Boards of Appeal, Registrar of the Boards of Appeal.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects have to send the information as part of the Notice of Appeal.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Title VII Council Regulation (EC) No 40/94. Title X Commission Regulation (EC) No 2868/95. Commission Regulation (EC) No 216/96.

Recipients:

Staff of the Boards of Appeal, IPLU Staff and ECJ (in case of Appeal to ECJ.)

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0201

Page 17 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-011 (BoA 09)

Organisational Entity:

BOA

Processing Operations:

Registry Distribution of BoA Decisions (MS Excel)

Purposes:

Follow up on/control the distribution and notification of decisions of the Boards of Appeal.

Categories of Data:

Registry staff name.

Processor:

Registry staff of the Boards of Appeal.

Retention Period:

6 months

Data Subjects:

Registry staff

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By the Senior Registrar when the table was initiated.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Title VII Council Regulation (EC) No 40/94. Title X Commission Regulation (EC) No 2868/95. Commission Regulation (EC) No 216/96.

Recipients:

Staff of the Registry.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 18 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-012 (BoA 10)

Organisational Entity:

BOA

Processing Operations:

Registry Distribution of CFI Decisions (MS Excel)

Purposes:

Follow up on/control the distribution and notification of CFI decisions.

Categories of Data:

Registry staff name.

Processor:

Registry staff of the Boards of Appeal.

Retention Period:

6 months

Data Subjects:

Registry staff

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By the Senior Registrar when the table was initiated.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Title VII Council Regulation (EC) No 40/94. Title X Commission Regulation (EC) No 2868/95. Commission Regulation (EC) No 216/96.

Recipients:

Staff of the Registry.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 19 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-013 (BoA 11)

Organisational Entity:

BOA

Processing Operations:

Final lists for Rapporteurs in case of Reallocation (MS Excel)

Purposes:

To be able to (not to) reallocate case of the Rapporteur.

Categories of Data:

Rapporteurs’ names and related relevant appeals.

Processor:

Registry staff of the Boards of Appeal.

Retention Period: Data Subjects:

Rapporteurs

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When he/she provided the relevant information to the Senior Registrar.

Right to Block Data:

Until the cases are processed by the Boards

Right to Erase Data:

Until the cases are processed by the Boards

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Managerial duty of the Head of Service

Recipients:

Staff of the Boards.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 20 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-014 (BoA 12)

Organisational Entity:

BOA

Processing Operations:

Registry Tools (MS Excel)

Purposes:

i. Permits a decision to be made on the Appeal, ii. It is also used to extract statistics related to the Boards of Appeal, iii. Extracts of this data base can be copied for the purpose of lightening the exploitation of the data contained therein.

Categories of Data:

Clients: Name, address. Members: Name

Processor:

Registry staff of the Boards of Appeal.

Retention Period: Data Subjects:

OHIM Clients, Board Members.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects have to send the information as part of the Notice of Appeal. Rapporteurs are assigned to cases according to the CTMR.

Right to Block Data:

Indefinite.

Right to Erase Data:

Indefinite.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Title VII Council Regulation (EC) No 40/94. Title X Commission Regulation (EC) No 2868/95. Commission Regulation (EC) No 216/96.

Recipients:

Staff of the Office.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 21 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-015 (BoA 13)

Organisational Entity:

BOA

Processing Operations:

DHL Track Report (MS Excel)

Purposes:

To be able to trace the notifications sent by the Registry and to calculate related deadlines.

Categories of Data:

Representatives name & telephone number.

Processor:

Registry staff of the Boards of Appeal + Mail Room staff

Retention Period:

5 years. May be needed for further decision taking of fixing of costs.

Data Subjects:

Representatives

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When he/she asked for an information on the notification of communications from the Boards of Appeal.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Title VII Council Regulation (EC) No 40/94. Title X Commission Regulation (EC) No 2868/95. Commission Regulation (EC) No 216/96.

Recipients:

Staff of the Boards, IPLU, ECJ, interested persons, Public inspection if requested.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 22 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-016 (BoA 14)

Organisational Entity:

BOA

Processing Operations:

Vacation (MS Word)

Purposes:

Follow up on planned vacation of the Staff of the Registry.

Categories of Data:

Registry staff name & type of leave taken.

Processor:

Registry staff of the Boards of Appeal.

Retention Period: Data Subjects:

Registry staff

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By the Senior Registrar when the table was initiated.

Right to Block Data:

Yearly

Right to Erase Data:

Yearly

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Decision no ADM-02-35 of 30 October 2002

Recipients:

Staff of the Registry.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

ABSENCES

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 23 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-017 (BoA 15)

Organisational Entity:

BOA

Processing Operations:

Planning of Absence (MS Excel)

Purposes:

To permit members of staff to know whether a member of the DASS is absent.

Categories of Data:

DASS staff name & type of leave and training taken.

Processor:

Selected DASS staff.

Retention Period:

Data is held for future absences, and once a week the data that refers to past dates is removed.

Data Subjects:

Staff of the DASS.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By the Head of Service when the table was initiated.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Decision no ADM-02-35 of 30 October 2002

Recipients:

DASS Staff

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

ABSENCES

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 24 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-018 (BoA 16)

Organisational Entity:

BOA

Processing Operations:

Graphs and Individual Statistics (Two MS Excel spreadsheets )

Purposes:

Monitoring the tasks performed by DASS staff members and control the fulfillment of the yearly targets as defined in individuals appraisal reports.

Categories of Data:

Details of tasks performed by member of staff of the DASS.

Processor:

Secretary assigned by Head of DASS.

Retention Period:

5 years.

Data Subjects:

Staff of the DASS.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By the Head of DASS when the table was initiated.

Right to Block Data:

Yes, on request to the Head of Service

Right to Erase Data:

Yes, on request to the Head of Service

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Article 43 of the Staff Regulations

Recipients:

Head of the DASS.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0297

Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 25 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-019 (BoA 17)

Organisational Entity:

BOA

Processing Operations:

Tracking of proof readings of BoA draft and tracking of BoA Abstracts

Purposes:

Monitor the creation and revising of abstracts and proof reading of BoA drafts.

Categories of Data:

Staff name and date of task.

Processor:

DASS staff involved in proof reading has access to proof reading worksheet. Worksheet on abstract: secretary assigned by Head of Service of DASS.

Retention Period: Data Subjects:

Abstracts: DASS staff Proof reading: DASS staff, rapporteur and legal assistant

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By the Head of Service when the tables was initiated.

Right to Block Data:

Yes, on request to the Head of Service

Right to Erase Data:

Yes, on request to the Head of Service

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

DASS Staff, Proof readers.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0201

Page 26 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-020 (QMD 01)

Organisational Entity:

QMD

Processing Operations:

Teleworking

Purposes:

Operational prerequisite to the introduction of a Teleworking scheme at the Office. We need personal information on staff that would be interested in joining a teleworking scheme to ensure that it is organizationally and technically feasible. But also for the subsequent management of this scheme overtime.

Categories of Data:

Data will include data on ? Superior / department / unit name & professional coordinates ? Name & Surname of telework volunteers ? Office location + ext ? Staff no. ? Home or Telework Location address + Telephone/GSM number ? Type of interest in telework ? Compliance with selections criteria ? Current post + suitability to telework ? Telefonica diagnostic/status result of GigaADSL line or alternative ? Posts and name/surname/ext. of current holder ? Special needs ? New IP ? New professional telephone/mobile number ? Dates + status

Processor:

All the Management and their assistants, Telework Group Members and their assistants, ITFMD staff working on the Teleworking project or supporting project.

Retention Period: Data Subjects:

Staff of the Office in its largest sense.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

On data collection according to article 11. Information will be provided on the form they will volunteer the requested information.

Right to Block Data:

Within one month if not required for operational purposes

Right to Erase Data:

Within one month if not required for operational purposes

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

Management, TWG, ITFMD, FD, HRD, any subcontracted companies on a need to known basis (such as Telecom company, Health and Safety company,…).

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

TELEWORKING

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 27 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-021 (GAERD 01)

Organisational Entity:

GAERD

Processing Operations:

Publication of OHIM staff direct phone numbers on the Internet.

Purposes:

Enhance accessibility of OHIM staff for the clients and users of the CTM and RCD systems.

Categories of Data:

- Surname - First name - Telephone number - Office - Address - Department

Processor:

User Support and IT Security Service and Informatic Production of the Information Technologies and Facilities Management Department and each staff member for his own personal data.

Retention Period: Data Subjects:

OAMI staff as designated by the Directors of the Departments.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A communication will be sent out by e-mail to OHIM staff concerned.

Right to Block Data:

Whenever a change occurs (triggered by ineed) data are corrected in Intranet Directory. Subsequent regular monthly updates on the Internet.

Right to Erase Data:

Whenever a change occurs (triggered by ineed) data are corrected in Intranet Directory. Subsequent regular monthly updates on the Internet.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Any individual having Internet access (through OAMI-Online).

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

DIRECTORY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 28 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-022 (GAERD 02)

Organisational Entity:

GAERD

Processing Operations:

Customer Care Unit (CCU) MS Access database (Complaints)

Purposes:

Be able to treat and follow-up on complaints.

Categories of Data:

Personal data (name, company name, address, phone + fax number, e-mail, profession) Description of the complaint Handling of the complaint (department affected)

Processor:

GAERD Customer Care Unit team (CCU) Local Access for departments

Retention Period: Data Subjects:

Individuals and company (users, clients and other relevant IP bodies or public who have made a complaint)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When the info was provided to GAERD.

Right to Block Data:

Regular updates or as soon as GAERD is aware of any incorrect data

Right to Erase Data:

Regular updates or as soon as GAERD is aware of any incorrect data

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

GAERD Management and GAERD CCU

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

COMPLAINT / CUSTOMER CARE

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 29 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-023 (GAERD 03)

Organisational Entity:

GAERD

Processing Operations:

OHIM Administrative Board & Budget Committee (ABBC) members contact list Word

Purposes:

Have an updated contact list for mailings etc

Categories of Data:

Personal coordinates, name, address, email, tel nr, fax nr

Processor:

GAERD ABBC team + OHIM M anagement Committee

Retention Period: Data Subjects:

ABBC members

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When the data was given to the GAERD ABBC team

Right to Block Data:

No limit – the data is updated upon request

Right to Erase Data:

No limit – the data is updated upon request

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

The GAERD ABBC team

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

ABBC / DIRECTORY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 30 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-024 (GAERD 04)

Organisational Entity:

GAERD

Processing Operations:

I-reach Document Management System (including OHIM Public Register) – I-reach (to be replaced by Filenet P8)

Purposes:

In order to have an electronic Document Management System for all GAERD documents

Categories of Data:

E.g. personal data (name, address, phone number)

Processor:

GAERD staff

Retention Period: Data Subjects:

All categories

Information to Data Subjects:

Yes

When and Data Subjects are informed:

On OAMI-ONLINE (Public Register)

Right to Block Data:

No limit

Right to Erase Data:

No limit

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

GAERD staff

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

DOCUMENT MANAGEMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0201

Page 31 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-025 (GAERD 05)

Organisational Entity:

GAERD

Processing Operations:

GAERD Absence Planner – MS Excel (will be migrated into MS Access in the future)

Purposes:

Absence planner for the GAERD

Categories of Data:

Personal absence data (annual leave, illness leave, special leave, training, missions etc)

Processor:

All GAERD staff members

Retention Period: Data Subjects:

GAERD staff members

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When the data is published - the GAERD staff members are introducing the data themselves

Right to Block Data:

No time limit

Right to Erase Data:

No time limit

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

GAERD staff members

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

ABSENCES

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 32 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-026 (GAERD 06)

Organisational Entity:

GAERD

Processing Operations:

Contacts DB - MS Access

Purposes:

Be able to carry out circular mailing actions for the purpose of dissemination of OHIM information.

Categories of Data:

Personal data (name, company, address, phone number, e-mail, profession)

Processor:

GAERD ER Team, GAERD Communication Tools Team, GAERD Information Centre

Retention Period: Data Subjects:

Individuals and company (mainly users, clients and other relevant IP bodies)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When the data was given

Right to Block Data:

Upon request of the subjects or when GAERD is informed about incorrect data (e.g. returned mails) – no time limit

Right to Erase Data:

Upon request of the subjects or when GAERD is informed about incorrect data (e.g. returned mails) – no time limit

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

GAERD ER Team, GAERD Communication Tools Team, GAERD Information Centre

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

CONTACTS

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 33 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-027 (GAERD 07)

Organisational Entity:

GAERD

Processing Operations:

Mailing DB – MS Access

Purposes:

Be able to provide clients with the information material requested.

Categories of Data:

Personal data (name, company name, address, email, phone + fax number)

Processor:

GAERD Information Desk and Switchboard, GAERD ER and GAERD CT

Retention Period: Data Subjects:

Individuals and company (mainly users, clients and other relevant IP bodies)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When the information is given

Right to Block Data:

Upon request of the subjects and when GAERD is aware about incorrect data (e.g. returned mails)

Right to Erase Data:

Upon request of the subjects and when GAERD is aware about incorrect data (e.g. returned mails)

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

Themselves.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

CONTACTS

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 34 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-028 (GAERD 08)

Organisational Entity:

GAERD

Processing Operations:

OHIM staff legal consultations – MS Excel

Purposes:

In order to have a list of the cases dealt with by the lawyers

Categories of Data:

Confidential and non confidential data. Name, Office address, Grade, Office tel, subject

Processor:

The GAERD/ LIA Team members

Retention Period: Data Subjects:

All the OHIM staff, who have requested legal consultation

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Information provided orally at the moment at the counselling

Right to Block Data:

No time limit decided

Right to Erase Data:

No time limit decided

Legal Basis:

Articles 5(d) and 5(e) of Regulation 45/2001

Legal Instrument: Recipients:

The GAERD LIA Team

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 35 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-029 (GAERD 09)

Organisational Entity:

GAERD

Processing Operations:

Market Intelligence (MINT+ MiniMINT) DB - MS Access

Purposes:

Be able to carry out analysis and marketing actions for the promotion of the Office, CTM and RCD

Categories of Data:

Personal data (name, company name, address, phone + fax number, e-mail, profession). Furthermore, event type, participants, subjects, promo material distributed and conclusions.

Processor:

GAERD External Relations Team (ER), GAERD management, GAERD ADM support, GAERD Information Centre

Retention Period: Data Subjects:

Individuals and company (users, clients and other relevant IP bodies or public)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When the info was provided to GAERD

Right to Block Data:

Regular updates or as soon as GAERD is aware of any incorrect data

Right to Erase Data:

Regular updates or as soon as GAERD is aware of any incorrect data

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

GAERD ER, GAERD management, GAERD ADM support, GAERD Information Centre

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

CONTACTS

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 36 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-030 (GAERD 10)

Organisational Entity:

GAERD

Processing Operations:

Publication of OHIM staff direct phone number and email on Internet (update of DPN-2005-021)

Purposes:

Via OAMI-ONLINE enhance the accessibility of OHIM staff for the clients and users of the CTM and RCD systems.

Categories of Data:

Surname First name Telephone number Office Email Address Department

Processor:

User support and IT Security Service and Informatic Production of the Information Technologies and Facilities Department. And each staff for his own personal data.

Retention Period: Data Subjects:

OHIM staff as designated by the Directors of the Departments.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When the data was given to the GAERD

Right to Block Data:

Whenever a change occurs (triggered by Ineed) data are corrected in Intraned Directory. Subsequent regular monthly updates on the Internet.

Right to Erase Data:

Whenever a change occurs (triggered by Ineed) data are corrected in Intraned Directory. Subsequent regular monthly updates on the Internet.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Any individual having Internet access (OAMI-ONLINE)

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

DIRECTORY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 37 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-031 (HRD 01) UPDATE

Organisational Entity:

HRD

Processing Operations:

Staff appraisal

Purposes:

Drafting appraisal reports for members of staff in compliance with art. 43 of the Staff Regulations.

Categories of Data:

Full name, grade, administrative address, staff number, status, seniority in grade, starting date in job, department and budgetary post number, job title and overall purpose, data of previous job assignments (department, service, sector, period concerned) and the names and job titles of the current and the past reporting officer, if any. The reporting officer introduces an overall assessment comment dealing with appraisal of: efficiency, ability and conduct in the service.

Processor:

The members of staff in Career and Development Sector dealing with appraisals.

Retention Period: Data Subjects:

The officials and temporary agents of the Office except grades A*16 and A*15 and chairpersons and members of the Boards of Appeal.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

1st October 2004 at the launching of the appraisal exercise.

Right to Block Data:

No time limits until transfer to another institution, permanent leave or retirement

Right to Erase Data:

No time limits until transfer to another institution, permanent leave or retirement

Legal Basis:

Article 43 of the Staff Regulations

Legal Instrument: Recipients:

See Description of the data processing

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0293

Notification Status:

ARCHIVED

Keywords Class:

APPRAISAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 38 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-032 (HRD 02)

Organisational Entity:

HRD

Processing Operations:

2004-2005 Internal selection procedure of TA and CA

Purposes:

The Authority authorised to conclude the contracts of the Office is aiming to select, among the OHIM’s temporary staff : · a maximum of 20 who will be offered a renewal of their temporary contract for an indefinite period · a maximum of 30 to who will be offered a renewal of their temporary contract with the inclusion of a resolutory clause linked to the non-participation or participation and failure in the next open competition of their category organised by or at the request of the OHIM · a maximum of 25 to who will be offered a contract of contract staff, for a period of three years. These contract agents will form a pool to replace absent officials or temporary staff. · a maximum of 5 to who will be offered one or several contracts as contract agents or auxiliary staff for a maximum of three years in accordance with the Office’s specific needs in terms of replacement of absent officials or temporary staff · a maximum of 5 to who will be offered a contract as contract staff in function group I for manual tasks.

Categories of Data:

In OHIM’s internal team, candidates’: · name · birth date · address · administrative status · category · seniority date as temporary staff · date of end of the contract as temporary staff · mother tongue · language 2 · an updated European Curriculum Vitae format · the personnel number · final lists with scores In EPSO’s e-recruitment tool (EPSO Profile and searching tool): · Data requested by t he tool (available in EPSO’s web site) · Written tests of candidates · Results of written tests of candidates In the Selection Committees: · Results of written tests of candidates · Oral tests results of candidates · Career Development Reports of candidates · Final tests results of candidates (also known by OHIM internal team and appointing authority) · Final lists with scores

Processor:

OHIM: Director of HRD, responsible of the internal team, members of the internal team and IT responsible of the internal team. EPSO: (European Personnel Selection Office), members of the team in unit E of EPSO. The roles of each one of the institutions is described in the Service Level Agreement, whose draft is enclosed as Annex 1. An addendum to this SLA is going to be signed in order to mention the obligations provided for in article 3 of Reg. 45/2001 as concerns the security and confidentiality of the processing of personal data.

Retention Period:

See Description of the data processing

Data Subjects:

Members of the temporary staff of the OHIM having a contract for a fixed period, at the date of publication of the selection procedure, provided they apply for the selection procedure.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Through: · Information notes of 01/10/04 and 8/10/04 (see annex 3 and 4) · Vacancy notices published on 15/10/04 (see annex 2)

Right to Block Data:

See Description of the data processing

Right to Erase Data:

See Description of the data processing

Legal Basis:

Article 112 of CTM regulation, Articles 12.3 and 82.5 of CEOS, Article 3 of decision published in OJ L 197 of 26 July 2002

Legal Instrument:

· Article 112 of CTM regulation: 1. The Staff Regulations of officials of the European Communities, the Conditions of Employment of other servants of the European Communities, and the rules adopted by agreement between the Institutions of the European Communities for giving effect to those Staff Regulations and Conditions of Employment shall apply to the staff of the Office, without prejudice to the application of Article 131 to the members of the Boards of Appeal.

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 39 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs 2. Without prejudice to Article 120, the powers conferred on each Institution by the Staff Regulations and by the Conditions of Employment of other servants shall be exercised by the Office in respect of its staff. · Article 12 3 of CEOS: 3. The European Communities Personnel Selection Office (hereinafter "the Office") shall, at their request, provide assistance to the different institutions with a view to the selection of temporary staff, in particular by defining the contents of the tests and organising the selection procedures. The Office shall ensure the transparency of selection procedures for temporary staff engaged under Article 2 (a), (b) and (d).) · Article 82 5 of CEOS: 5. The European Communities Personnel Selection Office shall, at their request, provide assistance to the different institutions with a view to the selection of contract staff, in particular by defining the contents of the tests and organising the selection procedures. The Office shall ensure the transparency of selection procedures for contract staff. · Article 3 of the Decision of the Secretaries-General of the European Parliament, the Council and the Commission, the Registrar of the Court of Justice, the Secretaries-General of the Court of Auditors, the Economic and Social Committee and the Committee of the Regions, and the Representative of the Ombudsman of 25 July 2002 on the organisation and operation of the European Communities Personnel Selection Office (Official Journal N° L 197 of 26 July 2002): Other services 1. Under an agreement between the Head of the Office and any body, office or agency, the Office may organise selection procedures for staff to be recruited by such bodies, offices or agencies. Before concluding such an agreement, the Head of the Office shall seek the approval of the Management Board. Any such agreement shall cover the financial arrangements relating to the services provided by the Office. 2. Where requested, the Office may provide technical support for internal competitions organised by individual institutions, bodies, offices or agencies. Recipients:

See Description of the data processing

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0174

Notification Status:

ARCHIVED

Keywords Class:

SELECTION

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 40 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-033 (HRD 03)

Organisational Entity:

HRD

Processing Operations:

Internal Promotion of Officials and Regrading of Temporary Agents

Purposes:

The purpose of the processing is to conduct the yearly internal promotion / regrading exercise for members of staff in compliance with article 45 of the Staff Regulations and administrative decisions ADM-05-09 and ADM-05-59.

Categories of Data:

Full name, gender, staff number, category and grade, status, seniority in grade, overall assessment comment in the last appraisal exercise (because it gives right to a minimum amount of guaranteed propmotion/regrading points), the accumulated capital of points since the last promotion / regrading, if any, the promotion / regrading threshold, the number of promotion / regrading points proposed/awarded in the current exercise, total number of promotion / regrading points (sum of accumulated points and points awarded in the current exercise), the number of promotion / regrading points in past promotions / regrading exercises, and third language (to check compliance with article 45.2 of the Staff Regulations in case of promotion).

Processor:

The members of staff in the Career and Development Sector dealing with promotions / regradings and the IT business support of the Human Resources Department.

Retention Period:

The MS-Access database built for the purpose of the yearly promotion / regrading exercise is kept for a period fixed provisionally to 10 years as from the end of the said exercise. At the end of the promotion / regrading exercise, the accumulated number of promotion / regrading points of each year is kept on a confidential electronic list in the HRD Career and Development Sector as a necessary basic working document for its use in the following promotions / regrading exercise as promotion / regrading points are accumulative over the years. This list is kept for a period fixed provisionally to 10 years as from the end of the said exercise. Both above 10 years retention periods are necessary for the purpose of appeals related to promotions. Indeed, in case of appeal, OHIM must be in a position to reconstitute with precision the situation and “environment” of past exercises. Such retention period also pursues the interests of data subjects in their right to appeal a promotion decision. Since the current promotion scheme is in force since 2003, it is considered that a sufficient and reasonable experience is necessary to fix a definitive time limit for the storage of these data. Therefore, the retention period has been fixed provisionally to 10 years. The data included in the lists published on OHIM’s intranet are governed by the conditions of use of OHIM’s intranet (i.e. published for a period of about 15 days and further archived for a period not longer than 5 years). The copy of the letter confirming the final awarding of points is kept on each individuals’ personal file until the end of the career of the person concerned. Where applicable, the copy of the decision on promotion / regrading is kept in the data subject’s personal file until the end of his/her career.

Data Subjects:

The officials and temporary agents of the Office who may be awarded promotion / regrading points (i.e. excluding grades A*16, A*15 and A*14) – see scope of decisions ADM-05-09 and ADM-05-59.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A data protection statement is attached to the notice published on OHIM’s Intranet informing about the launching of a promotions / regradings exercise with the list of candidates for promotion / regrading (see annex 4). In addition, FAQ (Frequently Asked Questions) are available on OHIM’s intranet. FAQ 28 refers precisely to the right of rectification of data (see annex 5).

Right to Block Data:

Data subjects may address a written request to HRD – Career and Development Sector – for blocking data in the cases foreseen by article 15 of Regulation 45/2001.

Right to Erase Data:

Data subjects may address a written request to HRD – Career and Development Sector – for erasing data in the cases foreseen by article 16 of Regulation 45/2001.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Article 45 of the Staff Regulations and decisions ADM-05-59 and ADM-05-09

Recipients:

Personal Data are disclosed as follows: . Individually to the members of staff to whom promotion / regrading points are to be awarded (individual notifications described above), an individual having access only to his/her own data. . The Directors of Department in charge of members of staff to whom promotion / regradingpoints are to be awarded. The data of each official and temporary agent included on the database are only disclosed to the director of the department to which the member of staff belongs. . The members of the Management Committee in the meeting on the global awarding of promotion points and the comparative examination of merits are discussed. This will be done on the basis of a list including the staff members for whom points must be proposed. . The members of HRD’s Personnel Administration Sector in charge of personal files (for the filing of definitive notification of points and preparation of decisions on promotion/regrading) . The members of the Joint Evaluation and Promotions Committee, only in case of an appeal on the proposal of awarding of promotion / regrading points.

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 41 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2008-0095

Notification Status:

REGISTERED

Keywords Class:

PROMOTIONS, REGRADINGS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 42 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-034 (HRD 04)

Organisational Entity:

HRD

Processing Operations:

TMS-Training database

Purposes:

. Collecting data for statistics on global training days and average training days per person . Issuing for training certificates on request by the member of staff concerned . Monitoring the training objectives of the Office . Ensure a follow-up on the trainings attended by the members of staff

Categories of Data:

Full name, staff number, category and grade, telephone number and administrative address, title of training course, number of hours, date of starting, date of finishing, language of the course, level, attendance or not attendance to the training event.

Processor:

The members of staff in the Career and Development Sector dealing with trainings and the TMS developer within ITFMD.

Retention Period: Data Subjects:

The officials, temporary agents, and auxiliaries of the Office. In certain cases temping staff and spouses to members of staff.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

After applying for the course, with the confirmation by the person in charge of the course from the Career and Development Sector by means of an e-mail.

Right to Block Data:

No time limit

Right to Erase Data:

No time limit

Legal Basis:

None

Legal Instrument: Recipients:

See Description of the data processing

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

TRAINING

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 43 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-035 (HRD 05)

Organisational Entity:

HRD

Processing Operations:

Tramitación de bajas médicas

Purposes:

Cumplimiento del artículo 59 del estatuto al respecto de las ausencias por baja médica.

Categories of Data:

Nombre y apellidos Diagnóstico Fecha de visita médica Periodo de baja

Processor:

Médico asesor, enfermera y médico de control. Personal de Administración (en este último caso con acceso únicamente al dato de los días de baja)

Retention Period: Data Subjects:

Todo el personal estatutario

Information to Data Subjects:

Yes

When and Data Subjects are informed:

En la actualidad cuando recibimos un certificado médico, no entregamos al agente ningún documento sobre la confidencialidad de sus datos. Vamos a proceder a la distribución de un comunicado mediante mail a todo el personal estatutario sobre las indicaciones expuestas en el artículo 11.

Right to Block Data:

Documentación asociada a la custodia del historial médico, es decir 30 años de posesión desde la fecha de ingreso del afectado.

Right to Erase Data:

Documentación asociada a la custodia del historial médico, es decir 30 años de posesión desde la fecha de ingreso del afectado.

Legal Basis:

Article 59 of the Staff Regulations

Legal Instrument: Recipients:

Médico asesor, enfermera y médico de control. Personal de Administración (en este último caso con acceso únicamente al dato de los días de baja)

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2005-0168

Notification Status:

ARCHIVED

Keywords Class:

MEDICAL FILE / HEALTH

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 44 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-036 (HRD 06)

Organisational Entity:

HRD

Processing Operations:

Comisión de invalidez

Purposes:

Dar curso a una cuestión estatutaria relativa a las solicitudes de consideración de incapacidad permanente y transitoria.

Categories of Data:

Nombre y apellidos Resultado de la visita: dictamen médico y administrativo Nº de empleado

Processor:

Parte médica: médico de control, médico asesor. Parte administrativa: asistente de prevención, asistente de administración, Director de DRH.

Retention Period: Data Subjects:

Personal estatutario.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Mediante carta al interesado en la convocatoria de la comisión, con todas las prescripciones de los artículos 11 y 12.

Right to Block Data:

Asociado al historial médico personal, es decir 30 años.

Right to Erase Data:

Asociado al historial médico personal, es decir 30 años.

Legal Basis:

Article 59 of the Staff Regulations

Legal Instrument: Recipients:

Además del agente/funcionario implicado, el servicio médico, el sector administración, un tercer médico, personal asignado del sector de administración y el director de DRH.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2005-0168

Notification Status:

REGISTERED

Keywords Class:

MEDICAL FILE / HEALTH / INVALIDITY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 45 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-037 (HRD 07)

Organisational Entity:

HRD

Processing Operations:

Reconocimiento médico anual

Purposes:

Facilitar el cumplimiento del artículo 59 del estatuto según el cual todo el personal estatutario debe realizar un reconocimiento médico anual.

Categories of Data:

Nombre y apellidos Edad Peso, talla Datos de actualización de historia clínica Nº de personal Antecedentes médicos familiares Pruebas médicas complementarias Nacionalidad

Processor:

Médico asesor, enfermera.

Retention Period: Data Subjects:

Personal estatutario

Information to Data Subjects:

Yes

When and Data Subjects are informed:

En la última página del reconocimiento aparece el siguiente párrafo: “Asimismo le informamos que los datos obtenidos en este examen de salud, serán incorporados en un archivo informático, dentro del programa de gestión preventiva PREVEN C/S32, garantizándose en todo momento la confidencialidad de los mismos y el cumplimiento de las disposiciones de la Ley Orgánica 17/1999, de 13 de Diciembre, de Protección de Datos de Carácter Personal (L.O.P.D.)” En lo sucesivo, enviaremos en los propios cuestionarios previos al reconocimiento un párrafo que cumpla con las exigencias de los artículos 11 y 12.

Right to Block Data:

Documentación asociada a la custodia del historial médico, es decir 30 años de posesión desde la fecha de ingreso del afectado.

Right to Erase Data:

Documentación asociada a la custodia del historial médico, es decir 30 años de posesión desde la fecha de ingreso del afectado.

Legal Basis:

Article 59 of the Staff Regulations

Legal Instrument: Recipients:

Médico asesor, enfermera y usuario afectado

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2005-0168

Notification Status:

ARCHIVED

Keywords Class:

MEDICAL FILE / HEALTH

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 46 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-038 (HRD 08)

Organisational Entity:

HRD

Processing Operations:

Transferencia de expedientes medicos.

Purposes:

Responder a una solicitud administrativa de otra institución europea o agencia.

Categories of Data:

Nombre y apellidos, enfermedades, diagnósticos, declaración de accidentes, DNI, nº de empleado, dirección, certificados de baja, certificados médicos de familiares, informes médicos de de visitas de control, certificados de maternidad y lactancia, autorizaciones de estancia fuera del lugar de afectación, certificados de doble asignación de hijo a cargo.

Processor:

Médico asesor, enfermera.

Retention Period: Data Subjects:

Todo el personal estatutario

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Solicitud de permiso mediante mail explicando lo que implica el proceso al agente/funcionario implicado.

Right to Block Data:

Documentación asociada a la custodia del historial médico, es decir 30 años de posesión desde la fecha de ingreso del afectado.

Right to Erase Data:

Documentación asociada a la custodia del historial médico, es decir 30 años de posesión desde la fecha de ingreso del afectado.

Legal Basis:

Article 59 of the Staff Regulations

Legal Instrument: Recipients:

Servicios médicos de otras instituciones

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2005-0168

Notification Status:

REGISTERED

Keywords Class:

MEDICAL FILE / HEALTH

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 47 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-039 (HRD 09)

Organisational Entity:

HRD

Processing Operations:

Visitas de control

Purposes:

Dar curso a una cuestión estatutaria relativa al control y validez de las bajas por enfermedad.

Categories of Data:

Nombre y apellidos Resultado de la visita: dictamen médico y administrativo Domicilio Fecha de la visita

Processor:

Parte médica: médico de control, médico asesor. Parte administrativa: asistente de prevención, asistente de administración.

Retention Period: Data Subjects:

Personal estatutario.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Mediante carta al interesado con todas las prescripciones de los artículos 11 y 12

Right to Block Data:

Asociado al historial médico personal, es decir 30 años.

Right to Erase Data:

Asociado al historial médico personal, es decir 30 años.

Legal Basis:

Article 59 of the Staff Regulations

Legal Instrument: Recipients:

Además del agente/funcionario implicado, el servicio médico, el sector administración, el médico de control y un tercer médico en caso de que sea necesario.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2005-0168

Notification Status:

ARCHIVED

Keywords Class:

MEDICAL FILE / HEALTH

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 48 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-040 (HRD 10)

Organisational Entity:

HRD

Processing Operations:

Flexitime/Absences

Purposes:

For the control of absences/presences and for the information of the agent.

Categories of Data:

Name, surname, category and grade, place of origin, date of birth, professional address, personal number, number of holidays, special leave, sickness leave, number of days of compensation available.

Processor:

The agent (category C*) of the sector Administration of personal who is in charge of the input and following through of these tasks.

Retention Period: Data Subjects:

All staff working in OHIM.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

For flexitime: decision ADM/02/06 signed by the President of the Office For holidays and absences: initial decision ADM 94/30 signed by the President of the Office

Right to Block Data:

No time limit decided

Right to Erase Data:

No time limit decided

Legal Basis:

Processing is necessary for the performance of a contract to which the data subject is party.

Legal Instrument: Recipients:

ITFM department in case of program bugs, Human resources department, Line managers

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

ABSENCES

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 49 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-041 (HRD 11)

Organisational Entity:

HRD

Processing Operations:

Payment of salaries & actuarial calculations for EU pension system

Purposes:

Monthly payment of the salaries and actuarial calculation of EU pensions system.

Categories of Data:

Name, surname, personal number, grade, category, step of the agents, bank details and account number, NUP, birth date, gender, nationality, country of residence, marriage status, gender & birth date of conjoint, children and assimilated people, starting date in OHIM, contractual relationship, grade, % of activity, amounts to be paid and different concepts of payment (ex: basic salary, all kind of statutory allowances, retentions for pension, illness, accident, insurances, transfers of a part of the salary)

Processor:

To modify: only two agents (category C*) of the sector Administration of personal who are in charge of the input and following through of these tasks. To read only: the Director of HRD and his assistant, the Head of sector Administration of personal, two agents (category A* of the Financial Office and two agents (category B* and C*) of the Financial department. Special permission to read only the pay slips: three other C* category agents of the sector administration of personal. Staff of pay Master Office (PMO) & EUROSTAT.

Retention Period: Data Subjects:

All staff having a statutory contract with OHIM + staff enjoying invalidity allocation.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

DPO website.

Right to Block Data:

No time limit decided

Right to Erase Data:

No time limit decided

Legal Basis:

Staff regulations for Officials of the European community and Conditions of employment of other servants of the European community. In particular chapter V & annex XII of SR.

Legal Instrument: Recipients:

All staff having a contract with OHIM receives a monthly pay slip. PMO receives data to calculate monthly pay slips. EUROSTAT will receive once a year data to calculate actuarial values.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SALARY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 50 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-042 (HRD 12)

Organisational Entity:

HRD

Processing Operations:

Selection procedures for recruiting temporary agents

Purposes:

Selection of candidates to establishi a reserve list

Categories of Data:

Electronic data base: Full name, date of birth, gender, marital status, address, telephone number, fax number, e-mail address, data of availability, type of education, years of experience in different areas, level of knowledge in languages, level of knowledge in using IT tools. CV: in addition to the above information place of birth, number of children, contact person in case of absence, dates of obtaining diplomas, type of diplomas, dates of working experience, names and addresses of previous employers, job descriptions of previous jobs, interests, references. Points obtained by the candidates in the interviews and tests. Lists of the successful and non-successful candidates. Minutes of the meetings of the Selection Committees.

Processor:

The members of staff in charge with the selection procedure For x:/recruitment_2003: the members and the chairperson of the Selection Committees

Retention Period: Data Subjects:

The applicants of the selection procedures.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By notification to the DPO. (From 2005 on a special advice will be attached to the publications relating to the selection procedures).

Right to Block Data:

See Description of the data processing

Right to Erase Data:

See Description of the data processing

Legal Basis:

Conditions of Employment of other servants of the European Communities, particularly Article 12.

Legal Instrument: Recipients:

See Description of the data processing

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0174, 2005

Notification Status:

ARCHIVED

Keywords Class:

SELECTION

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 51 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-044 (HRD 14)

Organisational Entity:

HRD

Processing Operations:

Etablissement de listes nominatives dans des tableaux EXCEL

Purposes:

Aide aux Départements dans le traitement de leurs dossiers de marques (langues pratiquées par certains collègues, …) ou dans la présentation de l’Office faite extra -muros.

Categories of Data:

· · · · · · ·

Processor:

Secretariat de DRH, correspondant informatique, Direction du DRH, secteur promotion, évolution de carrière, mobilité interne

Noms des agents de l’Office et/ou Catégorie des agents de l’Office et/ou Nationalité des agents de l’Office et/ou Langues des agents de l’Office et/ou Type de contrats des agents de l’Office et/ou Lien statutaire des agents de l’Office et/ou Département d’affectation des agents de l’Office …

Retention Period: Data Subjects:

Agents de l’Office

Information to Data Subjects:

NO

When and Data Subjects are informed:

Non spécifié.

Right to Block Data:

See Description of the data processing

Right to Erase Data:

See Description of the data processing

Legal Basis:

None

Legal Instrument: Recipients:

See Description of the data processing

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

DIRECTORY / PROFILE

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 52 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-045 (HRD 15)

Organisational Entity:

HRD

Processing Operations:

Selection procedures for recruiting temporary agents

Purposes:

Selection of candidates to establish reserve lists

Categories of Data:

Electronic data base: Full name, date of birth, gender, nationality, address, telephone number, fax number, e-mail address, data of availability, type of education, years of professional experience, level of knowledge in languages, level of knowledge in using IT tools. CV: in addition to the above information dates of obtaining diplomas, type of diplomas, dates of working experience, names and addresses of previous employers, job descriptions of previous jobs, interests, skills and competences Points obtained by the candidates in the interviews and tests Lists of the successful and non-successful candidates Minutes of the meetings of the Selection Committees

Processor:

The members of staff in charge with the selection procedure For x:/recruitment_2003: the members, the chairperson and the vice-chairperson of the Selection Committees

Retention Period: Data Subjects:

The applicants of the selection procedures.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By notification to the DPO. (From 2005 on a special advice will be attached to the publications relating to the selection procedures).

Right to Block Data:

See Description of the data processing

Right to Erase Data:

See Description of the data processing

Legal Basis:

Conditions of Employment of other servants of the European Communities, particularly Article 12.

Legal Instrument: Recipients:

See Description of the data processing

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0174, 2005

Notification Status:

ARCHIVED

Keywords Class:

SELECTION

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 53 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-046 (HRD 16)

Organisational Entity:

HRD

Processing Operations:

Communication to OHIM’s staff of staff arrivals, mobility and departures

Purposes:

Inform the staff about arrivals, mobility and departures of colleagues Fulfilling a statutory obligation

Categories of Data:

Arrivals: . Date of arrival . Name and surname . Department of assignment . Nationality and first language . Category (Function group after 30/04/06) . Statutory link (FONC, AT, etc.) . Personnel number . Office Departures: . Date of departure . Name and surname . Statutory link (FONC, AT, etc.) . Personnel number . Reasons for departure WILL NOT BE PUBLISHED Mobility: . Month of mobility . Name and surname . Department of origin . Department of destination

Processor:

The person concerned in the two sectors of HRD and the team of Internal Communication in GAERD

Retention Period: Data Subjects:

Staff arriving or leaving the Office or changing department

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Notification to DPO published in DPO’s page in Insite

Right to Block Data:

Data are kept in Insite as “old news” as long as “old news” are kept (see Insite policy for news)

Right to Erase Data:

Data are kept in Insite as “old news” as long as “old news” are kept (see Insite policy for news)

Legal Basis:

Article 25 of the Staff Regulations

Legal Instrument: Recipients:

All OHIM’s staff via Insite

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

MOBILITY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 54 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-047 (DD 01)

Organisational Entity:

DD

Processing Operations:

Analytical accounting (Excel file)

Purposes:

The purpose of the processing analytical accounting is to assess the costs of each activity which the Designs Department is to carry out in order to fulfil its responsibilities, namely the registration of Community designs.

Categories of Data:

- Initials of each member of department - Timings dedicated to any of the tasks according to job description

Processor:

all Designs Department staff (each individual introduces his/her own data into hiS/her file. Password protection is to be introduced. Quality and Performance officer has read access to all).

Retention Period: Data Subjects:

all Designs Department members

Information to Data Subjects:

Yes

When and Data Subjects are informed:

They were informed of the creation of the system in February 2004 and each month a reminder is sent to them to invite to introduce their estimates.

Right to Block Data:

No time limit defined

Right to Erase Data:

No time limit defined

Legal Basis:

Articles 2, 35, 36, 37, 38, 39, 40, 45, 46, 47, 48, 49 and 50 of the Community designs Regulation (6/2002)

Legal Instrument: Recipients:

All Designs Department staff

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 55 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-048 (DD 02)

Organisational Entity:

DD

Processing Operations:

Keying In of Designers names and addresses into Eurodesign’s EXA module

Purposes:

The purpose of the processing is to comply with the Community Designs Regulation. Once keyed in, the information becomes part of the Register and it is published in the Community designs Bulletin, available in OAMI ONLINE (http://oami.eu.int/en/design/bull.htm ).

Categories of Data:

- designer’s full name - designer’s postal address - ID number given to designer

Processor:

- all design examiners with an “examiner” IT profile can key in the information - any other user of Eurodesign with a “readexam” IT profile can read the information from the database - all persons looking at the Community designs Bulletin (http://oami.eu.int/en/design/bull.htm ) (access to the names only) and in the future search facility, once implemented (the future RCD online)

Retention Period: Data Subjects:

Designers whose names are quoted within an application of a Registered Community design.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Designers do not have an obligation to be quoted into the Register. The right to be quoted in the Community designs Register is a voluntary and consented one. The Office has not right to insert a designer into the Register unless he/she wishes to do so. In fact, the designer may wa ive his/her right to be cited (Articles 18 & 36(3)(e) Community designs Regulation).

Right to Block Data:

No time limit defined

Right to Erase Data:

No time limit defined

Legal Basis:

Article 18 of the Community designs Regulation (6/2002) and articles 69 and 70 of the Community designs Implementing Regulation.

Legal Instrument: Recipients:

at large, the information becomes public as it is part of the Community designs Bulletin

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

DESIGN REGISTER

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 56 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-049 (DD 03)

Organisational Entity:

DD

Processing Operations:

Designs Examination Production Figures (Excel file)

Purposes:

The purpose of the processing is: - to monitor the volume of design applications which enter the examination module of Eurodesign, in particular by monitoring the volume of pending applications - to monitor whether the rate of design examination per examiner and per group is acceptable in order to cope with incoming applications - to monitor the charge of work for examiners, in order to find standards - to serve as an element to evaluate the examiners and Chief design examiners for the completion of the appraisal report.

Categories of Data:

- examiner’s username - number of files assigned - number of designs assigned - number of designs in several examination status - days or work - design rate - registration rate

Processor:

Director, Assistant to Director, Quality and Performance officer, Examination coordinator, Chief design examiners, all individual design examiners only with his personal references.

Retention Period: Data Subjects:

all design examiners

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Since the beginning of our examination activities (more than a year ago), they know about these statistics and receive them. They are informed after release of the tables, via Chief Designs examiners and receive a copy of the paper (without names except for the indication of statistics pertaining to themselves)

Right to Block Data:

No time limit defined

Right to Erase Data:

No time limit defined

Legal Basis:

Articles 2, 35, 36, 37, 38, 39, 40, 45, 46, 47, 48, 49 and 50 of the Community designs Regulation (6/2002) + Article 43 of Staff Regulation

Legal Instrument: Recipients:

Director, Assistant to Director, Quality and Performance officer, Examination coordinator, Chief design examiners, all design examiners

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 57 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-050 (Other)

Organisational Entity:

HRD

Processing Operations:

Social well-being survey

Purposes:

Define a new social policy for the Office. Data will be collected for specified purposes; the survey will be sorted out in a way that no personal data will appear on the forms.

Categories of Data:

No names nor personal numbers, only data concerning gender, age, category, employment relationship with OHIM and where you work. The following questions are for analytic purposes only. With the data requested it is not possible to identify a concrete member of the staff.

Processor:

All members of the Committee: Henna Viinikka, Herbert Johnston, Caroline Hetterschijt, Theophile Margellos, Ursula Schildt, Vivien Loxton, Pierre De Groodt and Inge Mendieta

Retention Period: Data Subjects:

All staff, including externals.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Information only via insite.

Right to Block Data:

Data will be stored only on the x:drives for further analysis with other surveys to be carried out in the future.

Right to Erase Data:

Data will be stored only on the x:drives for further analysis with other surveys to be carried out in the future.

Legal Basis:

JCMISA has the full support of Staff Committee and Administration.

Legal Instrument: Recipients:

JCMISA members.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SOCIAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 58 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-057 (ITFMD 07)

Organisational Entity:

ITFMD

Processing Operations:

“Contactos” - Access

Purposes:

Consulting of data to contact them –phoning, (e-)mailing and/ or faxing

Categories of Data:

Name – Title, Department – Activity of the company - Address – Phones & Faxes – e-mail & web

Processor:

Administrative support team (4 pax)

Retention Period: Data Subjects:

Providers and private and public bodies with whom we work

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Spontaneously handled by the subjects or retrieved from the purchase data base of the Office.

Right to Block Data:

No time limits

Right to Erase Data:

No time limits

Legal Basis:

Decision No. PERS-AFFECT-02-177

Legal Instrument: Recipients:

FM Service

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

CONTACTS

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 59 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-065 (TMD 01)

Organisational Entity:

TMD

Processing Operations:

Intranet Decisions databases

Purposes:

The processing of data regarding decisions has the following objectives : · Allow examiners to retrieve similar cases to those they are handling, in order to help them in their decisions and keep consistency. · Allow any person to retrieve cases according to legal criteria used, to the characteristics of the trade mark involved or, potentially, to the examiner adopting the decision.

Categories of Data:

Until recently, the identification of the Examiner was shown in the annexed decision only, but was not ‘searchable’. After the latest revision of the Intranet search tool, key in of such data is allowed and, therefore, a search on decisions adopted by a particular examiner is potentially possible for newly keyed in decisions (not available at present).

Processor:

Production Service

Retention Period: Data Subjects:

All examiners adopting decisions in legal proceedings relating to trade marks.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The examiners were requested to provide the necessary data for the creation of a database where they could lately search for the decisions already adopted. Therefore, from the moment the information was requested to them, the purpose of the database and the utility to their work was explained.

Right to Block Data:

Data is to be kept indefinitely as it forms the history of decisions of the Office.

Right to Erase Data:

Data is to be kept indefinitely as it forms the history of decisions of the Office.

Legal Basis:

Council Regulation (EC) No 40/94 of 20 December 1993 (CTMR) and Commission Regulation (EC) No 2868/95 of 13 December 1995 (CTMIR)

Legal Instrument: Recipients:

All users of the Intranet of OHIM. Anybody connecting to OHIM Website.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

CTM / DECISION

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 60 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-066 (TMD 02)

Organisational Entity:

TMD

Processing Operations:

Individual production objectives of the administrative support Task Force

Purposes:

The processing of data regarding the files dealt with by interim staff have the following objectives: · Evaluation of group and individual production of staff. · Providing comparative information regarding the production of staff. · Providing information for the evaluation of staff. · Providing information regarding the degree of synergy produced by the concentration of a reduced number of staff in a particular task. This information would be of use for any future organisation of work in the Department.

Categories of Data:

Identification of the staff name and information concerning the number of files processed on each task, together with the identification of the task.

Processor:

Data is provided by staff working in the Task Force. The processing of data is made by the Deputy Director of the Trade Mark Department and his support staff.

Retention Period: Data Subjects:

Staff working in the Task Force for administrative support of the Department.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Staff received a specific training for the tasks they had been allocated regarding the administrative support to the ‘core services’ of the Department. In the training they were shown how to do the different tasks and were informed on the number of files they should process for each task, every week. They were also informed that their output in the form of files processed per week would be registered. The relevant data is obtained from a declaration of each member of the Task Force on the number of files they have been through during the relevant week.

Right to Block Data:

See Description of the data processing

Right to Erase Data:

See Description of the data processing

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Coordinator of the Task force, who is the Controller of the present data process. The files are stored locally.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0288

Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 61 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-067 (TMD 03)

Organisational Entity:

TMD

Processing Operations:

File Allocation Follow up

Purposes:

The processing of data regarding the allocation of files has the following objectives: · Presentation of the workflows internal to the Service. · Assessment of individual processing times and production in areas not covered by target. · Providing supplementary information regarding the work of the examiners.

Categories of Data:

Identification of the examiner (code or full name) and information regarding the number of files in a particular procedural situation (status) and language allocated to them.

Processor:

Data is available only to the Head of Service and Legal Advisor of the relevant Service and to the Head of Department.

Retention Period: Data Subjects:

All TMD staff.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Head of Service regularly meet staff in their Service in order to share the information gathered in the present data process.

Right to Block Data:

See Description of the data processing

Right to Erase Data:

See Description of the data processing

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Management of the Service and Head of the Department.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0289

Notification Status: Keywords Class:

STATISTICS / APPRAISAL / WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 62 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-068 (TMD 04)

Organisational Entity:

TMD

Processing Operations:

Follow up of individual production objectives

Purposes:

The processing of data from Euromarc and MPS for the purposes of the individual production objectives has the following objectives: · Evaluation of production of the Department and of the different Services · Evaluation of individual production and productivity. · Providing comparative information regarding the production of the examiners. · Error detection procedures regarding the information contained in Euromarc that serves for the constitution of a ‘target point’ according to the yearly fixation of objectives.

Categories of Data:

Identification of the examiner (code or full name) and all the information corresponding to the ‘target points’ as defined in the TMD yearly individual production objectives document (number of decisions in Absolute and Relative Grounds, decisions on cancellation, preparation of Office’s draft pleading documents before CFI and ECJ and certain status transitions involving complex tasks).

Processor:

All examiners have access to the data. The data processing with the objective of providing the follow up of the individual production objectives is made by the Production Service of Trade Mark Department.

Retention Period: Data Subjects:

All TMD staff.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

All new examiners receive an introductory training and a training in the job on Euromarc and MPS. Consequently, they are aware of the information contained in the system and the possibilities of retrieving data. Furthermore, regarding the particular ‘target points’ retrieved in the present data processing procedure, the examiners are presented for each year with the individual production objectives they have to reach. The present data processing procedure simply develops the points contained in the production objectives in order that staff is aware of their own production and of their relative position regarding the rest of the colleagues.

Right to Block Data:

See Description of the data processing

Right to Erase Data:

See Description of the data processing

Legal Basis:

Staff Regulation, Articles 34, 43 and 45

Legal Instrument: Recipients:

All TMD examiners, Line Managers of the examiners and high Management of the Department.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0290

Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 63 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-069 (TMD 05)

Organisational Entity:

TMD

Processing Operations:

Interlocutory Revisions in MS Access

Purposes:

To have the control on all requests for interlocutory revisions in TMD and the answers sent to the Boards of Appeal.

Categories of Data:

The names of the TMD Examiners and Legal Advisors dealing with the file, together with the identification of the file, the decision and appeal numbers and the response to the Interlocutory Revision (granted / granted w. fee refund, not granted). Relevant dates regarding the main actions are also stored (reception of request, date of reply).

Processor:

Secretariat of Production Service.

Retention Period: Data Subjects:

TMD Examiners of all categories.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

This database was created in the former Examination Division and exists since 1997. Its aim is to serve as a contact point between the examiners and the BoA. Therefore, all examiners were aware from its creation as it was their interface with the requests of the BoA.

Right to Block Data:

Updated everytime a new requests arrives. The existing data are never deleted.

Right to Erase Data:

Updated everytime a new requests arrives. The existing data are never deleted.

Legal Basis:

Articles 60 and 60a of the CTMR

Legal Instrument: Recipients:

Any of the TMD Examiners and their Legal Advisors.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 64 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-070 (TMD 06)

Organisational Entity:

TMD

Processing Operations:

Proof of use and third party observations – Examination

Purposes:

To have full control of all the original mails which have been sent to TMD and of who requests to see them.

Categories of Data:

File number and identification of the partially scanned mail and the date of arrival to TMD archives. Detail of the contents of the non scanned evidence (leaflets, 3D objects, catalogues, etc.) Identification of the person having requested access to the mail, the date on which it was sent to him/her and the date on which it was returned.

Processor:

Secretariat of Production Service

Retention Period: Data Subjects:

Any staff member of the OHIM.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

This database was created by the former Examination Division and exists since 1995.

Right to Block Data:

This database is updated every time a new mail arrives or a request is made. The data contained is not deleted.

Right to Erase Data:

This database is updated every time a new mail arrives or a request is made. The data contained is not deleted.

Legal Basis:

Articles 7.3 and Art. 41 of the CTMR

Legal Instrument: Recipients:

TMD Examiners, the Boards of Appeal and ATMDD (Inspection of Files) are the principal clients of this database.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 65 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-071 (TMD 07)

Organisational Entity:

TMD

Processing Operations:

Presentations databases

Purposes:

The processing of data regarding decisions has the following objectives : · Allow examiners to reuse existing presentations to create new. · Self Training resource for all TMD examiners

Categories of Data:

Usually presentations identify its creator. The database (the sorted list) does NOT contain any reference to personal data.

Processor:

TMD Production Service

Retention Period: Data Subjects:

All TMD staff having prepared a presentation that is made available to the rest of TMD Department.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The examiners were requested to provide, at their choice, the presentations in order that they could be available to everybody at the Department for reusing in total or in part for future presentation needs. Therefore, from the moment the information was requested to them, the purpose of the database and the utility to their work was explained.

Right to Block Data:

No time limit

Right to Erase Data:

No time limit

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

All staff at TMD.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 66 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-072 (TMD 08)

Organisational Entity:

TMD

Processing Operations:

Service Snapshots

Purposes:

The processing of data from Euromarc for the purposes of the Service’s situation snapshots has the following objectives: · Management and follow up of the CTMA throughout the proceedings (movements between status / workload in a particular status and language) · Management of the workload affecting the Service and the examiners of the Service for the purposes of reshuffling files between examiners or Services. The identification of bottlenecks, not only regarding workload but also languages is essential for a streamlined flow and for assuring similar processing times to all kind of files (independently of the language or the legal situation) · Follow up of the amount of files in critical situations (statuses) in order to organise quick task reallocations. · The use of such data processing is a key element for the efficient management of production and human resources inside the Services. · The information produced can also be used for preparing forecasts regarding the workload and workflows, in particular bearing in mind the linguistic and professional resources available in the Services.

Categories of Data:

Name and number of examiner, in relation with the amount of files in a particular Euromarc ‘status’ and for a particular language.

Processor:

Anyone having access to Euromarc. The processing of the relevant queries in Euromarc is made by the Head of Service or following his instructions.

Retention Period: Data Subjects:

Any examiner existing a such in Euromarc.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

All new examiners receive an introductory training and a training in the job on Euromarc. Consequently, they are aware of the information contained in the system and the possibilities of retrieving data. Furthermore, as the main purpose of the tool is the tracking of workloads, the examiners have been presented with the data processing in the regular meetings where reallocation of files has been decided in order to balance the workload per language and situation of the case (legal status).

Right to Block Data:

See Description of the data processing

Right to Erase Data:

See Description of the data processing

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Heads of Service, Head of Department.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0298

Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 67 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-073 (TMD 09)

Organisational Entity:

TMD

Processing Operations:

Statistical Snapshots

Purposes:

Le traitement des données est en effet assez vaste puisque les données obtenues avec Db-stat ou avec Business Objects servent principalement à : · la gestion et suivie des marques (mouvements a travers les status et tâches ); · gestion de la charge de travail affectée à chaque examinateur/service. Ca permet d’équilibrer la charge de travail entre les services et de distribuer la charge de travail selon la langue de procédure des dossiers. · quantité de marques/oppositions dans un certain nombre de status clé (général, par Service, etpar examinateur) ; · liste des dossiers dans un certain nombre de status clé, par examinateur, avec indication de la date d’arrivée au status afin de permettre un traitement chronologique des dossiers. · détection d’erreurs de manipulation; · L’utilisation de ces données est vitale pour la bonne gestion des services en matière de production et de ressources humaines. · C’est un outil de calcul très précis aussi pour pouvoir faire des prévisions en ce qui concerne l’activité des Services, du Département, voir de l’Office.

Categories of Data:

Le nom et le numéro de chaque examinateur, mis en relation avec le nombre de dossiers qui sont dans un ‘status’ particulier ou qui font une transition d’un ou vers un ‘status’ particulier

Processor:

Tout personne ayant accès à Euromarc ou à MPS. Le traitement des données est fait par le Production Service.

Retention Period: Data Subjects:

Tout examinateur avec accès à la base Euromarc ou MPS.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Puisque les options de query de Euromarc ont étés toujours présentes dans la base, théoriquement quand chaque utilisateur commence à utiliser Euromarc il est aussi formé dans l’obtention de données à partir d’Euromarc. Pour les options de query de MPS, une présentation des outils sera faite a tout le personnel du Département une fois le développement soit terminée de façon préalable à sa mise en production. Les traitements reguliers faits sur ces données ont été crées à la demande des examinateurs ou de ses cadres directes pour la faciliter une gestion souple de la procédure.

Right to Block Data:

No time limit

Right to Erase Data:

No time limit

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Les examinateurs, les chefs de Service, le Chef de Département.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2004-0299

Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / WORK ASSIGNMENT

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 68 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-074 (TMD 10)

Organisational Entity:

TMD

Processing Operations:

Individual production objectives of the Task Force on Absolute Grounds.

Purposes:

The processing of data regarding the files dealt with by the members of the Task Force on Absolute grounds have the following objectives: · Evaluation of production of the Task Force. · Evaluation of individual production and productivity for the purposes of being integrated into the annual Career Development Assessment. · Providing comparative information regarding the production of the examiners. · Provide information regarding the decisions arising from the pre-screening task charged to the task force. · Provide information for follow up of the evolution of the workload in the area for which the Task Force is competent and in relation with the rest of the workflows of the Department. · Provide information regarding the degree of synergy produced by the concentration of a reduced number of examiners in a pre -screening task. This information would be of use for any future decision on the internal organisation of work at TMD.

Categories of Data:

Identification of the examiner (code or full name) and information concerning the number of files processed, the destination of the files and the additional tasks in which the examiner has worked.

Processor:

Data is provided by the examiners. The processing of data is made by the Deputy Director of the Trade Mark Department and his support staff.

Retention Period: Data Subjects:

TMD staff belonging to the Task Force on Absolute Grounds.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The creation of the Task Force was made via a Call for Interest. The selected examiners were informed of their tasks, the organisation of the task force and the expected production. They were also informed of the data processing and given access to view the results of the data processing. The data is obtained from a declaration of the examiners on the number of files they have been through during the relevant week.

Right to Block Data:

Data is complete after the time unit for the objectives has elapsed (a year).

Right to Erase Data:

Data is complete after the time unit for the objectives has elapsed (a year).

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

All TMD examiners, Line Managers of the examiners and high Management of the Department.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0291

Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL / WORK ASSIGNMENT

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 69 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-075 (TMD 11)

Organisational Entity:

TMD

Processing Operations:

Follow up of individual production objectives inside a Service.

Purposes:

The processing of data has the following objectives: · Evaluation of production of the Service. · Evaluation of individual production and productivity. · Providing comparative information regarding the production of the examiners.

Categories of Data:

Identification of the examiner (code or full name) and all the information corresponding to the ‘target points’ as defined in the TMD yearly individual production objectives document (number of decisions in Absolute and Relative Grounds, decisions on cancellation, preparation of Office’s draft pleading documents before CFI and ECJ and certain status transitions involving complex tasks).

Processor:

Data is available only to the Head of Service and Legal Advisor of the relevant Service and to the Head of Department.

Retention Period: Data Subjects:

All TMD staff.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

All new examiners are requested by their Head of Service to provide the information for such processing.

Right to Block Data:

Data is complete after the time unit for the objectives has elapsed (a year). Nevertheless, it is not deleted as it forms part of the criteria used for the evaluation of the examiners of the Department.

Right to Erase Data:

Data is complete after the time unit for the objectives has elapsed (a year). Nevertheless, it is not deleted as it forms part of the criteria used for the evaluation of the examiners of the Department.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Management of the Service and Head of the Department.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2004-0292

Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 70 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-076 (TMD 12)

Organisational Entity:

TMD

Processing Operations:

Language check management tool

Purposes:

The purpose of this processing is to allow a team of native speakers to check whether the denomination of the trade mark has any meaning in any of the 20 EU official languages and whether this meaning could be relevant for absolute grounds examination regarding the list of goods and services covered by the trade mark. This team has to write down for each of the 20 languages whether there are relevant remarks or not from their native tongue point of view. Examiners dealing with the examination of absolute grounds retrieve the remarks filed for each of the trade marks they are examining and integrate the results in the decision of whether to raise an objection to the registration of the mark or not.

Categories of Data:

· · · ·

Processor:

Access to the data is granted to different categories of users. Administrator and Language Checkers can see the information and modify part of the data fields. In particular, the field containing the relevant language remarks regarding the sign of the trademark in relation with the G&S for which it is applied. The rest of TMD examiners have a READ access to the information stored in the database. They can query the database according to criteria such as number of the trade mark, denomination of the trade mark, all remarks in the 20 languages completed and examiner name.

Number of the trade mark file Denomination of the trade mark Examiner name Numbers of the classes in which the list of G&S are classified

Retention Period: Data Subjects:

Examiners recognised as such by tools for processing trade mark files (currently Euromarc and the Madrid Protocol System).

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The data process is currently going on with the help of Excel files. All examiners are informed on the working processes in the Department (training) and the need for the language check is explained, together with the information that is processed and the purposes of this process, namely to allow the examination on absolute grounds.

Right to Block Data:

See Description of the data processing

Right to Erase Data:

See Description of the data processing

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Examiners use this data process as a support for the examination of absolute grounds for refusal regarding trade mark files.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 71 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-077 (TMD 13)

Organisational Entity:

TMD

Processing Operations:

Excel spreadsheet for the follow-up of complaints transmitted by the Customer Care Unit

Purposes:

The purpose of the excel sheet is to know how many complaints we receive in relation to files dealt with within TMD, to assure that they are dealt with within a specific limit of time, detect pending cases for which a reply has not been provided and to evaluate the number and different categories of complaints which are received.

Categories of Data:

Date in which the complaint is sent to TMD examiner & TMD examiner name Deadline for TMD examiner to give elements of response to the complaint If the examiner has replied or not and if a reminder has been sent

Processor:

The controller The controller’s assistants (x5)

Retention Period: Data Subjects:

The examiners in the Trade Marks Department

Information to Data Subjects:

Yes

When and Data Subjects are informed:

In a meeting presenting the system on 3/12/2004 In an email sent by Production Service

Right to Block Data:

No time limit decided for the moment

Right to Erase Data:

No time limit decided for the moment

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

The controller and the controller’s assistants (x5) (contact points from TMD)

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

COMPLAINT / CUSTOMER CARE

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 72 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2005-078 (TMD 14)

Organisational Entity:

TMD

Processing Operations:

Key user resources tracking tool

Purposes:

· Allow TMD management to be aware of the time examiners have spent in the different projects in order to be taken into consideration as ‘additional tasks’ fulfilled besides the “target point” tasks that are directly related to the processing of files. · Allow examiners to follow up their dedication to the different projects for their own time & resources management. · Allow examiners to sum up the time dedicated to TMD projects in order to prepare their self assessment and justify the employ of their time outside the processing of files. · Allow the identification of the projects that have required more / less effort from TMD. · Allow TMD management to be aware of the use of TMD resources for projects where TMD is participating. · Allow TMD management to present to the management of the Office the degree of participation of the Department in projects having a general interest for the Office.

Categories of Data:

Data reflected in the process are the name of the examiner, the project in which he/she participates and the number of days (or day fractions) used in the relevant project activities.

Processor:

All TMD staff has access to the data.

Retention Period: Data Subjects:

Examiners of TMD

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Key users, when appointed for a particular project are informed of the data process and are required to participate to it by regularly providing the relevant data. Not willing to participate in the data process does not exclude an examiner for any project he/she wants to participate or has been appointed to participate by his / her line manager.

Right to Block Data:

Data is complete after the time unit for the objectives has elapsed (a year). Nevertheless, it is not deleted as it forms part of the criteria used for the evaluation of the examiners of the Department.

Right to Erase Data:

Data is complete after the time unit for the objectives has elapsed (a year). Nevertheless, it is not deleted as it forms part of the criteria used for the evaluation of the examiners of the Department.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Examiners and Management at TMD. Also support services being responsible of the coordination of the projects.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL / WORK ASSIGNMENT

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 73 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-001

Organisational Entity:

QMD

Processing Operations:

Teleworking survey of March 2006

Purposes:

Operational prerequisite to the introduction of a Teleworking scheme at the Office, in particular TW3, TW4 & TW5. We need personal information on staff that would be interested in joining a teleworking scheme to ensure that it is organizationally and technically feasible. But also for the subsequent management of this scheme overtime.

Categories of Data:

Data will include data on: • Name & surname • Telephone extension at the Office • Statutory situation • Type of contract • Current working location (at the office or teleworking) • Interest in teleworking • Current job + suitability for telework • Type of interest in telework • Evaluation of the distance from OHIM the data subject would like to telework • Interest to be part of Pilot 4 or 5 • Compliance with selections criteria • Special needs except for health related needs • Current IP • Dates + status

Processor:

All the Management and their assistants, Telework Group Members and their assistants, ITFMD staff working on the Teleworking project or supporting project, IT staff performing maintenance activities on the system.

Retention Period: Data Subjects:

All the OAMI staff including - officials - temporary staff - externals

Information to Data Subjects:

Yes

When and Data Subjects are informed:

On data collection according to article 11: a paragraph has been included in the survey itself to inform the data subjects.

Right to Block Data:

Within one month if not required for operational purposes

Right to Erase Data:

Within one month if not required for operational purposes

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

All the Management and their assistants; Telework Group Members and their assistants; ITFMD, FD and HRD staff working on the Teleworking project or supporting project; any subcontracted companies on a need to known basis (Telecom, Health & Safety…)

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

TELEWORKING

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 74 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-002

Organisational Entity:

QMD

Processing Operations:

ATMDD & TMD staff Language & Professional Profile Database

Purposes:

The Management Committee of the Office decided that higher efficiency in core IP operations and job satisfactions would be created by reengineering workflows according to the Principle of One File One Examiners (see definition attached). It also realised that the current structure would not allow the implementation of the aforementioned principle and, consequently decided to suppress current ATMDD and TMD Departments to create two new Departments that will have the same competence over IP core operations. Staff in these Departments have to be allocated to the new Departments with the objective of reaching a balance of expertise between the new Departments. Furthermore, the Departments will work both work in English, French, German and Spanish but will specialise in the remaining EU Official languages. Therefore, there is the need of a data process with the following purposes: • Redistribution of current employees of ATMDD and TMD to the two new operational departments. This process has to duly take into consideration the conditions on which the reorganisation has been decided. For this purpose, a database containing the relevant information for this process will be created. • As the new Department structure is created to facilitate the implementation of the One File One Examiner, it has also been considered the need to provide training to examiners in order that they can advance further in the tasks they currently do. The preparation of the training Plan needs to assess the current capabilities of examiners as regards the first “target” situation after the restructuring. The missing professional knowledge should be provided by the training Plan. Consequently, there is the need to know the current professional expertise of the involved staff. • The further development of the One File One Examiner principle requires that an assessment is made on which could be the more gradual less traumatic line of development. This also requires to compare some target ideal situation with the current capabilities of staff in order to foresee the broad lines of a medium / long term training & personal development plan. • The professional individual profiles derived from the present data process will also be used for the definition of HRD training policy with the aim of further developing professional competences towards the One File One Examiner principle.

Categories of Data:

Name & Surname Grade / Category Post Department/Service/Section Teleworker (yes/no) Tasks (see Annex II). Indication of the degree of expertise, as assessed by the Line Manager, in the particular fields of activity of the two Departments involved in the restructuring. Mother tongue Other language Skills

Processor:

QMD Project Team has access to the database for the purposes of update and query of the database. All Line Managers of the affected Departments (TMD and ATMDD) and representatives of Departments that have to provide support to the Reorganization (FD, ITFMD) have read access to the database.

Retention Period: Data Subjects:

All current statutory employees of ATMDD and TMD, excluding directors and Heads of Service.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A communication including all the details of the present notification will be addressed to all staff of ATMDD and TMD. Staff will be given a period for having access to their data and requesting modifications, if necessary. Bearing in mind that the assessment of the tasks staff is capable of doing is made by their Line Manager, any change in this area will be discussed with them. Furthermore, as the indication regarding the language profile comes from the declarations made in the yearly appraisal, HRD will also be contacted in case an indication is to be corrected. All the information regarding the restructuring process (including the creation of staff profiles and the distribution rules) will be made publicly available in the network of the Office as soon as the documents reach a final release status.

Right to Block Data:

Database will be blocked before the redistribution process starts.

Right to Erase Data:

Database will be of further interest as a reference for designing training activities and the acquisition of new professional competencies of staff

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 75 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Recipients:

Working Group on Reorganization

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT / PROFILE / REORGANISATION

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 76 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-003

Organisational Entity:

HRD

Processing Operations:

Transfer of personal data of community staff to member states

Purposes:

– Contacting officials for administrative, electoral, military, cultural or social issues related to the country of origin; – Measuring the representation of a Member State's nationals and examining the geographical balance of officials in the European institutions; – Maintaining regular working relations of Member States and European institutions in the framework of the implementation of the Treaties.

Categories of Data:

Name, title, administrative attachment, administrative address, working place (city), internal telephone number, office number, email address. Nationality and possibly administrative status is transferred only to the Member State corresponding to the nationality of the officials concerned. Exception: officials occupying posts of higher responsibility and also appearing in publicly available databases.

Processor:

HRD

Retention Period: Data Subjects:

Officials and other agents, seconded national experts

Information to Data Subjects:

Yes

When and Data Subjects are informed:

An information note compliant with the conclusions of the DPOs Working Group on "Représentations Permanentes" will be sent to the staff. The draft of this note is attached to the notification.

Right to Block Data:

None

Right to Erase Data:

None

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Permanent Representations of the Member States to the EU, embassies of the Member States in the hosting countries and ministries of foreign or European affairs of Member States.

Transfer to Third Parties

NO

Security Measures:

NO

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PERMANENT REPRESENTATIONS / MEMBER STATES

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 77 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-004

Organisational Entity:

HRD

Processing Operations:

Transfer of personal data of Community Staff to Poland

Purposes:

Updating a database of Polish nationals employed by EU instituions and agencies.

Categories of Data:

Name, status, department of assignment.

Processor:

HRD

Retention Period: Data Subjects:

Polish staff member (statutory and SNE)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

See DPN-2006-003.

Right to Block Data: Right to Erase Data: Legal Basis:

DPN-2006-003

Legal Instrument: Recipients:

Permanent Representation of the Republic of Poland to the European Union

Transfer to Third Parties

YES

Security Measures:

NO

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PERMANENT REPRESENTATIONS / MEMBER STATES

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 78 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-006

Organisational Entity:

FD

Processing Operations:

ABC

Categories of Data:

Nom prénom nº de personnel, nº de poste de travail, grade, affectation département + service, répartition du temps de travail entre activités ABC.

Processor:

En tant qu’administrateurs: les membres de Planning et Control. ITFMD a également accès (pour réaliser des interventions sur les mécanismes de la base).

Data Subjects:

Membres du personnel de l’Office (tous statuts), membres du personnel de firmes travaillant à l’Office (y compris entreprises de travail temporaire)

Information to Data Subjects:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

ACCOUNTING

Compliance with R45/2001:

NO

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 79 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-009

Organisational Entity:

SC

Processing Operations:

Survey "Paying shuttle service"

Purposes:

Put in place or not the service.

Categories of Data:

Interest for the service. If interested : name, kind of working link (contract) with th OHIM,

Processor:

Staff Committee members.

Retention Period:

If service not organized, erased in june 2006. Otherwise, depending on administrative needs of HRD and FD.

Data Subjects:

All staff including external and interim

Information to Data Subjects:

Yes

When and Data Subjects are informed:

E-mail sent on 23rd of May 2006. Further information will be sent to the data subjects in accordance with the DPO's recommendations.

Right to Block Data:

No time limit decided

Right to Erase Data:

No time limit decided

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

Staff Committee ; later on, if service organized HRD and FD

Transfer to Third Parties

NO

Security Measures:

NO

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

SURVEY / BUS SERVICE / SOCIAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 80 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-010

Organisational Entity:

HRD / OHIM

Processing Operations:

Management of absences of the Staff of the Office

Purposes:

- control of absences/presences; - management of individual rights related to holidays, sickness leaves, mission leaves, …; - information of the agent; - day-to-day operations of the service, work organisation according to the availability of the staff, ensuring mutual awareness of absences of staff working in the same organizational entity; - inform external callers of unavailability of staff when explicitly required for professional purpose; - aggregated statistics.

Categories of Data:

- name; - surname; - type of absence (holidays, special leave, sickness leave, compensation, mission, strike, training, CCP, parental leave, maternity leave, secondment, attachment, …); - starting date of the absence; - ending date of the absence; - duration of the absence (including “indefinite”).

Processor:

HRD. Respective Heads of Departments, Heads of Services, Heads of Teams, Heads of Group, Heads of Sectors.

Retention Period:

For SAP-TM and Flexitime database: no time limit decided ; For local storage on shared drive: data is held for future absences. Data that refers to past absences is deleted within 1 month.

Data Subjects:

All staff working in OHIM.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A communication has been published in Insite (see documents available).

Right to Block Data:

1 month

Right to Erase Data:

1 month

Legal Basis:

Articles 5(a) and 5(b) of Regulation 45/2001

Legal Instrument: Recipients:

HRD, Respective Head of Departments/Services/Teams/Groups/…, Switchboard and Information Centre of GAERD, ITFMD

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

ABSENCES

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 81 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-011

Organisational Entity:

HRD

Processing Operations:

Internal selection of OHIM’s middle managers (MM) UPDATED

Purposes:

Selection and appointment procedures of managers comprised in the official organisation chart of the Office.

Categories of Data:

Full name, date of birth, gender, marital status, number of children, , address, nationality and mother tongue, telephone number, fax number, e-mail address, contact person in case of absence; data refering to availability (for interviews, for taking up service), type of education (type of diplomas and titles obtained, including name of traning organization, periods), years of professional experience in the areas indicated (including names and addresses of previous employers, job descriptions of previous jobs), language knowledge and corresponding levels, level and area of IT-literacy; interests; references; photo; any other detail that the data subject declares on a voluntary basis. If the candidate is an internal staff member the following data may be indicated in addition: personnel number, status, jobtitle, department and eventual past assignments, internal telephone number, e-mail address, administrative address. Other data managed by the selection committee: -Results of the tests or pre-tests undergone by the candidates -lists of the successful and non-successful candidates -minutes of the meetings of the selection committee and final report to the Management Committee and the AA or AECE.

Processor:

-Members of staff in Career and Development Sector of HRD in charge of internal mobility and recruitment of managers: applications and CVs, agenda for organisation of interviews. -Members of Selection Committee (internal members and external members, whenever relevant) and secretariat of Selection Committee: all data -Members of Management Committee of the Office: lists of suitable candidates for final selection.

Retention Period:

The application, the CV and all the preparatory data (except the tests carried out) will be maintained 5 years in storage for dealing with eventual complaints, after the publication of the final list of succfessful candidates. Test results will be destroyed once the Selection Committee has taken note of the summary of the tests. The summary of the tests will be maintained 5 years after the publication of the final list of successful candidates. No time limits are considered for the documents related to the successful candidates as they are a part of the recruitment procedure and will remain in the recruitment folder until transfer to another institution, permanent leave or retirement.

Data Subjects:

The applicants of the selection procedures

Information to Data Subjects:

Yes

When and Data Subjects are informed:

In the acknowledgement of receipt of the application sent by the Career and Development Sector

Right to Block Data:

On written request to the controller, the data subject shall have the right to obtain from the controller the blocking of data under the conditions laid down in the Regulation. Should an applicant request the blocking of his/her personal data needed for the course of the procedure, the Controller would immediately inform him/her about any eventual impact such request may have on the individual procedure.

Right to Erase Data:

On written request to the controller, the data subject shall have the right to obtain from the controller the erasure of the personal data used during the procedure under the conditions laid down in the Regulation. Should an applicant request the erasure of his/her personal data needed for the course of the procedure, the Controller would immediately inform him/her about any eventual impact such request may have on the individual procedure.

Legal Basis:

Articles 7(1), 29 (1)(a)(i) and (ii) and 29 (1)(b) of the Staff Regulation of the European Communities, Article 12 of Conditions for Employment of other servant s of the European Communities, and Articles 5(a), 5(b), and 5(d) of Regulation 45/2001; and the Guidelines for mobility within the OHIM.

Legal Instrument: Recipients:

-Members of staff in Career and Development Sector of HRD in charge of internal mobility and recruitment of managers: applications and CVs, agenda for organisation of interviews. -Members of Selection Committee (internal members and external members, whenever relevant) and secretariat of Selection Committee: all data -Members of Management Committee of the Office: lists of suitable candidates for final selection.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

EDPS-2008-435

Notification Status:

ARCHIVED

Keywords Class:

MOBILITY

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 82 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 83 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-013

Organisational Entity:

SC / ITFMD

Processing Operations:

Office space survey

Purposes:

Evaluation of staff office space satisfaction in AC5. Enable the Office to have a better understanding of the importance of personal workspace to the individuals.

Categories of Data:

The survey form does not collect personal data. Nevertheless, it contents free text fields (“additional comments”) where the data subjects may key-in information which could lead to their identification.

Processor:

Staff Committee (L. McGarry) / ITFMD (M. Villarroya)

Retention Period:

Data to be erased once report published.

Data Subjects:

All the staff in AC5

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Information is provided in accordance with article 11 of Regulation 45/2001 directly on the survey form, just before the “Submit Survey” button (see attached documents).

Right to Block Data:

N/A

Right to Erase Data:

Data to be erased once report published.

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

The Staff Committee, the Facilities Management Service of ITFMD, the Management Committee

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY / OFFICE SPACE

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 84 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-016

Organisational Entity:

TMCD / TMRD

Processing Operations:

EuroClass

Purposes:

. Creation of a user account on the EuroClass platform . Management of the user account (contact with the user to confirm registration, alert before the imminent automatic closure of the account if it is not used, or inform about the closure of the account) . Send information to the users when they have ticked the corresponding options in the registration form . Statistics

Categories of Data:

Mandatory information for the creation of an user account on the EuroClass platform: . Username . Password (hashed) . Email Non mandatory information: . Interest in receiving information on trade marks and designs . Country . Search criteria See Registration form in annex.

Processor:

ITFMD for user account maintenance purposes.

Retention Period:

User accounts are deleted after a period of inactivity, with prior notice to the user by email. This period is set to 12 months.

Data Subjects:

Any visitor of the EuroClass platform.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A data protection statement is included in the “conditions of use” that must be accepted by the data subject to be registered (see annexes).

Right to Block Data:

No time limit decided

Right to Erase Data:

No time limit decided

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

TMRD, TMCD, GAERD, QMD for statistical purposes

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

E-BUSINESS

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 85 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-017

Organisational Entity:

HRD

Processing Operations:

Stagiaires

Purposes:

. Procédure de sélection de stagiaires, 2 fois par an. . Gestion des dossiers individuels des stagiaires pendant l’exécution de leur contrat.

Categories of Data:

. Données figurant dans l’acte de candidature (voir annexe 1). Outre les données requises par l’acte de candidature, les candidats sont libres d’ajouter toute information qu’ils estiment nécessaire à l’appréciation de leur dossier (diplômes, attestation de travail, …). . Contrat (voir annexes selon le type de décision appliquée). . Déclaration de confidentialité (annexe 2). . Données relatives aux horaires travail et demande de congés. . Certificats médicaux. Ces certificats sont transmis au Service Médical. Le traitement de ces données personnelles rentre dans le cadre de la notification faite au CEPD (Affaire 2005-0168).

Processor:

Les membres du bureau des stages au HRD.

Retention Period:

3 ans selon décisions administratives

Data Subjects:

Tout candidat visant à un contrat de stage

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Décisions administratives : . ADM-06-26 (antérieurement ADM-02-07) pour les stages rémunérés (annexe 3) Publié sur internet : oami.europa.eu/ . ADM-03-38 pour les stages non rémunérés (annexe 4) . ADM-05-63 stages pour les offices nationaux (annexe 5)

Right to Block Data:

No time limit decided

Right to Erase Data:

No time limit decided

Legal Basis:

Articles 5(b) and 5(d) of Regulation 45/2001

Legal Instrument: Recipients:

. Photos (papier) des candidats retenus transmises à la section protection pour les cartes d’accès. . Transmission de données vers SAP-HR dans le cadre de la gestion générale du personnel de l’Office . Données communiquées à l’assureur : Nom, prénom, sexe, durée du contrat

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

STAFF MANAGEMENT

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 86 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-020

Organisational Entity:

GAERD

Processing Operations:

Silent monitoring of incoming calls at Switchboard and Information Centre level.

Purposes:

Switchboard: Quality control and improvement of services in compliance with the SLA concluded with external provider (Contractor, see annex 1). Information Centre: Quality control, improvement of services, staff appraisal.

Categories of Data:

Evaluation reports (see samples in annexes 2 and 3).

Processor:

Coordinator, Management of the Department, Coordinator of Contractor with regard to Switchboard evaluations.

Retention Period:

5 years with regard to Switchboard evaluations. 1 year with regard to Information Centre staff.

Data Subjects:

Staff dedicated to Switchboard by Contractor; Staff dedicated to Information Centre; Incoming callers.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Prior to the launching of a monitoring exercise, data subjects are sent an appropriate Data Protection Statement (see annex 4). External clients (incoming callers) are requested oral consent prior to monitoring. In accordance with the EDPS opinion, an information notice is published on OHIM's internet website for the attention of callers (see Annex 5).

Right to Block Data:

Immediate

Right to Erase Data:

Immediate as far as relevant during the retention period

Legal Basis:

Articles 5(a) [Information Centre, switchboard], and 5(d) [incoming callers] of Regulation 45/2001

Legal Instrument: Recipients:

Coordinator, Management of the Department, Coordinator of Contractor with regard to Switchboard evaluations.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2007-0128

Notification Status:

REGISTERED

Keywords Class:

E-MONITORING / APPRAISAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 87 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-022

Organisational Entity:

TMCD / TMRD

Processing Operations:

TMRD and TMCD Production Statistics

Purposes:

Manage the production of both departments in the framework of the implementation of the Council Regulation 40/94 of 20 December 1993 on the Community trade mark. Manage and balance the workload of the departments and their respective services. Analyse the production in order to raise eventual organisational issues. Identify individual training needs in order to comply with the production objectives set up by the Office. The individual statistics will also be used as objective input in the framework of the annual appraisal exercise of the respective staff.

Categories of Data:

- Name - Period of reference (starting date, ending date) - Type or name of tasks - Number of task performed (change of status) - Number of letters produced

Processor:

- TMRD and TMCD directors and head of services - TMRD and TMCD Quality Officer - IT Production Service for eventual maintenance purposes

Retention Period:

No time limit for the statistical purpose ; 1 year for the appraisal purpose.

Data Subjects:

All the staff working in TMRD and TMCD, including Register, Mail Dispatch and Cancellation

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A note has been prepared in coordination with the DPO and communicated to the data subjects.

Right to Block Data:

No time limit decided

Right to Erase Data:

No time limit for the statistical purpose ; 1 year for the appraisal purpose.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Heads of Departments, the Heads of Service, the Legal Advisors and Technical Coordinator ; IT Production Service for eventual maintenance purposes

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 88 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-023

Organisational Entity:

HRD

Processing Operations:

GESTION ET CONSULTATION DES DOSSIERS PERSONNELS

Categories of Data:

• TOUTES PIÈCES RELATIVES À LA SITUATION ADMINISTRATIVE, FAMILIALE DES FONCTIONNAIRES/AGENTS ET TOUS RAPPORTS CONCERNANTS SA COMPÉTENCE, SON RENDEMENT OU SON COMPORTEMENT, ASINI QUE TOUTES PIÈCES RELATIVES AUX EVENTUELS DOSSIERS DISCIPLINAIRES DES FONCTIONNAIRES/AGENTS. • LES OBSERVATIONS FORMULÉES PAR LE FONCTIONNAIRE À L’ÉGARD DESDITES PIÈCES. EXEMPLE DE DOCUMENTS (LISTE NON EXHAUSTIVE): ACTES NAISSANCES FONCTIONNAIRE/AGENT ET ENFANTS A CHARGE, DIPLÔMES, ATTESTATIONS DE TRAVAIL, CERTIFICAT DE BONNE VIE ET MOERS/CASIER JUDICIAIRE, ATTESTATION DE NATIONALITÉ, APTITUDE MÉDICALE, ACTE DE MARIAGE/SÉPARATION/DIVORCE, LETTRE D’OFFRE, CONTRAT D’ENGAGEMENT, ACTE NOMINATION, QUESTIONNAIRES ET FORMULAIRES DEMANDE REMBOURSEMENT FRAIS, RAPPORT DE STAGE, RAPPORTS DE NOTATION, DÉCISIONS DE PROMOTION, DÉCISIONS D’AFFECTATION, DÉCISIONS DE MISE À LA RETRAITE, INVALIDITÉ, ENQUÊTES ADMINISTRATIVES ET SANCTIONS DISCIPLINAIRES CONCERNANT LE FONCTIONNAIRE/AGENT, DÉCISIONS D’AFFECTATION, ATTESTATION DE FORMATION (À LA DEMANDE DU FONCTIONNAIRE), ETC. N.B. LE DOSSIER MÉDICAL DES FONCTIONNAIRES/AGENTS NE FAIT PAS L’OBJET DE CLASSEMENT DANS LE DOSSIER PERSONNEL. POUR LES EXPERTS NATIONAUX DÉTACHÉS (END) LES DOCUMENTS SE LIMITENT À : LETTRE D’OFFRE ET TOUTE CORRESPONDANCE LIÉE AU DÉTACHEMENT, CV, DIPLÔMES, ATTESTATIONS DE TRAVAIL, ATTESTATION DE NATIONALITÉ, ATTESTATION DU DERNIER L’EMPLOYEUR, FORMULAIRE CONCERNANT LA COUVERTURE MÉDICALE, FICHE BANCAIRE, FORMULAIRES DEMANDE REMBOURSEMENT FRAIS, RAPPORTS DE NOTATION, PIÈCES JUSTIFICATIVES RELATIVES AUX PAIMENTS MENSUELS. POUR LES CONSÉILLERS SPÉCIAUX LES DOCUMENTS SE LIMITENT À : NOTIFICATION À L’AUTORITÉE BUDGÉTAIRE, DESIGNATION CONSÉILLER SPÉCIAL, CV, FICHE ENTITÉ LEGALE, FICHE BANCAIRE, CONTRATS, ATTESTATIONS MENSUELLES POUR PAIEMENT D’HONORAIRES.

Processor:

• LE DIRECTEUR DU DRH • LES GESTIONNAIRES/VÉRIFICATEURS DU DRH RESPONSABLES DU RECRUTEMENT ET DE LA GESTION ET VÉRIFICATION DES DROITS INDIVIDUELS DES FONCTIONNAIRES/AGENTS ET DES END DE L’OHMI. • LES FONCTIONNAIRES ET AGENTS PEUVENT CONSULTER LEURS PROPES DOSSIERS PERSONNELS. • LES ÉVALUATEURS/ÉVALUATRICES PEUVENT CONSULTER LES RAPPORTS DE NOTATION DE LEUR PERSONNEL OU D’UN ÉVENTUEL FUTUR PERSONNEL. • L’EVENTUEL FUTUR MANAGER PEUT CONSULTER LA PARTIE RELATIVE À LA FORMATION ET EXPERIENCE PROFESSIONNELLE ET AUX SANCTIONS DISCIPLINAIRES. • LA COUR DE JUSTICE DES COMMUNAUTÉS EN CAS DE RECOURS CONCERNANT LE FONCTIONNAIRE/AGENT. • LA COUR DES COMPTES LORS DES CONTRÔLES. • LE FINANCIAL OFFICER POUR VÉRIFICATION DANS LE CADRE DE LA DÉPENSE FINANCIÈRE ET SUITE A UNE DÉCISION ADMINISTRATIVE CONCERNANT LE FONCTIONNAIRE/AGENT. • LE SECTEUR DES AFFAIRES LÉGALES ET INSTITUTIONNELLES EN CAS DE CONSULTATION JURIDIQUE OU RÉCLAMATION. N.B. : DANS LE CADRE D’UNE POSSIBLE FUTURE DÉCENTRALISATION, LES PIÈCES JUSTIFICATIVES CONCERNANT LA FIXATION DES DROITS INDIVIDUELS ET FINANCIERS DU PERSONNEL SERONT TRANSMISES AU PERSONNEL GESTIONNAIRE CONCERNÉ DE L’OFFICE GESTION ET LIQUIDATION DES DROITS INDIVIDUELS DE BRUXELLES (PMO). ACTUELLEMENT, NOUS TRANSMETTONS À L’OFFICE EN QUESTION LES INFORMATIONS CONCERNANTS LES DROITS SOUSMENTIONNÉS AFIN QU’ELLES APPARAÎSSENT SUR LA FICHE DE SALAIRE DE NOTRE PERSONNEL. LE CALCUL ET LA MISE EN ŒUVRE DE LA FICHE DE SALAIRE EST DÉJÀ PRISE EN CHARGE PAR PMO. LES DOSSIERS PERSONNELS NE PEUVENT ÊTRE CONSULTÉS QUE DANS LES LOCAUX DE L’ADMINISTRATION. CHAQUE CONSULTATION DU DOSSIER PERSONNEL PAR L’AGENT, PAR UN LINE MANAGER, PAR LE MEMBRE CONCERNÉ DU SECTEUR DES AFFAIRES LÉGALES ET

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 89 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs INSTITUTIONNELLES FAIT L’OBJET D’UNE TRACE PRÉCISE DANS UNE FICHE (VOIR MODÈLE EN ANNEXE). Data Subjects:

TOUT FONCTIONNAIRE ET AGENT STATUTAIRE, AINSI QUE LES EXPERTS NATIONAUX DÉTACHÉS (END).

Information to Data Subjects:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PERSONAL FILE

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 90 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2006-028

Organisational Entity:

GAERD

Processing Operations:

Disclosure of OHIM diaries

Purposes:

Control diary distribution (one diary per person).

Categories of Data:

First name, last name, signature.

Processor:

All the staff.

Retention Period:

6 months

Data Subjects:

All staff working in OHIM (internal + external).

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The list of OHIM staff contains a data protection statement.

Right to Block Data:

Not applicable

Right to Erase Data:

6 months

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

Library

Transfer to Third Parties

NO

Security Measures:

NO

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PUBLICATION / DIARIES

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 91 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-001

Organisational Entity:

HRD

Processing Operations:

Certification Procedure

Purposes:

The selection of the officials authorised to take part in the compulsory training programme for the certification procedure.

Categories of Data:

Data of a personal nature allowing the identification of the official: - full name, - staff number - grade, seniority in grade, seniority in grade AST5 or above Information provided by the official allowing the practical organisation of the selection procedure: - administrative address and telephone number, - priority area chosen for the certification procedure, - present organisational assignment: department, service, sector, jobtitle and duties and functions undertaken, seniority in job (eventually), any other details the applicant wishes to insert, - previous job assignments or employments: employer, place of employment, periods, job title and duties and functions undertaken, any other details the applicant wishes to insert - language competencies (capacity to work in FR or EN), - training undertaken of academic or professional character: title of diploma or training, level when relevant, name of training organisation, training periods, relationship with priority area chosen. - Preference for Brussels or Luxembourg as a training site; - Content of the annexes the applicant joins to the application form providing justification for the abovementioned data. Data included in the three last appraisal reports (copied from the personal folder of each applicant, if not provided by applicant), in particular: - The comments of the reporting officer on performance, competencies and conduct in the service and general comments where relevant. - The overall assessment awarded - The justification of the reporting officer for checking the box F.3 (potential)

Processor:

The members of staff in Human Resources Department / Career and Development Sector dealing with the certification procedure and the IT business support of the HRD will process and treat the data.

Retention Period:

1 year after the end of the certification procedure (total closure of the exercise)

Data Subjects:

The officials in function group AST of grade 5 and higher who apply for certification.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

At the launching of the certification procedure each year.

Right to Block Data:

Immediate.

Right to Erase Data:

Immediate.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Article 45a of the Staff Regulations, Decision ADM-06-15.

Recipients:

HRD, Management Committee, Joint Evaluation and Promotion Committee , OHIM Staff Data corresponding to all applicants will be disclosed to: - the members of Human Resources Department in charge of the certification procedure for organisational purposes (formal and admissibility check, setting up of lists and files, publication and sending out of notifications…) and the IT business support of the HRD for IT reasons. Data corresponding to admissible candidates will be disclosed to: - the members of the Management Committee for selection purposes Data included in published lists (available to all OHIM staff): - list of admissible candidates: full name of official - draft list of officials authorised to take part in the training programme: full name of official - final list of officials authorised to take part in the training programme: full name of official Data corresponding to the appeal files (of candidates who are not on the draft list of officials authorised to take part in the training programme and who have introduced an appeal) will be disclosed to: - the members of the Joint Evaluation and Promotion Committee for the examination of appeals, and its secretariat Right of access and verification: applicants to the certification exercise may send a written request to HRD-Career and Development for obtaining an abstract of their personal data as

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 92 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs registered for the certification. Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2007-0138

Notification Status:

REGISTERED

Keywords Class:

SELECTION / CERTIFICATION

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 93 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-002

Organisational Entity:

TMCD / TMRD

Processing Operations:

Quality Management System - Quality Checks

Purposes:

The processing operations consist of checking quality of decisions made by examiners in the examination of classification, absolute grounds and in the opposition proceedings. A random sample of 102 CTMAs and 16 opposition files will be generated on a weekly basis. This list and data will then be used to access the file and evaluate the quality of the decision and examination. The global error rates for the examination process and opposition decisions will then be calculated. The main aim of this activity is to monitor the global quality of the outputs of the Office in relation to the Office’s service standards. However, evaluation of individuals is not the aim of quality checks. Examiners will be informed by the persons performing the check about the errors found to prevent repetition of errors.

Categories of Data:

Indirect Personal Data pointing to quality of individual’s work. Data from the production database will be extracted on a weekly basis. The data will contain basic information about all the trade mark applications and opposition files which were finalized in the given week, such us file number, CTM name, date of entering final status, etc. CTM number, CTM name and OPPO number can be used to identify the examiner. This indirect identification of the data subject can lead to processing of personal data.

Processor:

Directors of TMCD and TMRD, Legal Advisors and 1 Senior Examiner, Classification Experts, Heads of Services, Quality Officers, Quality Check tool Administrator.

Retention Period:

CTM number, CTM name and OPPO number will be kept for a period of 6 months in the MS Access Database – Quality Check Tool. After this period the data will be deleted from the system. For storage: 15 months

Data Subjects:

Examiners (of CTMA or opposition files)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Examiners will be informed about the way quality is going to be assessed, how the data is going to be used and where it is going to be stored. This information will be communicated by Heads of Services as well as by Directors in the form of an official communication.

Right to Block Data:

Not applicable once data subjects are not identifiable anymore beyond the retention period.

Right to Erase Data:

Yes, 6 months.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Directors of TMRD and TMCD, Heads of Services of TMRS and TMCD, Head of QMD Service 1 and QMS Project Team.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

MERGED

Keywords Class:

CTM / QUALITY MANAGEMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 94 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-003

Organisational Entity:

QMD

Processing Operations:

QMD Photos

Purposes:

Team social gathering.

Categories of Data:

Picture.

Processor:

QMD staff.

Retention Period:

1 year

Data Subjects:

QMD Staff

Information to Data Subjects:

Yes

When and Data Subjects are informed:

They let the pictures to be taken, and they were sent an e-mail that the pictures are in the folder.

Right to Block Data:

N/A

Right to Erase Data:

Immediate

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

QMD full team

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SOCIAL / TEAM BUILDING

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 95 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-004

Organisational Entity:

GAERD

Processing Operations:

Business cards and compliment cards

Purposes:

Production of individual professional business/compliment cards.

Categories of Data:

First name, last name, department, service, function, phone, mobile, fax and email.

Processor:

Members of Gaerd’s RUWP team in charge of the business/compliment cards, and external provider.

Retention Period:

5 years (article 38§4 of OHIM Financial Regulation)

Data Subjects:

All staff working in OHIM (internal + external).

Information to Data Subjects:

NO

When and Data Subjects are informed: Right to Block Data:

N/A

Right to Erase Data:

5 years (article 38§4 of OHIM Financial Regulation)

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument: Recipients:

Members of Gaerd’s RUWP team in charge of the business/compliment cards, external provider, the data subject, financial actors in the validation of the order form.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PUBLICATION / COMMUNICATION TOOLS / BUSINESS CARDS

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 96 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-005

Organisational Entity:

IAS

Processing Operations:

Internal Audits

Purposes:

To audit Office systems and procedures/processes for the purpose of issuing Audit Reports containing findings and recommendations and action plans/ to give assurances to the management, the Budget Commitee and the European Court of Auditors that the Office is complying with the appropriate Official rules and Regulations etc and discharging its duties in the proper manner.

Categories of Data:

Potentially all data in the Office – paper and electronic records, databases, recording interviews with staff at all levels of the organisation.

Processor:

The Internal Audit team, Administrators and QMD Secretary.

Retention Period:

Retention policy (5 years)

Data Subjects:

Potentially all staff within the Office (including any externals staff* contracted to work in the Office)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

For each Audit an Audit Notification is sent to the area or service being audited and which describes the scope and objectives of the audit. It is however not always possible to anticipate in advance everyone that will be contacted or interviewed during the course of an audit.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

CTMR Article 136, Financial Regulation of the Office Articles 71-73 and Financial Regulation IR Articles 71-73

Recipients:

Internal Audit, Management Cttee, Court of Auditors, Chairmen Administrative Board and Budget Cttee and staff/auditees.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

AUDIT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 97 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-006

Organisational Entity:

DPO

Processing Operations:

OHIM's Data Protection Register

Purposes:

Proper implementation of Regulation 45/2001.

Categories of Data:

Name and address of controllers.

Processor:

DPO, EDPS.

Retention Period:

Personal data are erased once the notification is archived, this is to say when the corresponding processing operations are not n force anymore.

Data Subjects:

Controllers as defined by article 2(d) of Regulation 45/2001

Information to Data Subjects:

Yes

When and Data Subjects are informed:

In the framework of the setting up of OHIM's Data Protection Register Inspection and Publication Policy, the notification form used to collect data related to processing operations of personal data from controllers, contains a data protection statement informing the data subject (the controller) in accordance with article 11 of Regulation 45/2001. Moreover, an additional data protection statement is attached to the DPO's opinion issued after carefull analysis of the notification for the attention of the controller.

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

DPO, EDPS

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

DATA PROTECTION REGISTER

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 98 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-007

Organisational Entity:

HRD

Processing Operations:

Legal consultancy for private matters of our staff

Purposes:

Organise the weekly 4 hours service (30 min’ per consultation).

Categories of Data:

Name, time of the appointment (occasionally the issue of the consultation).

Processor:

Social Policy Secretariat + Provider of the activity (contractor).

Retention Period:

After the consultation every week, the agenda is deleted.

Data Subjects:

Statutory staff (and family) of the office.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When the data subject requests the appointment.

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

Provider of the activity (contractor)

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SOCIAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 99 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-008

Organisational Entity:

HRD

Processing Operations:

Activities during school holidays: farm school, teens’ camp

Purposes:

Organization of activities during school holidays in the framework of OHIM’s social policy.

Categories of Data:

Staff member’s personal number Name and phone numbers (office + private) of the staff member Name and birth date of children participating in the activity Dates of participation of the children to the activities The Social Service does not collect medical data. These are to be sent immediately to the provider entrusted with the activity.

Processor:

Social Policy Secretariat

Retention Period:

Inscriptions are kept for no longer than 1 year. Since these activities are recurring, the list of children and parents is continuously kept up to date. Data is deleted when the staff members leaves the Office, when the child is not enrolled anymore or gets too old.

Data Subjects:

Parents and kids

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Staff members are informed at the moment of the inscription by mean of a specific data protection statement disclosed with all relevant information concerning outdoors activities during school holidays. Parents are informed that the provider (farm) collecting medical data is bound by the Spanish law as concerns data protection.

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument: Recipients:

HRD’s Individual Rights Sector (for payment through the salary slip) The provider (farm school) Security guards (in order to contact directly the parents in case of late/early arrival of the bus)

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SOCIAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 100 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-009

Organisational Entity:

HRD

Processing Operations:

Social activities: Special offers

Purposes:

To inform about special offers and discounts to staff.

Categories of Data:

Contact details of the companies offering discounts.

Processor:

All staff of the Office.

Retention Period:

As long as the offer remains valid (at least 1 year)

Data Subjects:

Companies who wish to publish a special offer

Information to Data Subjects:

Yes

When and Data Subjects are informed:

After receiving the offer, we send an information note on the conditions for publication. It contains all data required to the company and informs about the means of publication.

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

OHIM Staff and authorized persons to enter OHIM's premises

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SOCIAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 101 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-010

Organisational Entity:

GAERD

Processing Operations:

Quality control of linguistic team

Purposes:

a) Overall quality control of the work performed by the linguistic team; b) Evaluation of individuals.

Categories of Data:

Name of evaluated staff members; Name and language knowledge of evaluators; Quality evaluation of work done by the linguists.

Processor:

Linguistic Team Coordinator.

Retention Period:

3 years, in order to be able to evaluate the development of the quality of each linguist compared to past evaluation periods.

Data Subjects:

The members of Linguistic Team who do translation and revision work. Linguistic evaluators.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

They are aware of all the details the evaluation process and of the names of their evaluators. They get a copy of the result. The evaluation form contains a data protection statement.

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Linguistic Team Coordinator.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2007-0475

Notification Status:

REGISTERED

Keywords Class:

STATISTICS / APPRAISAL / WORK ASSIGNMENT / QUALITY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 102 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-011

Organisational Entity:

GAERD

Processing Operations:

Table “SYCOPAT”

Purposes:

a) Control of fulfilment of deadlines; b) Statistics on incoming workload in total, on workload per type of work, per requesting per department, per languages, per linguist, on dates and fulfilment of deadlines at the end of the year – data which are needed for controlling, planning and organising the sector; c) Eventually, the statistics may be used as an objective input in the annual appraisal exercise (but is definitely not the only one!).

Categories of Data:

(Type of ) production data.

Processor:

Linguistic Team, Coordinator, Director of Dept and IT people

Retention Period:

3 years

Data Subjects:

The members of Linguistic Team who do translation and revision work.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The content of the table is discussed with all the concerned colleagues in regular team meetings. They all have awareness of its existence and purposes. The personal data are rectified or erased without delay in accordance with the outcome of the linguistic team meetings where this table is discussed.

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Linguistic Team, Coordinator, Director of Dept.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

STATISTICS / APPRAISAL / WORK ASSIGNMENT / QUALITY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 103 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-012

Organisational Entity:

GAERD

Processing Operations:

Translation and revision requests

Purposes:

Process translation and/or revision of documents.

Categories of Data:

. Name of the requestor . Name of the coordinator in department (= requestor) . Name of the coordinator of the linguistic team . Author of the document to be translated and/or revised . any personal data eventually contained in the document submitted for translation and/or revision

Processor:

. Linguistic Team, Coordinator, Director of Dept . Translation Centre of the Bodies of the European Union

Retention Period:

Requests are stored for an indefinite period. Translations and revisions done in the past, and of the discussion in this regard, may be reused in the future for terminology purposes or for similar translations/revisions.

Data Subjects:

Requestor, coordinator in department (generally the requestor), coordinator of the linguistic team, author of the document to be translated/revised, any data subject identified or identifiable in the document to be translated/revised.

Information to Data Subjects:

NO

When and Data Subjects are informed:

Translation and revision procedures are explained on the GAERD’s Linguistic Team minisite on Intranet. Nevertheless, data protection issues are not addressed according to articles 11 or 12 of Regulation 45/2001.

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Requestor of the translation/revision.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

TRANSLATION

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 104 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-014

Organisational Entity:

HRD

Processing Operations:

Social Assistance

Purposes:

The main aim of this service is to assist in reconciling professional and private life. The basic concept is to secure the most favorable personal conditions for each individual in order to develop their utmost potential. Consultations may be made on matters relating to: • Family • Money • Psychological issues • Administrative issues • Adjusting to the environment and cultural issues • Health • Conflict management • Relationships • Miscellaneous The Social Worker carries out individual and collective activities in prevention, assistance and, where the need arises, social accompaniment. It is important to clarify that this is a consultation and assessment service on both professional (communication, stress, conflicts, burn-out, etc.) and personal matters (adaptation, specific problems, etc.). It also provides information on the various resources of both the Social Services of Alicante and the Institutions.

Categories of Data:

Name of the agent (not always provided and not compulsory) and description of social consultation submitted to the Social Worker.

Processor:

Only the Social Worker has access to the data. The Social Worker works alone without any administrative support.

Retention Period:

5 years maximum (emails)

Data Subjects:

Any person working for the Office (statutory or not). Related persons of family of statutory staff members.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Whenever a data subject consults the Social Worker, he/she is informed about the confidentiality of the consultation and about the code of deontology followed by the Social Worker (www.ifsw.org).

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Articles 5(d) and 5(e) of Regulation 45/2001

Legal Instrument: Recipients:

Any related family member, or any professional (doctor, psychologist, lawyer, …) directly linked with the case, only where strictly necessary and always with the prior unambiguous consent of the data subject.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2007-0171

Notification Status:

REGISTERED

Keywords Class:

SOCIAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 105 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-015

Organisational Entity:

HRD

Processing Operations:

Social Financial Aids

Purposes:

Take decision whether to grant financial support.

Categories of Data:

Personal number, name of the agent, type and justification of financial aid, amount.

Processor:

In the case of aid for disabled (Decision ADM-05-38), an ad hoc committee consisting of the Office’s medical officer, the social worker and the administrator responsible for the case concerned, and, where appropriate, two experts appointed by the President of the Office according to the nature of the disability, is consulted to take the decision. In all other cases, only the Social Worker has access to the data.

Retention Period:

5 years (article 38§6 of OHIM Financial Regulation)

Data Subjects:

Only statutory staff members and their related family.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The data subjects are informed when filling in the application for financial aid.

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

Articles 76 and 76bis of Staff Regulation or other OHIM administrative decisions.

Recipients:

Only financial actors receive the personal data needed to proceed with the financial commitment and payment. These recipients do not receive information concerning the justification of the financial aid.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2007-0172

Notification Status:

REGISTERED

Keywords Class:

SOCIAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 106 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-016

Organisational Entity:

GAERD

Processing Operations:

OHIM Award Prize

Purposes: Categories of Data: Processor: Retention Period: Data Subjects: Information to Data Subjects: When and Data Subjects are informed: Right to Block Data: Right to Erase Data: Legal Basis: Legal Instrument: Recipients: Transfer to Third Parties Security Measures: EDPS Reference:

2007-0155

Notification Status:

ARCHIVED

Keywords Class: Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 107 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-017

Organisational Entity:

GAERD

Processing Operations:

TADCOR Minisite

Purposes: Categories of Data: Processor: Retention Period: Data Subjects: Information to Data Subjects: When and Data Subjects are informed: Right to Block Data: Right to Erase Data: Legal Basis: Legal Instrument: Recipients: Transfer to Third Parties Security Measures: EDPS Reference: Notification Status:

REGISTERED

Keywords Class: Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 108 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-018

Organisational Entity:

GAERD

Processing Operations:

CTM and Design Courts Judges’ Seminars organisation (IP Academy)

Purposes: Categories of Data: Processor: Retention Period: Data Subjects: Information to Data Subjects: When and Data Subjects are informed: Right to Block Data: Right to Erase Data: Legal Basis: Legal Instrument: Recipients: Transfer to Third Parties Security Measures: EDPS Reference: Notification Status:

REGISTERED

Keywords Class: Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 109 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-019

Organisational Entity:

GAERD

Processing Operations:

T4T site

Purposes: Categories of Data: Processor: Retention Period: Data Subjects: Information to Data Subjects: When and Data Subjects are informed: Right to Block Data: Right to Erase Data: Legal Basis: Legal Instrument: Recipients: Transfer to Third Parties Security Measures: EDPS Reference: Notification Status:

REGISTERED

Keywords Class: Compliance with R45/2001:

N/A

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 110 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-020

Organisational Entity:

GAERD

Processing Operations:

Administrative Archiving Procedure - ARCAD

Purposes:

Such documents are no longer needed for everyday use but access needs to be maintained on a longer-term basis.

Categories of Data:

Name of User; Service

Processor:

Staff of Archives

Retention Period:

By default the ARCAD systems proposes a limit of 6 years, but that can be renewed by the Servicer owner or they can take the decision and request the destruction of the box.

Data Subjects:

OHIM Staff Members who have been designated by their Department or Service

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Information Note 328/00 – Implementation of the Administrative archiving procedure using the ARCAD System (Available electronically in the Doc.Centre Website)

Right to Block Data:

Immediate upon request.

Right to Erase Data:

Immediate upon request.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Information note 328/00 dated 31/10/2000

Recipients:

The data are not disclosed outside GAERD’s documentation centre in charge of the implementation of the archiving procedure.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

ARCHIVE

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 111 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-021

Organisational Entity:

GAERD

Processing Operations:

Loaning of Books

Purposes:

Manage the asset of the library and control the circulation of books.

Categories of Data:

Personnel Nº; Name; Language; Department, Office Nº; Phone Nº; E-Mail; Length of Contract, references of loaned books, number of loaned books, date of loans, due dates.

Processor:

Those who work in the Documentation Centre - mainly staff of Library and Documentation units.

Retention Period:

Until termination of Contract with the Office

Data Subjects:

OHIM Staff Members

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Once the subject in question borrows a book from the Library for the first time he/she is informed as we have to print out a form for him/her to sign giving their agreement that he/she is responsible for the book on loan to him/her. Their personnel details are at the top of this form (ID Nº; Name; Dep. /Service; Office). In addition, we inform the user that he/she can consult all their personal data and books they have borrowed via DocuMarc. We inform them of their username& password.

Right to Block Data:

Immediate upon request.

Right to Erase Data:

Immediate upon request.

Legal Basis:

Article 5(c ) of Regulation 45/2001 (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract)

Legal Instrument: Recipients:

The data are not disclosed outside the Documentation Centre.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

LIBRARY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 112 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-022

Organisational Entity:

GAERD

Processing Operations:

Loaning of original documents + 3 dimensional objects related to CTM & RCD applications from the Archives

Purposes:

Manage the asset of the documentation centre and control the circulation of original documents + 3 dimensional objects related to CTM & RCD applications.

Categories of Data:

Name; Department/Service; Office Nº, references of items borrowed, dates of loans, due dates.

Processor:

Staff of Archives

Retention Period: Data Subjects:

OHIM Staff member who work with the CTM or RCD file applications

Information to Data Subjects:

Yes

When and Data Subjects are informed:

In the Staff Notice Nº 322/00

Right to Block Data:

Immediate upon request.

Right to Erase Data:

Immediate upon request.

Legal Basis:

Article 5(c ) of Regulation 45/2001 (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract)

Legal Instrument: Recipients:

The data are not disclosed outside the Documentation Centre.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

LIBRARY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 113 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-023

Organisational Entity:

DD

Processing Operations:

Quality control of the RCD bulletin (Merged into DPN-2012-009)

Purposes:

The purpose of the processing is: - to monitor the quality of the publications on the bulletin and in detail the general error rate; - to monitor the error rate per examiner and to carry out actions to correct error’s causes; - to improve the quality standards.

Categories of Data:

- examiner’s username - number of designs assigned - number of designs checked - number of errors founded of the examiner - rate (%) of designs checked - rate (%) of error of the examiner - average of designs checked - average of error per examiner

Processor:

Director, Assistant to Director, Quality and risks Officer, Inspection Clerk, Examination coordinator, Chief designs examiners, all individual design examiners only with his personal references and the average of all references.

Retention Period: Data Subjects:

all designs examiners

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Since the beginning of the revision of the quality check of the bulletin, January 2007, they were informed in a Examiners meeting about the changes in the procedure. Every three month they are informed after release of the table, via Quality Officer and/or Chief examiners and they receive a copy of the paper with the personal statistics and the average of the Department.

Right to Block Data:

No time limit defined

Right to Erase Data:

No time limit defined

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

The processing is necessary for the performance of the tasks devolved to the Office pursuant to Articles 2, 35, 36, 37, 38, 39, 40, 45, 46, 47, 48, 49 and 50 of Community designs Regulation (62002), that is, the tasks to receive Community design applications, mark them and grant filing dates, examine the formal requirements for registration, examine the existence of grounds for non-registrability, register and publish Community designs. In particular the processing is necessary in order to improve the quality of the published bulletins, to reduce the error rate and anticipate changes in trends of these errors. Also the data serves in order to appraise the person according to Article 43 of Statute and corresponding provisions of the rules applicable to the other agents.

Recipients:

Director, Assistant to Director, Quality and risks Officer, Inspection Clerk, Examination coordinator, Chief designs examiners, all individual design examiners.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

QUALITY / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 114 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-025

Organisational Entity:

HRD

Processing Operations:

Residence permits - Transfer of personal data of Community Staff to Spanish Foreign Affairs Ministry

Purposes:

Allowing identification of the applicant for emission of the residence permit.

Categories of Data:

Name, working place (agency, county and city), gender, civil state, country of origin, date of birth, nationality, place of birth, maid name; Passport number, passport type, date of issue; Category and grade (for these two informations, MAE agrees OHIM provides Statutory link only), date of appointment, other lucrative activity in Spain and, if so, which one; Personal address, personal telephone number, previous residence in Spain (yes/no), date of arrival in Spain; Photos and signature. In some cases, same data for spouse and children have to appear in the form if a residence permit is requested for them.

Processor:

Spanish agents of MAE; HRD and concerned people in OHIM.

Retention Period:

MAE: unknown – OHIM: 4 years after leaving the Office.

Data Subjects:

Officials, temporary and contractual agents and family members.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The request form to be filled in by data subjects contains a data protection statement (see annex). The agents are informed by a certificate emitted by OHIM. The Office provides a copy of the note sent to MAE too.

Right to Block Data:

OHIM: The agents can block the proceeding: in this case the file is given back. MAE: according to Spanish legislation (LOPD 15/1999).

Right to Erase Data:

OHIM: Immediately and on request. MAE: according to Spanish legislation (LOPD 15/1999).

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

MAE and OHIM-HRD

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

RESIDENCE PERMITS / MEMBER STATES

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 115 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-026

Organisational Entity:

ITFMD

Processing Operations:

OLA’s feasability project

Purposes:

Establish OLAs (Operational Level Agreements with OHIM services) Improve process management within ITFMD

Categories of Data:

First name, last name, department, list of remedy assigned groups, questions related to the Ineed and/or Cases management experience (YES/NO type + free text).

Processor:

Service provider and data controller.

Retention Period:

Until the end of the study, estimated 31/05/2007. Afterwards, all data will be destroyed.

Data Subjects:

All Actors of Remedy processes

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Information through e-mail together with questionnaire or, in case of meeting, in the meeting itself.

Right to Block Data:

Immediate upon request.

Right to Erase Data:

Immediate upon request.

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

ITFMD Management.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 116 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-027

Organisational Entity:

ITFMD

Processing Operations:

Service Desk Quality Control

Purposes:

The purpose of this quality control will be to assess the compliance of the service provided with the corresponding SLA, and to further improve the quality of the service offered.

Categories of Data:

. Name and phone number of the user concerned; . Description of the request or problem treated; . Name of the Service Desk Team member who executed the service; . Satisfaction criteria (see grid in Annex 2).

Processor:

The Service Desk coordinator and the controller.

Retention Period:

1 year.

Data Subjects:

. The user concerned (both statutory and non statutory staff members); . The Service Desk Team Members (outsourced).

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A data protection notice will be published in OHIM’s intranet (see draft in Annex 3). When called back, a user will be briefly informed about data protection issues before being asked to participate to the quality control (see draft in Annex 4). Service Desk Team Members will be addressed a data protection statement by email on a yearly basis (see draft in Annex 5).

Right to Block Data:

Yes, immediate when justified

Right to Erase Data:

Yes, immediate when justified

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

Article 5(a): SLA as concerns Service Desk team members. Article 5(d): The participation of the user is free and voluntary. The user will be requested the consent before proceeding with the quality control exercise.

Recipients:

Data concerning the called back users are not disclosed. Only the Head of Service receives the individual assessments of the Service Desk members. Only aggregated figures are disclosed to the Director of Department and to the service provider.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

HELP DESK / QUALITY CONTROL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 117 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-028

Organisational Entity:

SC

Processing Operations:

Staff Committee’s Internal Call for Interests

Purposes:

Selection of staff representatives in committees.

Categories of Data:

Name, category of the staff member

Processor:

Members of the Staff Committee

Retention Period:

3 years

Data Subjects:

Members of staff, volunteers to be appointed in the committee corresponding to a specific call for interests.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The call for interest contains a specific data protection statement compliant with article 11 of Regulation 45/2001 (see sample in annex).

Right to Block Data:

Immediate upon request.

Right to Erase Data:

Immediate upon request.

Legal Basis:

Articles 5(a), 5(b) and 5(d) of Regulation 45/2001

Legal Instrument:

- Article 9 of the Staff Regulation as concern task carried out in the public interest (Article 5(a)) - Spanish legislation as concern legal obligation (Article 5(b)). Eg. Health and Safety at Work Committee

Recipients:

Personal data concerning appointed staff representatives may be disclosed to : . The respective committee . HRD . AASC (disciplinary boards)

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SELECTION / CALL FOR INTEREST

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 118 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-029

Organisational Entity:

GAERD

Processing Operations:

Database of the CTM Download Licensees and Database of the CTM Download users’ e-mails

Purposes:

1. List of the CTM Download licensees in order to contact them. 2. Systematic communication with IT Department and organised flow of the mails between OHIM and users.

Categories of Data:

1. Name of the organisation/company, postal address, contact person name, e-mail address of the organisation/company/contact person, phone number. 2. First name, last name, e-mail address.

Processor:

Members of Gaerd’s RUWP team in charge of the e-business.

Retention Period:

5 years (article 38§4 of OHIM Financial Regulation)

Data Subjects:

All users of the CTM Download Database

Information to Data Subjects:

NO

When and Data Subjects are informed: Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(c ) of Regulation 45/2001 (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract)

Legal Instrument: Recipients:

Members of Gaerd’s RUWP team in charge of the business/compliment cards, external provider, the data subject, financial actors in the validation of the order form.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

E-BUSINESS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 119 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-030

Organisational Entity:

GAERD

Processing Operations:

Distribution of Alicante News

Purposes:

Send newsletter to customers.

Categories of Data:

e-mail

Processor:

Staff in charge of the sending of newsletter.

Retention Period:

As long as the data subject is volunteer to receive the newsletter and does not request to be deleted from the distribution list.

Data Subjects:

Any person interested to receive OHIM’s newsletter and subscribing to it by sending a mail to *[email protected]

Information to Data Subjects:

NO

When and Data Subjects are informed:

People send e-mails to *[email protected] asking to be included in the distribution list

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

The data gathered are not disclosed.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

PUBLICATION / NEWSLETTER

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 120 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-031

Organisational Entity:

GAERD

Processing Operations:

Events of the Office

Purposes:

Information for customers in our web page

Categories of Data:

Name, surname in some cases position in the Office and/or background.

Processor:

Public information

Retention Period: Data Subjects:

Any person participating in events. Principally GAERD staff and directors of all departments

Information to Data Subjects:

NO

When and Data Subjects are informed: Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients: Transfer to Third Parties

YES

Security Measures:

NO

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PUBLICATION / EVENTS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 121 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-032

Organisational Entity:

GAERD

Processing Operations:

List of attendees to OHIM booth during Annual Meetings & trade fairs

Purposes:

Follow-up use of data for Alicante News subscriptions

Categories of Data:

name, email address

Processor:

Members of GAERD relation with users team in charge of the dossiers

Retention Period: Data Subjects: Information to Data Subjects: When and Data Subjects are informed: Right to Block Data: Right to Erase Data: Legal Basis:

Articles 5(c) and 5(d) of Regulation 45/2001

Legal Instrument: Recipients:

Members of Gaerd’s RUWP team associated with INTA organisation, private company offering mailing service

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

EVENTS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 122 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-033

Organisational Entity:

GAERD

Processing Operations:

INTA and other meetings invitations to Members

Purposes:

Pre and post INTA & other meetings contacts with users, National Offices, representatives.

Categories of Data:

First name, last name, postal address, email.

Processor:

Members of GAERD Relation with users team in charge of the INTA & other meetings dossiers and external provider.

Retention Period: Data Subjects: Information to Data Subjects: When and Data Subjects are informed: Right to Block Data: Right to Erase Data: Legal Basis:

Articles 5(c) and 5(d) of Regulation 45/2001

Legal Instrument: Recipients:

Members of Gaerd’s RUWP team associated with INTA organisation, private company offering mailing service

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

EVENTS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 123 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-034

Organisational Entity:

GAERD

Processing Operations:

OAMI Organigramme

Purposes: Categories of Data: Processor: Retention Period: Data Subjects: Information to Data Subjects: When and Data Subjects are informed: Right to Block Data: Right to Erase Data: Legal Basis: Legal Instrument: Recipients: Transfer to Third Parties Security Measures: EDPS Reference: Notification Status:

REGISTERED

Keywords Class: Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 124 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-035

Organisational Entity:

GAERD

Processing Operations:

External distribution of publications

Purposes:

Distribution of OHIM AR and other promotional publications.

Categories of Data:

First name, last name, organisation, function, phone, mobile, fax and email.

Processor:

Members of GAERD relation with users team in charge of the publications and external provider.

Retention Period: Data Subjects: Information to Data Subjects: When and Data Subjects are informed: Right to Block Data: Right to Erase Data: Legal Basis: Legal Instrument: Recipients: Transfer to Third Parties Security Measures: EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PUBLICATION

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 125 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-036

Organisational Entity:

GAERD

Processing Operations:

Statistics in relation to e-business

Purposes:

Presentation of statistics of in internal reporting and in external presentations

Categories of Data:

First name, last name, company name, number of CTM/RCD filed, % of e-filing, My Page users

Processor:

Members of Gaerd and external people when data is published.

Retention Period: Data Subjects:

Users of CTM/RCD systems

Information to Data Subjects:

NO

When and Data Subjects are informed: Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Members of office staff and external people receiving presentations

Transfer to Third Parties

YES

Security Measures: EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

E-BUSINESS / STATISTICS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 126 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-037

Organisational Entity:

GAERD

Processing Operations:

Alicante News Statistics - Owner & Representative ranking figures

Purposes:

Publication as articles in Alicante News

Categories of Data:

Company Name + nº of CTM & RCD filings.

Processor:

All GAERD

Retention Period: Data Subjects: Information to Data Subjects: When and Data Subjects are informed: Right to Block Data: Right to Erase Data: Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Alicante News subscribers (External e-mail distribution list)

Transfer to Third Parties

YES

Security Measures:

NO

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PUBLICATION / STATISTICS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 127 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-038

Organisational Entity:

GAERD

Processing Operations:

Mailing

Purposes:

Database of name and contact details of CTM/RCD users for marketing use (sending of information by e-mail, survey)

Categories of Data:

First name, last name, company name, number of CTM/RCD filed, address, phone number, fax number, e-mail address

Processor:

Members of Gaerd

Retention Period: Data Subjects:

Users of CTM/RCD systems contact details

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When collecting the data, phone calls, the e-mail addresses and names information was given that information relating to CTM/RCD and e-business will be sent to the contacts collected

Right to Block Data: Right to Erase Data: Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

GAERD staff, third parties in question

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

MAILING

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 128 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-042

Organisational Entity:

GAERD / ITFMD

Processing Operations:

Call Centre Technology

Purposes:

Continuous monitoring of incoming calls. Monitoring of volume of calls received. This monitoring helps at assessing and improving the quality of the service offered. The main objective is to ease the planning of activities and the coordination of workflow and teams. The individual statistics concerning statutory staff members (Information Centre) may be used as an objective input taken into account in the annual appraisal exercise. The individual statistics concerning non statutory staff members (Switchboard, Help Desk) are used to assess the compliance with Service Level Agreements concluded with respective providers (see annexes 4 and 5).

Categories of Data:

No special categories of data in the sense of article 10 of Regulation 45/2001 are processed in this context. Information Manager Module: . Staff member's name . Extension number (phone) . Real time situation showing the status of the servicing person, such as logged off, servicing, idle, …. . Status time (= how long the line has been in this status) . Service group (See samples in annex 1). Report Manager Module (generally for a range period: day, week, month, …): . Staff member's name . Reference period . Date and time of availability . Duration of activity per day . Number of calls received . Number of calls attended . Number of calls rejected . Number of calls abandoned . Average duration of servicing (see samples in annex 2) The Report Manager Module also provides group statistics (main purpose, see samples in annex 3).

Processor:

Respective group coordinators

Retention Period:

. Data in Solidus eCare’s built-in database are kept for 1 year . Individual statistics related to statutory staff members: 1 year . Individual statistics related to non statutory staff members: 5 (+2) years in accordance with article 38§6 of OHIM’s Financial Regulation (annex 8) . Group statistics (non personal data): 3 years

Data Subjects:

Staff dedicated to call centres (Switchboard, Information Centre, Help Desk)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects are addressed a data protection statement compliant with article 12 of Regulation 45/2001, once a year (see annex 6).

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

. Article 43 of the Staff Regulations . Decision ADM-00-37 dated 09/07/2001 on the adoption of a Code of Good Administration Behaviour (see annex 7) . Service Level Agreement concluded with the external providers (see annexes 4 and 5)

Recipients:

. Respective group coordinators . Respective authorising officers . Respective line directors of departments, deputy director and/or head of service

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2007-0583

Notification Status:

REGISTERED

Keywords Class:

E-MONITORING

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 129 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 130 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-043

Organisational Entity:

HRD

Processing Operations:

Early retirement without reduction of pension rights

Purposes:

The purpose of the above processing operations of personal data is the implementation of OHIM's administrative decision ADM-07-21 aiming at granting early retirement without reduction of pension rights.

Categories of Data:

Data are collected by means of a standard application form specifically designed for the purpose of this procedure (annex 3). Data collected are: - Personal number; - Identity of the applicant (name, birthdate, email); - Affectation (department, service, …); - Administrative position; - Career within OHIM and EU institutions; - Other rights already granted; - Motivation; - Information as concern the transfer of pension rights; - Date and signature. Data published are: - Personal number; - First name; - Surname.

Processor:

HUMAN RESOURCES DEPARTMENT STAFF DEALING WITH EARLY RETIREMENT FILES

Retention Period:

3 YEARS

Data Subjects:

OFFICIALS/TEMPORARY AGENTS CANDIDATES TO EARLY RETIREMENT

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The call for applications (annex 2) contains specific provisions as concerns data protection, in compliance with article 11 of Regulation 45/200. It draws the candidate's attention of eventual impact that the exercise of such rights may bear on the eligibility of their application.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

ARTICLE 9,§ 2 OF ANNEX VIII OF STAFF REGULATIONS, ARTICLE 39 OF R.A.A.A. AND DEC-ADM-07-21

Recipients:

DIRECTION COMMITTEE, JOINT COMMITTEE, EUROPEAN COMMISSION (SELECTED CANDIDATES)

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2007-0575

Notification Status:

ARCHIVED

Keywords Class:

SELECTION / EARLY RETIREMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 131 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-046

Organisational Entity:

BOA

Processing Operations:

Goods and Services Database

Purposes:

Ensure the update of the G&S database.

Categories of Data:

Staff name, date and type of entry made in the database, issues encountered in control.

Processor:

DASS staff who contribute to the G&S database (except for issues encountered in controls). One selected staff member has access to issues encountered in controls.

Retention Period:

2 years

Data Subjects:

DASS staff who contribute to the G&S database.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By head of service when control system was created.

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Tracking: DASS staff Post-Control: Head of Service on a no name basis

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 132 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-047

Organisational Entity:

BOA

Processing Operations:

CFI/ECJ Info Service, Informing about CFI and ECJ judgments

Purposes:

Tracking of procedures and assigning Info Service tasks to DASS staff.

Categories of Data:

The assignment table contains a calendar with the names of the DASS staff member responsible in a given week. The tracking table contains the names of staff members carrying out the tasks of the Info Service, the date and judgement covered and information relating to the judgement(E.g. was it appealed, etc.)

Processor:

DASS staff members.

Retention Period:

Calendar sheet: 1 year. Tracking table: 5 years.

Data Subjects:

DASS staff contributing to the Info Service.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By the Head of Service when the Info Service was created.

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

DASS Staff

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 133 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-048

Organisational Entity:

HRD

Processing Operations:

Training Survey

Purposes:

Define the training needs and training catalogue for next year.

Categories of Data:

The survey is not intended to process personal data. Nevertheless, it cannot be excluded that the combination of some replies may indicentally permit the identification of a person.

Processor:

IT coordinator in HRD, Training sector coordinator and team members.

Retention Period:

Data will be deleted once the purposes of the survey are fulfilled (estimated 6 months maximum).

Data Subjects:

All OHIM staffs.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The websurveyor form includes a data protection statement compliant with article 11 of Regulation 45/2001. Participation to the survey is free and voluntary.

Right to Block Data:

Yes, where possible.

Right to Erase Data:

Yes, where possible.

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

Participation to the survey is free and voluntary. The survey is a necessary step towards an appropriate definition of the training needs of the OHIM staff and is therefore considered as a tasks performed in the interest of the service, notably in the context of article 24bis of the Staff Regulations.

Recipients:

Data gathered from the survey form are not disclosed. Only aggregated conclusions may be disclosed the OHIM management.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY / TRAINING

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 134 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-049

Organisational Entity:

HRD

Processing Operations:

Reimbursement of language stays expenses

Purposes:

The purpose of the processing is to grant reimbursements of language stays expenses in accordance with OHIM’s administrative decision ADM-05-12.

Categories of Data:

- Applicant’s identification (staff number, surname and first name); - Family’s income: officials salary slips, partner’s salary slip or unemployment certificate, allowances; - Bank account details; - Composition of family (number of dependent children); - Name and birth date of the children who participates in the language stay; - Description of the program of the language stay

Processor:

HRD-Social Policy Secretariat has access to the whole documentation

Retention Period:

Refused applications are kept for a period of 4 months for eventual appeal purposes. Approved applications are kept for a period of 5+2 years in accordance with article 38§6 of OHIM’s Financial Regulation. They are stored in a locked cupboard accessible only by HRDSocial Policy Secretariat for a period of 3 years and then transferred in OHIM’s archives for a period of 4 years (5+2 = 3 + 4).

Data Subjects:

Statutory staff members (applicants)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A data protection notice is published in OHIM’s intranet together with all the documentation related to this activity (see annex 6). A reference to this data protection notice is made on the application form.

Right to Block Data:

Immediate where justified.

Right to Erase Data:

Immediate where justified.

Legal Basis:

Article 5(a) of Regulation 45/2001

Legal Instrument:

Administrative Decision ADM-05-12

Recipients:

Financial Department: staff member’s name, personal number, bank account details and amount to be paid (see annex 4).

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SOCIAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 135 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-050

Organisational Entity:

HRD

Processing Operations:

After School Nursery

Purposes:

Deduction of after school nursery costs from the officials’ monthly salary.

Categories of Data:

- Name of the official; - Staff number of the official; - Family’s income: officials salary slips, partner salary slips and/or unemployment certificate, allowances; - Composition of family (number of dependent children); - Name of the child enrolled in the After School Nursery; - Modality of the enrollment (full time / part time); - Monthly list of attendance sent by school.

Processor:

HRD-Social Policy Secretariat: whole documentation

Retention Period:

The data are kept for a period of 5+2 years in accordance with article 38§6 of OHIM’s Financial Regulation. They are stored in a locked cupboard accessible only by HRD-Social Policy Secretariat for a period of 3 years and then transferred in OHIM’s archives for a period of 4 years (5+2 = 3 + 4).

Data Subjects:

Statutory staff members. Partners of such statutory staff members (where applicable). Child(ren) of such statutory staff members.

Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data:

Immediate where justified.

Right to Erase Data:

Immediate where justified.

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

HRD’s Personnel and Administration Sector. OHIM’s Financial Department. PMO.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SOCIAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 136 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-051

Organisational Entity:

BITD

Processing Operations:

Incidents and Change Requests Management

Purposes:

The first purpose is to provide OHIM’s users with user friendly tool and procedure to request any items or services needed to ensure the daily and efficient functioning of OHIM and its services. Since part of the incidents and change requests management is outsourced and entrusted to external providers, this tool (and in particular its workflow mechanism) also permits to measure the compliance of the performance of the contractor with the provisions of the Service Level Agreement concluded with OHIM. See SLA in annex 5

Categories of Data:

Internal users (Staff) - login* - first name, last name* - department, service* - administrative address* - phone extension* - mobile phone* - email* - list of user’s IT inventory** * data extracted from SAP-HR on a daily basis ** data extracted from SAP-MM on a daily basis External users (Customer): first name, last name, company, address, phone number, email. All users - incident/change requests description with: . product identification (including category, type, item) . user’s comments . additional attachment . scheduling (priority, expected date) See the catalog of product in annex 2. Some products may refer to a need linked to the health of the user. Authorizers - login - comments related to intervention (free text) - date and time of the comments

Processor: Retention Period:

2 years from the closing of the incidents or resolution of the change request.

Data Subjects:

All OHIM users, including: - Staff (statutory or not) - Customers (E.g. e-business users) Authorizers (which may be individuals or group functions)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A data protection statement is included in the conditions of use of the Remedy software, accessible from the main screen of Remedy. External users are sent an email confirming that their incident and//or change request is taken into account. This mail contains a data protection statement.

Right to Block Data:

Yes, immediate on request

Right to Erase Data:

Yes, immediate on request

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

All actors involved in the validation and management of incidents and/or change requests - ITFMD’s Service Desk - Authorizers (see annex 3)

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

HELP DESK / STATISTICS / QUALITY CONTROL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 137 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2007-052

Organisational Entity:

HRD

Processing Operations:

Publication of list of EPIS with photo

Purposes:

FACILITATE STAFF AND PUBLIC (VISITORS) INFORMATION ABOUT THEIR EPIS

Categories of Data:

PHOTOS, NAMES, OFFICE NUMBER, OFFICE TELEPHONE NUMBER

Processor:

Members of HRD’s Occupational Risk Prevention Sector, EPIS

Retention Period:

Posters are updated any time a new EPI is appointed or anytime an EPI’s data change (E.g. change of office) and anytime an EPI dismisses or is dismissed from this duty.

Data Subjects:

MEMBERS OF EPI TEAM (Statutory staff members)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

LAST YEAR BEFORE PUBLICATION OF POSTERS IN THE BUILDINGS

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Articles 5(a), 5(b) and 5(d) of Regulation 45/2001

Legal Instrument:

OHIM’s risk prevention policy, notably pursuant to the European Directive 89/391, its transposition into the Spanish law (ley 31/95 de prevención de riesgos laborales) and the OHSAS 18001 standard

Recipients:

The data are disclosed next to all lift accesses in OHIM’s premises. It is intended for all occupants of these buildings (Staff and visitors).

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

OCCUPATIONAL RISK PREVENTION

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 138 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2008-001

Organisational Entity:

BOA

Processing Operations:

Tasks statistics (BoA Registry)

Purposes:

Gather suggestions for the purpose of continuous improvement of the quality of OHIM services and processing.

Categories of Data:

Number and kind of tasks pending and done per module and every co-worker of Registry

Processor:

Registrar, IT coordinator

Retention Period: Data Subjects: Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Decision no ADM-02-35 of 30 October 2002

Recipients: Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 139 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2008-002

Organisational Entity:

HRD

Processing Operations:

Survey for the management of the Gymnasium

Purposes:

Ensure the organization of the gymnasium in accordance with the users' preferences.

Categories of Data:

First name, last name, email, preferences

Processor:

Staff of the social sector only.

Retention Period:

1 months after the closing of the survey.

Data Subjects:

Potential users of the gymnasium (OHIM staff).

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A data protection statement is attached to the survey.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

External provider

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

SOCIAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 140 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2008-003

Organisational Entity:

QMD

Processing Operations:

Improvement Idea Form

Purposes:

Gather suggestions for the purpose of continuous improvement of the quality of OHIM services and processing.

Categories of Data:

Name of contributors

Processor:

QMD staff in charge of the Quality Management System and/or Change Management Process. OHIM's Quality officers.

Retention Period:

Contributions are stored for a maximum period of one year to be counted as from the final outcome of the case.

Data Subjects:

OHIM staff and/or OHIM users likely to submit any improvement ideas.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The template used to collect Improvement Ideas contains a data protection statement compliant with article 11 of Regulation 45/2001.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument: Recipients:

QMD, Quality Officers, Process owners and/or Directors

Transfer to Third Parties

NO

Security Measures:

NO

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

QUALITY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 141 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2008-004

Organisational Entity:

General Assembly of the Staff

Processing Operations:

Rules concerning Elections and Appointment to the Staff Committee

Purposes: Categories of Data: Processor:

The Electoral Office

Retention Period: Data Subjects: Information to Data Subjects: When and Data Subjects are informed: Right to Block Data: Right to Erase Data: Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument:

Aticle 9 of the Staff Regulations. Article 1 of Annex II to the Staff Regulations. Article 7 of the Conditions of Employment of Other Servants. Rules concerning Elections and Appointment to the Staff Committee of OHM adopted by the General Assembly of the Staff on xx/11/2007.

Recipients: Transfer to Third Parties

NO

Security Measures: EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

STAFF COMMITTEE / ELECTIONS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 142 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2008-005

Organisational Entity:

HRD

Processing Operations:

Internal mobility

Purposes:

Internal mobility in the OHIM as described in the mobility guidelines: Http://oaminet/oaminet/drvisapi.dll?Mival=cw_usr_index&ID=56152&LANG=en

Categories of Data:

Full name, staff number, function group and grade, status, job title, job description (tasks and competencies) and any other relevant detail that the candidate wishes to add to the application.

Processor: Retention Period: Data Subjects:

The officials and temporary agents of the Office who apply for a vacant post.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

In the e-mail acknowledgement of receipt of the application sent to the applicant by the Career and Development Sector. In this e-mail a paragraph regarding the protection of personal data is included

Right to Block Data: Right to Erase Data:

On written request to the controller, the data subject shall have the right to obtain from the controller the erasure of the personal data used during the procedure under the conditions laid down in the Regulation. Should an applicant request the erasure of his/her personal data needed for the course of the mobility procedure, the Controller would immediately inform him/her about any eventual impact such request may have on the procedure.

Legal Basis:

a) For temporary staff members: Article 7 of the CEOS b) For permanent staff members: Article 29 §1a)i) of the Staff Regulations

Legal Instrument: Recipients:

Data will only be disclosed to: a) Candidatures: • the Director or line manager to whom the vacant post is assigned. • Staff members to whom the Director or line manager delegates • the members of the Human Resources Department in charge of internal mobility • The staff member in whom the Staff Committee delegates for the specific selection procedures. b) Data related to new assignment (date, job title, department, personal number): • the members of the Human Resources Department in charge of the personal files (only for the filing of definitive documents).

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

EDPS-2008-426

Notification Status:

REGISTERED

Keywords Class:

STAFF MANAGEMENT

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 143 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2008-006

Organisational Entity:

HRD

Processing Operations:

Probationary period Report

Purposes:

See above

Categories of Data:

Full name, staff number, function group and grade, status, job title, job description (tasks and competencies) and any other relevant detail that the candidate wishes to add to the application.

Processor:

HR Staff members concerned

Retention Period:

As for the original report in paper format stored in the personal folder, no time limits until transfer to another institution, permanent leave or retirement. As for the word document (report) used for the drafting of the individual reports (stored provisionnally on the individual PCs of the reporting officers for drafting purposes), the time limit for storage is the moment when the report is deemed final, i.e. when the reports have been signed by all parties and no conflict has arisen on the basis of that report. This document is then erased by the reporting officer from his/her computer.

Data Subjects:

The officials, temporary agents and contract agents newly recruited and newly appointed heads of service.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Requirements of Articles 11 and 12 of Regulation 45/2001are met in the probationary period appraisal form

Right to Block Data:

On written request to the controller, the data subject shall have the right to obtain from the controller the blocking of data under the conditions laid down in the Regulation.

Right to Erase Data:

On written request to the controller, the data subject shall have the right to obtain from the controller the erasure of the personal data used during the procedure under the conditions laid down in the Regulation.

Legal Basis:

Articles 34 and 44 of the Staff Regulations and Articles 14 and 84 of the CEOS.

Legal Instrument: Recipients:

- the probationer appraised - the reporting officer who is in charge of drafting the probationary period report - the countersigning officer / director of department who must decide on the result of the probationary period - the members of Human Resources Department in charge of the probationary period reports, the personal folders, issuing decisions to be submitted to the Appointing Authority in relation to probationary period reports, and dealing with payroll and individual rights.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

EDPS-2008-432

Notification Status:

REGISTERED

Keywords Class:

APPRAISAL

Compliance with R45/2001:

Yes

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 144 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2008-007

Organisational Entity:

HRD

Processing Operations:

Establishment of annual appraisal reports (Updated by DPN-2015-001)

Purposes:

Establishment of annual appraisal reports

Categories of Data:

Full name, grade, administrative address, staff number, status, seniority in grade, starting date in job, department and budgetary post number, job title and overall purpose, data of previous job assignments (department, service, sector, period concerned) and the names and job titles of the current and the past reporting officer, if any. The reporting officer introduces an overall assessment comment dealing with appraisal of: efficiency, ability and conduct in the service. The reporting officer, the countersigning officer and the jobholder may add comments on the report.

Processor: Retention Period:

The final physical paper reports will be filed temporarily, until the end of the appraisal exercise, in the HRD-Career and Development cupboard, at which moment they will be filed definitively in the personal files of the jobholders. No time limits are considered for these documents as they are a part of the personal file existing in the Office until transfer to another institution, permanent leave or retirement. The electronic word files used for the drafting of the individual reports (stored on the individual PCs of the reporting officers until de reports are deemed final) are erased by the reporting officers. The data included on the appraisal tool (access) for the generation of reports are used for the update of the following year’s appraisal exercise.

Data Subjects:

The officials and temporary agents of the Office except grades A*16 and A*15 and chairpersons and members of the Boards of Appeal.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Requierments of Article 11 and 12 of R 45/2001 are met in : Administrative decision ADM 04-18 Rev. gives all the relevant information to the data subjects regarding the procedure. Appraisal form

Right to Block Data:

on written request to the controller, the data subject shall have the right to obtain from the controller the blocking of data under the conditions laid down in the Regulation. Should an applicant request the blocking of his/her personal data needed for the course of the attestation procedure, the Controller would immediately inform him/her about any eventual impact such request may have on the individual procedure.

Right to Erase Data:

upon written request to the controller, the data subject shall have the right to obtain from the controller the erasure of the personal data used during the procedure under the conditions laid down in the Regulation. Should an applicant request the erasure of his/her personal data needed for the course of the attestation procedure, the Controller would immediately inform him/her about any possible impact such request may have on the individual procedure.

Legal Basis:

Article 43 of the Staff Regulations

Legal Instrument: Recipients:

Data will only be disclosed to: - the member of staff appraised - the reporting officer who is in charge of drafting the appraisal report - future line managers of the staff appraised - the countersigning officer who is in charge of validating the report - the members of Human Resources Department in charge of the appraisal system - the members of the Management Committee for harmonisation purposes - the members of the Joint Evaluation and Promotion Committee, only in case of an appeal on the appraisal report. - the case arising, internal selection committees (if announced in the selection notice)

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

EDPS-2008-415

Notification Status:

ARCHIVED

Keywords Class:

APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 145 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2008-008

Organisational Entity:

HRD

Processing Operations:

Organisation of training activities for staff members

Purposes:

Organisation of training activities for staff members in order to ensure their development. The data integrated in the Training Management System (TMS) will be used: • In a compiled anonymous manner (not identifying data subjects): - Collecting information for statistics on global training days and average training days per person - Monitoring the training objectives of the Office - Ensure a follow-up on the trainings attended by the members of staff - Preparing the future training catalogue / activities • For the service of the stakeholders: - Issuing of training certificates on request by the member of staff concerned (for data subjects) - Generation of the list of training events attended during the appraisal period for the annual appraisal exercise (data subjects are informed at the beginning of the appraisal exercise) For the service of the stakeholders:  issuing of training certificates on request by the member of staff concerned (for data subjects)  generation of the list of training events attended during the appraisal period for the annual appraisal exercise (data subjects are informed at the beginning of the appraisal exercise)

Categories of Data:

 In relation to the participant in the course: Full name, grade, administrative address, staff number, status, department, internal telephone number, e-mail address, mother tongue, administrative address, inscription days of the current year.  In relation to the course: Title and description of the course, type of the course, attendance to course (attendance completed, abandoned, pending, waiting list…), number of hours, dates, level of the course, language of the course.  Other data that the data subject declares on a voluntary basis: The comments that the participant may add to the evaluation sheet of the course (this may be anonymous information as identification is not requested).

Processor:

The members of staff in Career and Development Sector dealing with training and the IT business support of the HRD.

Retention Period:

No time limits are considered for these documents as they are a part of the personal competency profile in order to ensure further development of skills and knowledge, until transfer to another institution, permanent leave or retirement.The data included on the appraisal tool (access) for the generation of reports are used for the update of the following year’s appraisal exercise.

Data Subjects:

The officials, temporary agents, trainees, contract agents and auxiliaries of the Office who follow training provided by the Human Resources Department or external training. In certain cases temping staff (whenever the director of department so requires it) and spouses to members of staff may also follow Spanish courses organised by the Office.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

After applying for the course, with the confirmation by the training organiser from the Career and Development Sector by means of an e-mail.

Right to Block Data:

Yes. On written request to the controller, the data subject shall have the right to obtain from the controller the blocking of data under the conditions laid down in the Regulation. Should an applicant request the blocking of his/her personal data needed for the course of the attestation procedure, the Controller would immediately inform him/her about any eventual impact such request may have on the individual procedure.

Right to Erase Data:

Yes. On written request to the controller, the data subject shall have the right to obtain from the controller the erasure of the personal data used during the procedure under the conditions laid down in the Regulation. Should an applicant request the erasure of his/her personal data needed for the course of the attestation procedure, the Controller would immediately inform him/her about any eventual impact such request may have on the individual procedure.

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

- Article 24a of the Staff Regulations - Article 45 of the Staff Regulations (appropriate training for ensuring acquisition of third language before promotion).

Recipients:

Personal data will only be disclosed to: - The members of the Human Resources Department in charge of training. - Individually to the members of staff who ask for a list of their training courses or a training certificate. - The reporting and countersigning officers within the context of the annual appraisal exercise. - The trainer (restricted to a list of participants per course with full name).

Transfer to Third Parties

NO

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 146 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

TRAINING

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 147 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2008-009

Organisational Entity:

TMCD / TMRD

Processing Operations:

Quality Management System - Ex ante quality checks

Purposes:

The processing operations consist in checking quality of decisions made by examiners in the examination of absolute grounds (objection letters and final refusals) and in the opposition proceedings (decisions) before they are notified to the parties of the procedure. Absolute grounds Final drafts of all objection letters and decisions will be passed by the examiner to the Legal Advisors and especially nominated examiners of his service for a 100 % ex ante check to evaluate the quality of the decision and examination and retrieve information on the categories of errors and mistakes on the basis of the quality criteria which have been published internally and externally (see http://oami.europa.eu/ows/rw/pages/QPLUS/serviceCharter/serviceCharter.en.do). Opposition decisions Opposition decisions are drafted by one examiner and co-signed by two other examiners (Article 127(2) CTMR), the third signer being the one who is responsible for carrying out ex ante checks (HoS, Legal Advisors and especially nominated examiners). Quality of the decision is evaluated and information retrieved on the categories of errors and mistakes. The main aim of this activity is to improve the global quality of the outputs of the Office in relation to the Office’s service standards and to collect information on areas were improvement / special measures are needed. This procedure complements the ex post checks which the TMDs perform since February 2007. As – related to the performance of individuals – necessary measures to improve quality/error rates will be taken, for the ex ante checks evaluation of individuals is part of the objectives of quality checks. Examiners will be informed by the persons performing the check about the errors found to prevent repetition of errors. As the examiners name is recorded this direct identification of the data subject will lead to processing of personal data. Legal advisors and HoS may use the findings when drafting appraisal reports. Information collected will be taken into consideration as one of several elements in the evaluation exercise.

Categories of Data:

Direct personal data pointing to quality of individual’s work. In both cases, absolute grounds and opposition decisions, the findings will be introduced into a database (MS Access Database – Quality Check Tool). The data will contain basic information about all the trade mark applications and oppositions which were checked in the given week, such as the name of the examiner, file number, CTM Name, opposition number, date of entering final status, errors made etc.

Processor:

Directors of TMCD and TMRD, Legal Advisors and 1 Senior Examiner, Classification Experts, Heads of Services, Quality Officers, Quality Check Administrator.

Retention Period:

Information will be kept for a period of 15 months in the MS Access Database – Quality Check Tool. After this period the data will be deleted from the system.

Data Subjects:

Examiners (of CTMA or opposition files)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Examiners will be informed about the way quality is going to be assessed, how the data is going to be used and where it is going to be stored. This information will be communicated by Heads of Services as well as by Directors in the form of an official communication.

Right to Block Data:

Not applicable once data subjects are not identifiable anymore beyond the retention period.

Right to Erase Data:

Automatic procedure agreed with IT Department within 15 months

Legal Basis:

Article 5(a) of Regulation 45/2001 (Processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties)

Legal Instrument: Recipients:

Directors of TMRD and TMCD. Heads of Services of TMRS and TMCD. Head of QMD Service 1 and QMS Project Team.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2008-437

Notification Status:

ARCHIVED

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 148 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Keywords Class:

CTM / QUALITY MANAGEMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 149 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2009-001

Organisational Entity:

HRD

Processing Operations:

Employee Opinion Survey

Purposes:

To carry out a survey among OHIM statutory staff. The assistance of an external consultancy firm expert in employee opinion survey is envisaged.

Categories of Data:

Name and surname, e-mail address, department (as declared by statutory staff member), statutory link (as declared by statutory staff member), gender (as declared by statutory staff member).

Processor:

External consultant: only of anonymous results (not linked to the individual). No personal data can be accessed.

Retention Period:

No personal data are stored.

Data Subjects:

OHIM statutory staff active at the moment of the survey.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Treatment of data: anonymity ensured due to the breaking of the link with the data origin at the point of submission of the filled-in questionnaire. Before the launching of the survey and in the e-mail providing the link to the questionnaire and the individual password.

Right to Block Data:

see above

Right to Erase Data:

see above

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument:

Additional information: Participation is striictly on a voluntary basis

Recipients:

External consultant: only of anonymous results (not linked to the individual). No personal data can be accessed. OHIM: all staff: only of anonymous results(not linked to the individual). No personal data can be accessed.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 150 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2009-002

Organisational Entity:

IAERD

Processing Operations:

Customer Relationship Management System (CRM)

Purposes:

With a view to improving the efficiency and quality of the information services rendered to OHIM users, the CRM system shall : -Store and keep up to date OHIM users' personal data -Store and keep up to date users’ interactions with OHIM: -a copy of their files (CTM, RCD, Oppositions, Appeals, Cancellations, Invalidity, recordals) -master data of users’ queries to the OHIM (phone calls, e-mails, complaints, e-business problems) -master data of users’ participation to events (seminars, conferences, fairs, workshops and other marketing campaigns such as specific surveys)

Categories of Data:

Personal data of users (First Name, Last name, company name, phone number, e-mail, address) Files information copied from OHIM back office systems (ID Numbers, languages, status of the file, examiners in charge of the file) Information Interaction Data (type of interaction (calls, e-mail, complaints), data and hour, number, categorization, solutions) Participation of events (event name, event organizer, event date)

Processor:

Staff of IAERD from Information Centre, Switchboard, External Relations Team, Complaints Unit, IT Help Desk

Retention Period:

Until the Data Subject maintains Trade Marks and Designs register at the OHIM

Data Subjects:

Individuals and companies (OHIM users and potential users contacting the OHIM).

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects are advised by a disclaimer on the web page and "autosignatures" of e-mail sent by Information Centre, Complaints Unit and E-Business IT Help Desk and generally speaking but all e-mails generated by CRM system

Right to Block Data:

on request per email

Right to Erase Data:

on request per email

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties establishing the European Communities or other legal instruments adopted on the basis thereof […]”)

Legal Instrument:

Regulation 40/94 Community Trade Mark regulation and Regulation 6/2002 on Community designs

Recipients:

Information Centre, Switchboard, External Relations Team, Complaints Unit, IT Help Desk, managers of the OHIM

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

COMPLAINT / CUSTOMER CARE

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 151 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2009-003

Organisational Entity:

DIPP

Processing Operations:

Questionnaire to those involved in quality control

Categories of Data:

Replies to the Annex

Processor: Data Subjects: Information to Data Subjects:

NO

Legal Basis:

Article 5(b) of Regulation 45/2001 (“processing is necessary to compliance with a legal obligation to which the controller is suject”)

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

QUALITY CONTROL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 152 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2009-005

Organisational Entity:

TMD

Processing Operations:

TMD Production Statistics (Replaced by DPN-2013-003)

Purposes:

Manage the production of the department in the framework of the implementation of the Council Regulation 207/2009 on the Community trade mark. Manage and balance the workload of the services. Analyse the production in order to raise eventual organisational issues. Identify individual training needs in order to comply with the production objectives set up by the Office. The individual statistics will also be used as objective input in the framework of the annual appraisal exercise of the respective staff.

Categories of Data:

Name and per name: Period of reference (starting date, ending date) or date (as at.dd/mm/yy) Type or name of tasks Number of task in different status (pending, completed, allocated, etc.), results (OK, not OK, etc) etc, as contained in OHIM’s CTM workflow tool (EM++) Number of letters produced by type of letter Number of decisions produced by type of decision Timeliness by task/milestone Age of pending tasks/files

Processor:

TMD director and head of services TMD Quality Officers IT Production Service for eventual maintenance purposes TMD workflow allocation managers and TMD data responsibles PMU team in QMD IT responsible of the Data Warehouse will have access to the data of all TMD examiners In a second step, each examiner will have access to his/her own data

Retention Period:

The data stays available in Euromarc. For the statistical and analysis purposes, it is stored for an unlimited period. For the appraisal purpose, queries aiming at individual statistics shall not go beyond the appraisal reference period unless there is a need to connect different appraisal periods in agreement with the data subject.

Data Subjects:

All the staff working in TMD

Information to Data Subjects:

Yes

When and Data Subjects are informed:

An updated note was prepared in coordination with the DPO and communicated to the data subjects

Right to Block Data:

No time limit decided

Right to Erase Data:

No time limit decided

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties establishing the European Communities or other legal instruments adopted on the basis thereof […]”)

Legal Instrument:

- Council Regulation 207/2009 on the Community trade mark - Article 43 of the Staff Regulations

Recipients:

TMD director and head of service. TMD Quality Officers, Workflow allocation managers, TMD Staff IT Production Service for eventual maintenance purposes.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

STATISTICS / APPRAISAL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 153 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2009-006

Organisational Entity:

QMD / ITD

Processing Operations:

Usage of user names and emails into Clarity

Purposes:

To be used as “users” and as a “resources” in the Portfolio Project Management Tool Clarity

Categories of Data:

Name, Surname, User name, email address, Department, Type of contract

Processor:

The Project Management Office, The Management, The Tool Administrator

Retention Period:

One year contract (extended on yearly basis)

Data Subjects:

All the Portfolio & Project Management Tool Clarity Users or resources (Quality Officers, Managmenet, users form QMD and IT)

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By means of a data protection statement sent to users since their personal data are loaded into the application

Right to Block Data:

Upon written request to the line manager

Right to Erase Data:

Upon written request to the line manager

Legal Basis:

Articles 5(e) of Regulation 45/2001

Legal Instrument: Recipients:

The Project Management Office, The Management, The Tool Administrator

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

USER NAMES / EMAIL / SECURITY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 154 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2009-007

Organisational Entity:

IAERD

Processing Operations:

Photographs for Web site

Purposes:

Promotion of the Web site

Categories of Data:

Images

Processor:

Public

Retention Period:

2 years

Data Subjects:

People working in OHIM building on November 2009

Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data:

Yes

Right to Erase Data:

No

Legal Basis:

Article 5(d) of Regulation 45/2001 (The data subject has unambiguously given his or her consent)

Legal Instrument: Recipients:

Public

Transfer to Third Parties

NO

Security Measures:

NO

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PHOTOGRAPHS / INTERNET

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 155 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2009-009

Organisational Entity:

QMD

Processing Operations:

Empirical analysis of correlations between work system variables and decision making

Purposes:

Various work system variables are suspected to have an impact on the decision making process, which is the central core business process of OHIM (and, for that matter, of many other organisations). In order to scientifically evaluate these variables (classified as being related to a person/individual, file, process or environment), a broad set of very personal information has to be polled (with the possibility to opt-out in each question). The purpose is not to draw any conclusions on the individual level, but rather to conclude on the general influence of these variables on decision making in general.

Categories of Data:

The processing works with a quite large number of data, up to 45 different variables sub divided into 4 categories: - Individual variables - Environmental variables - File variables - Process variables

Processor:

Only the Data Controller has full access to the data in its identifiable form. No disclosure of personal data to anyone else.

Retention Period:

One year with regard to the individual data. In anonymised form, the data should ideally be publicly available to the scientific community for an unlimited period of time.

Data Subjects:

Contract agents recruited for the Opposition decision making process exercise

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Informed upon recruitment of the twofold approach followed in the Opposition decision making process exercise (operational and experimental). Additionally, data subjects will receive a detailed presentation and a written summary of the exercise upon arrival. Futhermore, each questionnaire will contain an introductory part elaborating details abot the purpose and the possibility to opt-out.

Right to Block Data:

Immediate on request to the Data Controller

Right to Erase Data:

Immediate, by notifying the Data Controller

Legal Basis:

- Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”) - Article 5(d) of Regulation 45/2001 (“the data subject has unambiguously given his or her consent”)

Legal Instrument: Recipients:

- Only the Data Controller has full access to the data in its identifiable form. No disclosure of personal data to anyone else. - Non-identifiable data may be disclosed or distributed to the scientific community for statistical purposes. - Test results are reported back to each respondent.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2010-0468

Notification Status:

REGISTERED

Keywords Class:

STATISTICS / APPRAISAL / WORK ASSIGNMENT / QUALITY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 156 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2009-010

Organisational Entity:

HRD

Processing Operations:

Management of personal data of staff on general HR database (Updated by DPN-2014-010)

Categories of Data:

See table in Annex 1 for detail. Categories of data: Basic identification data - Communication in the Office - Addresses (private) - Relatives - Bank information - Place of origin - Employee type / administrative career - Working conditions Working time - Seniorities - Contract - Salary - Allowances, expenses and reimbursements Travel expenses entry / termination of service - Dependent child allowance - Education allowance - Annual travel expenses - Organisation chart / post - Absences - Languages Appraisals - Promotions / regradings - Professional experience - Diplomas and certificates Training - Documents

Processor:

Members of staff in the Human Resources Department for management of the data for processing purposes, for the procedures of which they are in charge. Access may be allowed on a temporary and restricted basis to IT-technicians for customization, development, updating, technical tests, repair, support and improvement of the data base.

Data Subjects:

All staff working for or in OHIM, and the relatives from which relationship rights may derive. This includes: Statutory staff member: bound by the rules and procedures laid down by the Staff Regulations of Officials of the European Communities and the Conditions for Employment of Other Servants of the European Communities. (temporary agents, official, contract agent, auxiliary, special adviser), and, wherever relevant for the processing of individual rights, data related to relatives of said staff member. Non statutory personnel: Seconded National Expert, trainees, agency staff (“intérimaires”), and External Consultants. Data categories will only be filled in when relevant for staff member.

Information to Data Subjects:

Yes

Legal Basis:

- Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties establishing the EC or other legal instruments […]”). - Article 5(b) of Regulation 45/2001 (“processing is necessary for compliance with a legal obligation to which the controller is subject”) - Non statutory staff. - Article 5(c) of Regulation 45/2001 (“processing is necessary for the performance of a contract to which the data subject is party […]”). - Article 5(d) of Regulation 45/2001 (“the data subject has unambiguously given his or her consent”) - Photo in staff directory. - Article 5(e) of Regulation 45/2001 (“processing is necessary in order to protect the vital interests of the data subject”) - Emergency addresses, contact persons details.

EDPS Reference:

2009-0468

Notification Status:

ARCHIVED

Keywords Class:

STAFF MANAGEMENT

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 157 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2010-001

Organisational Entity:

QMD PMU and IDT BI

Processing Operations:

Business Objects (BO) repository administration

Purposes:

Performance of statistics provision task: Making statistics and reports available to users, resolving technical issues with the access to or usage of the reports Legal obligation: Blocking users from unauthorised access to sensitive reports following the applicable DPO notifications (the latter ones are few in number and covered by notifications of their own, e.g. DPN-2006-022) Performance of a contract: Occasionally monitoring the access frequency to the server along with the server response time / downtime, in order to ensure proper back-end technical administration and compliance with service-level agreements signed with service providers

Categories of Data:

Business Objects reports access rights and access activities

Processor:

Members of QMD PMU and IDT BI teams

Retention Period:

For as long as the BO accounts exist

Data Subjects:

Active BO users (many passive ones, desired future state: all users of the Office will at least be allowed to access the vast majority of public reports)

Information to Data Subjects:

Not a

When and Data Subjects are informed:

Data subjects will be informed about the implementation finally approved via an electronic document linked from every report, the login pages, etc.

Right to Block Data:

No. Treatment of individual blocking requests not feasible without excessive development effort.

Right to Erase Data:

Yes. Only unlawful processing, which will not occur.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

Council Regulation 207/2009 on the Community trade mark

Recipients:

Organizational entities (QMD PMU and IDT BI), including their management, ITD IOS service in case of technical problems that require their assistance

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

STATISTICS / QUALITY CONTROL

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 158 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2010-002

Organisational Entity:

Web Publications

Processing Operations:

Google Analytics

Purposes:

Collecting anonymous website statistics

Categories of Data:

Website statistics

Processor:

Web Publications and Google Analytics

Retention Period:

Not applicable

Data Subjects:

Not identifiable individuals using the OHIM website

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Via a notice in Legal notices. http://oami.europa.eu/ows/rw/pages/legalNotices.en.do

Right to Block Data:

Yes

Right to Erase Data: Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”) Processing is necessary to gain anonymous information on site usage in order to improve the OHIM website

Legal Instrument: Recipients:

Web Publications and Google Analytics

Transfer to Third Parties

YES

Security Measures:

NO

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

INTERNET / STATISTICS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 159 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2010-003

Organisational Entity:

HRD

Processing Operations:

Control and management of sickness leaves (Update of DPN-2005-035)

Purposes:

Efficient and correct management of the aforementioned absences

Categories of Data:

Name and Surname; result of medical visit; diagnosis; medical and administrative report; home address; date of absence and days and probable length of absence; telephone number

Processor:

Medical Service and Medical Control

Retention Period:

30 years

Data Subjects:

Statutory staff

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When the data subject receives an official notification informing about an irregularity in the medical certificates, all relevant information concerning articles 11 and 12 is included.

Right to Block Data:

Yes, confidential data.

Right to Erase Data:

No. Data has to be stored 30 years in the medical archives. Only after that period of time the affected person can ask to erase the file/data.

Legal Basis:

- Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”) - Article 5(b) of Regulation 45/2001 (“processing is necessary to compliance with a legal obligation […]”)

Legal Instrument:

Article 59 of the Staff Regulations

Recipients:

A part from the affected person, the medical service, administration, medical control, a third doctor if this should be necessary

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2010-263

Notification Status:

REGISTERED

Keywords Class:

MEDICAL FILE / HEALTH

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 160 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2010-005

Organisational Entity:

DIPP

Processing Operations:

Quality Management System, ex-post quality check of TM decisions (Updated by DPN-2012-009)

Purposes:

The purpose of the processing operations is twofold: Measure and make public the level of quality of TM first instance decisions.  Obtain feed back information about the reasons of the mistakes, their frequency, distribution, pattern, etc, in order to decide the measures for improvement. Marginally, the information contained in the e-mails received by the HoS (see (a) & (b) above), both in terms of volumes and content, is used as an additional indicator by the HoS for evaluating the quality of the outcome of examiners. The rest of the indicators which are used by HoS to evaluate the quality of the outcome of the examiners are, in particular: 1. the quality of the draft decisions that HoS revise; 2. the complaints of users that arrived to the Complaints Unit; 3. the revocation of examiners’ decisions; 4. the information coming from Info Centre about particular problems or good treatments of a file; 5. the feed back from the training units in Quality Matters service when the examiner has been trained and coached in that service; 6. the feed back from the Legal Advisers in Quality Matters service when the examiner’s decisions have been revised by that service.

Categories of Data:

The data concerned by the EPQC are: 1. In the EPQC data base (called UQCT):  the identification of the file concerned;  the type of the decision analyzed (classification, AG, opposition, cancellation);  the date when the extraction point has been reached;  the date of the extraction;  the organizational service where the decision was taken;  the outcome of the evaluation of the decision (correct/mistake);  if mistaken, the type of mistake, in two levels, as described above;  backups of e-mails content (see point (a) under “description”) as well as the error descriptions used as a basis for the e-mails. 2. The EPQC DB does not contain therefore personal data. However, it is to be noticed that the ID of the file concerned, if crossed with the DB of production (EM++), allows identifying the examiner who made the decision. This summary of the data by service and individual, built ad-hoc in principle once a year by crossing this DB with the TM Production DB, contains the data referred to above plus the name of the examiner. 3. In the e-mail to examiners and HoS:  the identification of the file concerned;  if mistaken: o the detailed description of the mistake; o the text in the reference documents justifying to consider a mistake; o an invitation to reply to the rapporteur and the HoS with the reasons for the mistake and the measures suggested to avoid its repetition;  if not mistaken: o standard text informing the examiner that the file did not contain mistake.

Processor:

1. To the EPQC DB:  the members of EPQCG;  one expert in statistics (sampling, etc) from Quality Management Department;  two experts from ITD (database administrators). 2. To the summary of the data by service and individual:  director and HoS of production services;  the members of Central Team Unit of the TM department, responsible for preparing the data for the TMD hierarchy. 3.To the e-mails:  content and addressees: the rapporteur and the other members of EPQCG, each examiner and eventual co-signers concerned, their HoS;  just content (anonymous and without the ID of the file): the report containing all mistakes is distributed to the whole production services.

Retention Period:

1. The EPQC DB contains for the time being data since 2007. Since no personal data are stored there and this DB is the source of aggregated, anonymous data for quality results purpose, no limit for storage is foreseen. 2. The summary of the data by service and individual is to be eliminated at the end of the lifecycle of the appraisal exercises (2 years after the end of the appraisal period). 3. The e-mails sent and received are eliminated by each individual following their own practices of managing their e-mail inbox. No general instruction has been given on what to do about these e-mails but in any case it is logic that they are maintained during the lifecycle of the appraisal exercises.

Data Subjects:

OHIM’s examiners of the first instance teams taking decisions in classification, AG, opposition or cancellation

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 161 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Information to Data Subjects:

Yes

When and Data Subjects are informed:

In September 2009 there was a note (annexed) where examiners where informed about the details of the EPQC system and that the results of EPQC would be an additional indicator for their HoS of the quality of their outcome. The note was explained by the director of DIPP in meetings with all examiners in TMD. At the beginning of each appraisal exercise, in the framework of the compulsory meetings between director of TMD and its staff, TMD’s director recalls the indicators on the basis of which the quality of the outcome of examiners is evaluated by HoS.

Right to Block Data:

No. Data are production data.

Right to Erase Data:

No. Data are production data.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties establishing the European Communities or other legal instruments adopted on the basis thereof […]”)

Legal Instrument:

CTM Regulation as far as it defines the obligation for examiners to take correct decisions

Recipients:

See 'Processor'

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2010-869

Notification Status:

ARCHIVED

Keywords Class:

QUALITY MANAGEMENT SYSTEM / APPRAISAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 162 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2010-007

Organisational Entity:

FD

Processing Operations:

Details invoices by month (late)

Purposes:

Inform to Authorising Officers about invoices paid late and as consequence the Office may be obliged to paid interests.

Categories of Data:

Registry staff names, invoice No., budget line, authorising officer, delay time, interests

Processor:

Authorising Officers

Retention Period: Data Subjects:

Authorising officers

Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data: Right to Erase Data: Legal Basis:

Article 5(a) of Regulation 45/2001

Legal Instrument: Recipients:

Authorising officers

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

ACCOUNTING

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 163 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2010-008

Organisational Entity:

GSD

Processing Operations:

Upgrade of the Library Management System

Purposes:

Update Aleph because is obsolete.

Categories of Data:

Library data, all records of books, loans, borrowers/users data (name, surname, ID number, telephone, room location and number of loans).

Processor:

Green data technical consultants

Retention Period:

Until project is closed, foreseen mid 2011

Data Subjects:

OHIM staff and external

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Legal notice posted in the Intranet

Right to Block Data:

N/A

Right to Erase Data:

N/A

Legal Basis:

Article 5(a) of Regulation 45/2001

Legal Instrument: Recipients:

Green Data and OHIM technical consultants and GSD staff involved in the project

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

LIBRARY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 164 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2010-009

Organisational Entity:

Presidence

Processing Operations:

Infrastructure Audit Survey

Purposes:

Input to the infrastructure audit carried out by an external company.

Categories of Data:

Gender, age range, working scheme, detail on part time working scheme, place of work, number of work places, work area, carrying out Management activity, number (range) of staff managed, work place distance to Office, transport used to come to Office, lunch habits (time used, when, place, preference of 3 options), short breaks (used for what, when). Work description, question on work: working from home, confidentiality degree of dept. work, hours working outside Office, percentage of daily work at work place – away from work place, who is met in internal meetings, departments working with, confidentiality – material needed – number of attendants to meetings with other departments. Installations: distance to equipment and rest areas, opinion about different aspects of work place: soundproofing, acoustic and thermal condition, desk, chair, archive, copy room, meeting room, special equipment, air conditioning, electricity and IT installations. Suggestions.

Processor:

QMD – data processor (PM of audits) and external company

Retention Period:

3 months

Data Subjects:

Statuary and non statuary staff at the moment of the survey.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Before launching of the survey and in the e-mail reminding them about the survey.

Right to Block Data:

N/A

Right to Erase Data:

N/A

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out in the public interest……") Article 5(d) of Regulation 45/2001 (“the data subject has unambiguously given his or her consent”)

Legal Instrument: Recipients:

External company carrying out the audit. Only anonymous data collections and result.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 165 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2011-001

Organisational Entity:

HRD

Processing Operations:

Management of requests related to credit cards for staff going on mission

Purposes:

The purpose of the operation is transmission of essential and minimum data from the requestor / cardholder to the contractor (bank).

Categories of Data:

Personal data, such as: name, surname, N.I.E. or passport number, home address, date of birth, bank account number, e-mail address, mobile number.

Processor:

Mission Office Agent and contracting party providing the credit cards (Bank).

Retention Period:

During use of the credit card and 2 years upon return of the same.

Data Subjects:

OHIM staff (officials, temporary or contract agents) who are liable to incur mission expenses.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Via their request for the credit card.

Right to Block Data:

Yes (in case of blockage, erasure or objection to the collection of the data the data subject cannot maintain the credit card and has to return it to OHIM without delay).

Right to Erase Data:

Yes

Legal Basis:

Article 5(d) of Regulation 45/2001 (“the data subject has unambiguously given his or her consent”)

Legal Instrument: Recipients:

Mission Office Staff and their back-up (always staff of the Staffing and Entitlements Sector), Head of Staffing and Entitlements Sector. Contracting party providing the crecit cards.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

E-BUSINESS

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 166 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2011-002

Organisational Entity:

ID-IBA

Processing Operations:

Installation of a “Localizator GPS” in the car fleet of OHIM

Purposes:

1. The data of present locations help to allocate the most appropriate car to a pending request for transport 2. The data of past locations provide a means of control on whether cars were merely used for professional purposes 3. The data of past locations give the possibility of evaluating whether the car fleet was used in the most efficient and economic way 4. The data of past locations provide a solid basis for decisions on the overall fleet size and the car models to be used in the future

Categories of Data:

Number of official car + coordinates of location (continuous)

Processor:

Director of GSD (now ID-IBA) Head of Facility Management Head of Transport Sector

Retention Period:

2 years

Data Subjects:

Drivers

Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data:

No

Right to Erase Data:

No

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument: Recipients:

Director of GSD (now ID-IBA) Head of Facility Management Head of Transport Sector

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

CONTROL / MONITORING

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 167 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2011-003

Organisational Entity:

RD-HRA-SESWS

Processing Operations:

Reference check of Candidates on OHIM reserve lists (merged in DPN-2012-007)

Purposes:

The purpose of the operation is to obtain information on the Candidate’s past performance and conduct as well as his/her skills, strengths & developmental areas, his/her ability to perform in the foreseen role, as well as his/her ability to fit in the working environment. Collection of such information solely aims to support the A.I.P.N. in taking an informed decision about the Candidate’s aptitude and preparedness for working at the OHIM.

Categories of Data:

Relation of the referee with the Candidate, length of their acquaintance, the Candidate’s duties at his/her previous workplace(s), assessment by the referee of the Candidate’s performance in his/her previous workplace(s), his/her strengths, areas for development, relationship with his/her colleagues; assessment by the referee whether the Candidate could perform in the role for which the OHIM is considering his/her candidature; comments made by the referee (solely those limited to the Candidate’s work experience and aptitude to perform in his/her past jobs as well as in the job for which his/her candidature is considered by the OHIM).

Processor:

Recruitment Agent

Retention Period:

Data of candidates who later work as an OHIM employee: Once the contract on employment has terminated, the data are kept to assist the pension service and the Joint Sickness Insurance Service. The data are definitely disposed after the staff member’s death and pension payment to descendents ends. Data of candidates whose name is put on a reserve list but who are not offered a job at the OHIM or who don’t accept it is kept 2 years.

Data Subjects:

Candidates on OHIM reserve list who are offered a specific job at the OHIM.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The vacancy notice published on OHIM website includes information on the reference check. The notification to the Candidate about the fact that his/her name was included in a reserve list for future recruitment includes information about possible future reference check based on the data provided by the Candidate in his candidature

Right to Block Data:

Yes In case of blockage, erasure or objection to the collection of the data the data subject may be excluded from the selection procedure.

Right to Erase Data:

Yes

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument: Recipients:

- Recruitment Team (RD-HRA) - Management of the recruiting department (Director, foreseen immediate superior and reporting officer) - Management of the HRA (Director, Head of the Recruitment Team) - A.I.P.N. of the OHIM and their delegates.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2011-0369

Notification Status:

REGISTERED

Keywords Class:

SELECTION

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 168 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2011-004

Organisational Entity:

RD-HRA

Processing Operations:

informal procedure relating to the Anti-harassment Policy

Purposes:

The reference person whom the alleged victim has chosen for giving assistance throughout the informal procedure will collect a reduced number of data referring to the case submitted. The personal data is collected and processed with the following aims: to support and provide an efficient and proper administration of cases to be solved while guaranteeing confidentiality and create conciliation; to follow up and evaluate the policy; to review the request for help and any need for psychological support; to identify recurrent cases and provide references for disciplinary actions with the consent of the victim; to provide data for the formal procedure; eventually, to reply to the Ombudsman or legal authorities at the national or European level in the case that the complaint leads to a formal procedure.

Categories of Data:

Administrative data of the alleged victim and alleged harasser, such as name, professional address, phone number, e-mail address, organizational unit and function. The processing operations refer to data directly connected to the working and personal situation of the data subject, but will only be collected if connected to the situation of alleged harassment.

Processor:

- Reference Persons; - HRD, in the case that an informal procedure leads to a formal procedure and responsible for administrative enquiry set up within this context

Retention Period:

Each Reference Person will keep his own case files for a period of no more than five years after the outcome of the informal procedure, whenever this information procedure has not lead to a formal procedure. This period is necessary to evaluate the policy, reply to legal questions and identify possible recurrent cases. If at the date of the expiration of the initial five years, there are ongoing legal or administrative proceedings which may necessitate the consultation of the files, records shall be kept until the rights for appeal or any other procedures expire. Statistical data is held without limit after having being made anonymous and not identifiable in accordance with Article 4(1) (e) of Regulation 45/2001.

Data Subjects:

Seconded officials, temporary agents, contractual agents, interim staff or stagiares. Every person working in the Agency is potentially concerned as they can be alleged harassor, potential victim, witness or other person implicated.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The data protection statement relating to the informal procedure is publicly available through the OHIM intranet page dedicated to the Anti-harassment Policy. - Persons who contact a Reference Person shall receive a copy of the "specific privacy statement on the protection of personal data within the framework of an informal procedure following alleged psychological and sexual harassment." (See Annex I of the Manual of Procedure). - Once the alleged victim confirms that he wishes to have his case dealt with under the informal procedure he receives a "Declaration of Confidentiality for the informal procedure for cases of psychological and sexual harassment", signed by the Reference Person (see annex III to the Manual or Procedure). - If a witness or other third party intervenes during this informal procedure, he also receives the privacy statement (see Annex I to the Manual of Procedure). - If the Reference Person approaches the alleged harasser with the consent of the victim, the alleged harasser also receives a privacy statement (see Annex II). The alleged harasser has the right to be informed of the policy of psychological and sexual harassment and the manual of procedures and the option to receive help and advice from the anti-harassment coordinator. He also has the right to know that his or her data are processed.

Right to Block Data:

Yes. On written request to the controller, the data subject shall have the right to obtain from the controller the blocking of data under the conditions laid down in the Regulation.

Right to Erase Data:

Yes. On written request to the controller, the data subject shall have the right to obtain from the controller the erasure of the personal data used during the procedure under the conditions laid down in the Regulation.

Legal Basis:

Article 5(a), 5(d), and 5(e) of Regulation 45/2001

Legal Instrument:

- Staff Regulations on Officials of the European Communities and the Conditions of Employment of other Servants of the European Communities Articles 1d, 12, 12a, 24, and Articles 11 and 81 of the CEOS. Article 12a of the Staff Regulations provides that"officials shall refrain from any form of psycological harassement"; - The OHIM Decision ADM-08-11 on the policy protecting the dignity of the person and preventing psychological harassment and sexual harassment;

Recipients:

Data will only be transmitted to the competent bodies when a formal procedure is launched and with the prior consent of the person who gave them to the recipients. Transmission without prior consent can only occur in exceptional cases covered by Article 20(1)(c) of Regulation 45/2001, i.e. when necessary to ensure the protection of the alleged victims. - Reference Persons;

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 169 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs - HRD, in the case that an informal procedure leads to a formal procedure and responsible for administrative enquiry set up within this context. - The parties in the informal procedure, insofar the personal data relate directly to themselves under the conditions laid down in Regulation 45/2001. Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2011-596

Notification Status:

REGISTERED

Keywords Class:

SENSITIVE

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 170 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2011-005

Organisational Entity:

RD-HRA

Processing Operations:

Selection and appointment of confidential counsellors among certified mediators

Purposes:

The Appointing Authority of the Office will appoint a list of Reference Persons: 1) at least 5 statutory employees chosen among OHIM’s certified mediators who have undergone an official training and successfully passed an examination. This certification confirms the suitability of the candidates; 2) at least 5 statutory employees selected as a result of a call of interest published by the Staff Committee of the OHIM. This prior notification concerns only point 1) of the present part. The Staff Committee has committed to file the prior notification concerning point 2).

Categories of Data:

Information provided by the employees on the list of certified mediators: name, professional address, phone number, e-mail address, languages mastered, gender and organizational assignment. The candidates shall provide a declaration on honour (solemn declaration) about their disciplinary situation during their career within the EU institutions and bodies

Processor:

The data for the selection will only be accessible by the HRD staff responsible staff for the selection procedure and the selection panel, also constituted by HRD staff members.

Retention Period:

Documents that might have been provided by the selected candidates will be destroyed after the expiry of the mandate of the Reference Person. If this mandate is prolonged, the documents will be destroyed at the end of the new mandate. Personal data on non-selected candidates will not be retained further to a possible appeal deadline and subsequent treatment period.

Data Subjects:

The data subject is the staff member who is on the list of certified mediators and who volunteers to become a reference person for the informal procedure.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The data protection statement relating to the selection of confidential counsellors by the Resources Department (HR) is sent to the candidate concerned after receiving his/her application form for the position of confidential counsellor in response to the call for expression of interest launched to that effect.

Right to Block Data:

Yes. On written request to the controller, the data subject shall have the right to obtain from the controller the blocking of data under the conditions laid down in the Regulation.

Right to Erase Data:

Yes. On written request to the controller, the data subject shall have the right to obtain from the controller the erasure of the personal data used during the procedure under the conditions laid down in the Regulation.

Legal Basis:

Article 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

- Staff Regulations on Officials of the European Communities and the Conditions of Employment of other Servants of the European Communities Articles 1d, 12, 12a, 24, and Articles 11 and 81 of the CEOS. Article 12a of the Staff Regulations provides that"officials shall refrain from any form of psycological harassement"; - Memorandum of Understanding for the setting up of a network of Reference Persons; - The OHIM Decision ADM-08-11 on the policy protecting the dignity of the person and preventing psychological harassment and sexual harassment.

Recipients:

The data contained in the selection files are disclosed to: - Members of the selection panel whenever set up; - HRD responsibles and support staff in charge of the selection; This transmission will be restricted to the information necessary for the competent entity to carry out its task. The data contained in the resulting list of appointed Reference Persons will be published on OHIM’s Intranet and will be visible by all OHIM employees. These data will be limited to: full name, contact details (telephone number, professional address), organizational assignment, languages mastered at working level. The data subject will have access to his/her data.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2011-596

Notification Status:

REGISTERED

Keywords Class:

SELECTION / CALL FOR INTEREST

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 171 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2011-006

Organisational Entity:

Staff Committee

Processing Operations:

Selection and appointment by the SC of confidential counsellors

Purposes:

To set up a network of confidential counsellors (or "reference persons") as foreseen in OHIM's Decision ADM-08-11 and its annexed Guidelines on the policy on protecting the dignity of the person and preventing psychological harassment and sexual harassment. The Human Resources Department is responsible for selecting five confidential counsellors (to reach the total of ten confidential counsellors or "references persons") which it will do according to its own procedure while respecting the rules laid down in the Decision and Guidelines.

Categories of Data:

Applications from candidates following a call for interest launched by the OHIM Staff Committee. The call for interest describes the selection and eligibility criteria.

Processor:

The Staff Committee who communicates the list of five names to the AIPN with a copy to the Human Resources Department

Retention Period:

End of the selection procedure, once the confidential counsellors are nominated (not more than six months)

Data Subjects:

Applicants for the position of confidential counsellor to be nominated by the AIPN based on a list of five names to be put forward by the Staff Committee.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The data protection statement relating to the selection of confidential counsellors by the Staff Committee is sent to the candidate concerned after receiving his/her application form for the position of confidential counsellor in response to the call for expression of interest launched to that effect.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

Decision ADM-08-11 and the annexed Guidelines

Recipients:

Members of the Staff Committee. The Staff Committee will communicate the list of five names to the AIPN with a copy to the Human Resources Department. OHIM's Welfare Officer, who is part of the selection panel set up by the Staff Committee to select the five confidential counsellors.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2011-596

Notification Status:

REGISTERED

Keywords Class:

SELECTION / CALL FOR INTEREST

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 172 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2011-007 (DPN-2006-11 Update)

Organisational Entity:

RD-HRA

Processing Operations:

Selection and appointment procedures of managers

Purposes:

Selection and appointment procedures of managers comprised in the official organisation chart of the Office

Categories of Data:

Full name, date of birth, gender, marital status, number of children, address, nationality and mother tongue, telephone number, fax number, e-mail address, contact person in case of absence; data refering to availability (for interviews, for taking up service), type of education (type of diplomas and titles obtained, including name of traning organization, periods), years of professional experience in the areas indicated (including names and addresses of previous employers, job descriptions of previous jobs), language knowledge and corresponding levels, level and area of IT-literacy; interests; references; photo; any other detail that the data subject declares on a voluntary basis. If the candidate is an internal staff member the following data may be indicated in addition: personnel number, status, jobtitle, department and eventual past assignments, internal telephone number, e-mail address, administrative address. Other data managed by the selection committee: - results of the tests or pre-tests undergone by the candidates - lists of the successful and non-successful candidates - minutes of the meetings of the selection committee and final report to the Management Committee and the AA or AECE.

Processor:

- Members of staff in Human Resources Area of RD in charge of internal mobility and recruitment of managers: applications and CVs, agenda for organisation of interviews. - Members of Selection Committee (internal members and external members, whenever relevant) and secretariat of Selection Committee: all data - Members of Management Committee of the Office: lists of suitable candidates for final selection.

Retention Period:

The application, the CV and all the preparatory data (except the tests carried out) will be maintained 5 years in storage for dealing with eventual complaints, after the publication of the final list of succfessful candidates. Test results will be destroyed once the Selection Committee has taken note of the summary of the tests. The summary of the tests will be maintained 5 years after the publication of the final list of successful candidates. No time limits are considered for the documents related to the successful candidates as they are a part of the recruitment procedure and will remain in the recruitment folder until transfer to another institution, permanent leave or retirement.

Data Subjects:

The applicants of the selection procedures.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

For internal applications the information is clearly available on the Mobility page

Right to Block Data:

On written request to the controller, the data subject shall have the right to obtain from the controller the blocking of data under the conditions laid down in the Regulation. Should an applicant request the blocking of his/her personal data needed for the course of the procedure, the Controller would immediately inform him/her about any eventual impact such request may have on the individual procedure.

Right to Erase Data:

On written request to the controller, the data subject shall have the right to obtain from the controller the erasure of the personal data used during the procedure under the conditions laid down in the Regulation. Should an applicant request the erasure of his/her personal data needed for the course of the procedure, the Controller would immediately inform him/her about any eventual impact such request may have on the individual procedure.

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

Articles 7(1), 29 (1)(a)(i) and (ii) and 29 (1)(b) of the Staff Regulation of the European Communities; Article 12 of Conditions for Employment of other servant s of the European Communities; and the Guidelines for mobility within the OHIM.

Recipients:

- Members of staff in Human Resources Areda of RD in charge of internal mobility and recruitment of managers: applications and CVs, agenda for organisation of interviews. - Members of Selection Committee (internal members and external members, whenever relevant) and secretariat of Selection Committee: all data - Members of Management Committee of the Office: lists of suitable candidates for final selection.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2008-435

Notification Status:

REGISTERED

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 173 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Keywords Class:

SELECTION

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 13/04/2012

Page 174 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2011-009

Organisational Entity:

ICLAD

Processing Operations:

User Satisfaction Survey

Purposes:

The objective is to globally measure the satisfaction of users of the OHIM services in order to improve OHIM services.

Categories of Data:

Name of users of OHIM services (CTM/RCD owners and applicants, Opponents and Representatives); OHIM ID (only when users provide it); e-mail adresses; type of user (owner-representative); size of the company; number of employees in the company; identification of sector of business; country.

Processor:

ICLAD-Institutional Relations; Economics and Statistics Service Staff of the Office involved in statistical tasks and in performing the survey

Retention Period:

indefinite for demographic information (as it is considered register data), 10 years for linked satisfaction data of users opting in, indefinite for anonymous satisfaction data or interested satisfaction panel members (those opting in to be members of longitudinal study panel)

Data Subjects:

Users of the OHIM services : CTM/RCD owners and applicants, Opponents and Representatives over a defined time period (usually 12 months before the launch of the survey)

Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data:

on request per email

Right to Erase Data:

on request per email

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument: Recipients:

OHIM: Staff involved in carrying out user satisfaction survey exercice Market Research Provider : QUOTA UNION

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 175 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2011-010

Organisational Entity:

BOA

Processing Operations:

Mediation in inter partes proceedings

Purposes:

Facilitate the assistance of mediators in order to resolve disputes in inter partes cases within the framework of the rules established by the Presidium. Help the parties to reach a voluntary agreement that is mutually satisfactory.

Categories of Data:

A) Curriculum Vitae of the mediators: - Name, surname - Photography - Work e-mail address - Work telephone - Education & proffesional background - Accredited mediation training - Other CV information (membership in professional bodies, etc) B) The information obtained and the documents furnished within the framework of the mediation

Processor:

BoAs special assistant

Retention Period: Data Subjects:

Qualified mediators appointed by the BoA’s Presidium

Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data:

On written request to the controller

Right to Erase Data:

On written request to the controller

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

Decision No 2011-1 of the Presidium of the Boards of Appeal on the amicable settlement of disputes

Recipients:

External people accessing the mediators’ CV posted in the Website (the mediators’ CV’s are public information) and the BoA mediators regarding their mediation records. The discussions and negotiations conducted within the framework of mediation shall be confidential for all persons involved in the mediation, in particular the mediator, the parties and their representatives.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SELECTION / CALL FOR INTEREST

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 176 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2012-001

Organisational Entity:

RD-FR

Processing Operations:

Excel database of OHIM staff going on mission

Categories of Data:

Name, Surname, DNI/Passport and passport expiration date, e-mail address, line manager, nationality.

Processor:

Head of the Accounts and Treasury Service and the officers dealing with the organizational management of missions

Data Subjects:

OHIM staff going on mission

Information to Data Subjects:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PERSONAL FOLDER

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 177 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2012-002

Organisational Entity:

ICLAD

Processing Operations:

Ad Hoc Satisfaction Surveys

Purposes:

The objective is to measure the overall satisfaction of users of specific OHIM service in order to improve in that particular area. In addition, based on specific individual satisfaction sheets or samples thereof, the Office wants to obtain information on the users’ perception as compared to OHIM’s internal perception of quality and to identify specific improvement measures.

Categories of Data:

Name of users of OHIM services (CTM/RCD applicants or owners, as well as owners of earlier rights or their respective representatives) OHIM ID Procedure ID User ID E-mail addresses Type of user (owner-representative) Size of the company Number of employees in the company Identification of sector of business Country Not all of this data will be necessary for each type of survey.

Processor:

Staff of the Office involved in statistical tasks, performing the survey, and dealing with quality issues

Retention Period:

Three years for demographic information (as it is considered register data), five years for linked satisfaction data of users opting in, indefinite for anonymous satisfaction data.

Data Subjects:

Users of the OHIM services : CTM/RCD applicants or owners, as well as owners of earlier rights or their respective representatives over a defined time period

Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data:

on request per email

Right to Erase Data:

on request per email

Legal Basis:

Article 5(a) and 5(d) of Regulation 45/2001

Legal Instrument: Recipients:

Market Research Provider : QUOTA UNION OHIM: Staff involved in carrying out user satisfaction survey exercice

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 178 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2012-003

Organisational Entity:

RD-HRA

Processing Operations:

Administrative investigations and disciplinary proceedings at OHIM

Purposes:

The main purpose is to put together relevant information into a file in order to enable the appointing authority to determine whether there has been a failure by an official, servant or other person working for OHIM, to comply with his/her obligations under the Staff Regulations and, where appropriate, impose a disciplinary penalty in accordance with the Staff Regulations.

Categories of Data:

Any personal data or document necessary in order to determine the existence of suspected offences in the framework of administrative inquiries and disciplinary proceedings in each particular case under investigation, namely: - name, personal number, and data on the statutory position and conditions of employment, name of witnesses, etc; - behavior, action or inaction of persons under investigation and / or subject to disciplinary procedures; - personal information contained in or compiled from a transcript, minutes, reports of informers, hearing records, witnesses, and investigators; - the legal qualification of these actions or inactions under the staff regulations and other obligations to which the persons concerned are subject - the individual responsibility of the persons concerned, including financial (Article 22 of the Staff Regulations) - the disciplinary penalty imposed where appropriate to those concerned. If, exceptionally, processing of special categories of data in the meaning of Article 10(1) were to be regarded this would be done under strict compliance with the conditions established in this regard in Article 10 of the Regulation.

Processor:

The staff member of the Office appointed and authorised by the AA/AECE to conduct an administrative investigation (the Inquiry Team Lead or the Chairman of Board) and his alternate. The members of the the Inquiry Team or the Disciplinary Board, their alternates and the additional members where appropriate The AA/AECE, as regards the investigation reports and conlusive opinions of the Inquiry Team and the Disciplinary Board The Human Resources department as custodian of documents generated in the framework of administrative inquiries and disciplinary proceedings to be filed in the corresponding personnel files and administrative inquiry files in accordance with the retention policy applied

Retention Period:

The final disciplinary decision is kept in the personal file of the staff member concerned. All the documents related to the disciplinary proceedings and the administrative inquires without disciplinary follow-up are kept according to Article 20 of Decision ADM-08-01 in the register of administrative investigations for a period of three years.

Data Subjects:

All statutory staff employed at OHIM, including officials, temporary agents and contract agents and any person whose data may be processed in the context of an inquiry or proceeding.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

As soon as an administrative investigation is initiated, the person concerned is officially notified by the appointing authority that the investigation has been opened, provided that information does not hinder the investigation. It is informed during the investigation of the facts and circumstances involving him/her. It is also informed by the appointing authority of the conclusion of the investigation and its findings. The appointing authority shall inform the person concerned of the possible opening of disciplinary proceedings concerning him/her and his decision. Furthermore, the data subject will be provided with a privacy notice with respect to the processing of his/her data in an administrative procedure or disciplinary proceeding including as a minimum: - the identity of the controller; - the purposes of the processing operation for which the data are intended; - the recipients or categories of recipients of the data; - the existence of the right of access to and the right to rectify, the data concerning him or her.

Right to Block Data:

N/A

Right to Erase Data:

As to the right of erasure, Decision ADM-08-01 refers to the provisions of the Staff Regulations, Annex 9, Article 27 so that the data subject may, after three years in the case of a written warning or reprimand or after six years in the case of any other penalty, submit a request for the deletion from his personal file of all reference to such measure. The AA/AECE shall decide whether to grant this request.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

Art. 86 of the Staff Regulations and Annex IX thereof ; Articles 49 to 50a and Article 119 of the CEOS ; Decision of the President of OHIM No ADM-08-01 concerning the conduct of administrative

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 179 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs investigations and disciplinary proceedings and, as a consequence, the mandate granted by the AA/AECE for the administrative investigations. Recipients:

The data subject. The staff member of the Office appointed and authorised by the AA/AECE to conduct an administrative investigation (the Inquiry Team Lead or the Chairman of Board) and his alternate. The members of the the Inquiry Team or the Disciplinary Board, their alternates and the additional members where appropriate. The Secretary of the Inquiry Team or the Board, with respect to the personal information transcribed in the minutes of the Inquiry Team or Board's meetings. The AA/AECE, as regards the investigation reports and conlusive opinions of the Inquiry Team and the Disciplinary Board. The Human Resources department as custodian of documents generated in the framework of administrative inquiries and disciplinary proceedings to be filed in the corresponding personnel files and administrative inquiry files in accordance with the retention policy applied.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2012-0333

Notification Status:

REGISTERED

Keywords Class:

SENSITIVE

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 180 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2012-004

Organisational Entity:

ESS

Processing Operations:

E-mail address polling

Purposes:

Distribution of an electronic survey among applicants who successfully applied for a CTM in 2009, for which we need to poll “blank” e-mail fields from applicants’ representatives. OHIM has recently been entrusted with additional tasks related to the protection of IP rights. For this and other reasons, OHIM has to improve its understanding of the impact of intellectual property on the economy, as measured by variables such as innovation, a key driver of the European economy in the coming years. It also implies that OHIM has to enhance its knowledge of best public and private sector practices used to manage IP rights. To meet these requirements, we study the motives, purpose(s) and timing of CTM registration as well as the bundling of CTMs with other IP rights, such as patents and design rights. The activities are in line with OHIM Strategic Objective 15 as per the Strategy Map, related to a total of eight Key Initiatives.

Categories of Data:

E-mail addresses

Processor:

ESS staff members, survey tool administrator

Retention Period:

1 year

Data Subjects:

CTM onwers

Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data:

on request per email.

Right to Erase Data:

on request per email.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

Legal instrument: Increasing knowledge about utilisation of IP rights

Recipients:

ESS staff members, survey tool administrator

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 181 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2012-005

Organisational Entity:

CS

Processing Operations:

Videoconferencing system

Purposes:

Improve the quality of our live decreasing missions outside the Office

Categories of Data:

Audio-Video data

Processor:

(See recipients)

Retention Period:

Work-related video conference recordings are considered OHIM records, and must be treated as such. The video recorded in this manner must be retained for a period of six (6) months, and after such period must be disposed in accordance to the Secure disposal of IT equipment and information procedure. Any exception to this standard should be justified and documented in the corresponding procedure.

Data Subjects:

Participants (internal and external users) using the videoconferencing system

Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data:

Yes, on written request to the controller

Right to Erase Data:

Yes, on written request to the controller

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument: Recipients:

Network Administrators plus other advantage users from CS and the Academy (to be defined).

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

COMMUNICATION

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 182 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2012-006

Organisational Entity:

OSD

Processing Operations:

Reporting on interactions with external users

Purposes:

Provision of metrics regarding external users’ interactions, OHIM accessibility and response time. Ensure that Service Level Agreements are achieved by the external providers (Switchboard and E-BusinessHelp). Identify areas of improvement and facilitate the planning and coordination of workflow and teams. Give more detail on type of Business Partners interacting with the Office and identify areas where support to SMEs is provided.

Categories of Data:

No special categories of data in the sense of article 10 of Regulation 45/2001 are processed in this context. Data processed and retained are the ones provided by the callers themselves. Data related to Business Partners are directly imported from PER. Business Partners personal data to be processed for reporting purposes under “Top 20 BPs by number of Irs": -BP name. -BP group (Owner, Representative, Potential BP). -BP type (Lawyer, Company, Contact, Designer, IP Offices, EU Bodies, Judicial bodies, Academic bodies/students, Others). -Statistics related to type of interactions associated to BPs.

Processor:

OHIM main internal stakeholders

Retention Period: Data Subjects:

Any external users to the Office contacting Switchboard by phone or email.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

External users are made aware of data processing by the disclaimer available on OHIM website (http:// http://oami.europa.eu/ows/rw/pages/OHIM/contact.en.do).

Right to Block Data:

Immediate

Right to Erase Data:

Immediate

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument: Recipients:

Switchboard, Information Centre and E-BusinessHelp staff.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

CONTROL / MONITORING

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 183 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2012-007

Organisational Entity:

RD-HRA

Processing Operations:

Recruitment procedures

Purposes:

Collection, analysis and processing of applications for OHIM temporary, contract agent posts, SNEs and agency staff, selection and recruitment of the most appropriate candidates. Selection phase: the personal data processed during the selection phase are necessary to evaluate the eligibility, the expertise and the profile of candidates. This allows the retention of the most suitable people for the open positions. Recruitment phase: the personal data processed during the recruitment phase are necessary to support the A.I.P.N./Authority Empowered to Conclude Contracts of Employment (i.e. the President of the OHIM) in taking an informed decision about the candidate’s aptitude and preparedness for working at the OHIM and to determine the rights of staff, prepare the relevant contracts of employment and build the new staff member’s personal file. In the case of agency staff, such personal file will not be built nor kept by the OHIM as the direct employer is the agency staff employer.

Categories of Data:

Selection phase: a) Personal details as: first name, last name, date of birth, gender, nationality, address, phone number, fax (optional), email address; b) Work experience including for each experience: start and end dates, position/title held, main activities and responsibilities, name and address of the employer, type of business, sector; years of professional experience (total); c) Education and training including, for each course, start and end dates, title of qualification obtained, diploma (level in the national and/or international classification), main study subjects, name of the organisation providing the education or the training; highest level of education (according to diploma classification in Europe); d) Languages including, for each language, the level of understanding, spoken and written proficiency; e) Computer skills including for each software application the skill level; f) Part of personal skills and competencies (such as artistic and others) – the completion of these fields is not obligatory and candidates are informed of this fact via the CV template / erecruitment application; g) References (names and contact numbers); h) Copies of proofs of education and professional experience; i) Result of the candidates’ performance during the oral and written tests: evaluation sheets. Recruitment phase: j) Reference check of selected candidates (see prior check case No. 2011-369 to merge and treat jointly with the present notification) - (Not required for SNE/agency staff); k) Availability of the applicant to take up duties at the OHIM; l) Medical aptitude of the candidate to perform the work at the OHIM (only the mention “apt” / “not apt”) - (Not required for SNE); m) Extract from the national police or criminal record / certificate of good conduct (Not required for SNE); n) Proofs of education and professional experience (originals or certified copies of the same are retained in the personnel file). Data and proofs required to determine rights to entitlements (originals or certified copies of the proofs are retained in the personnel file; o) Persons to be informed in case of accident incl. their contact data. For agency staff, the only data required to be submitted to the OHIM is the applicant’s CV (temporary agency’ template), obtained from the data subject, and the medical aptitude certificate to perform work at the OHIM. Eventually, in addition, the extract from the national police (m), might be requested.

Processor:

(See Recipients)

Retention Period:

Data of candidates who later work as an OHIM employee: ten years as of the termination of contract on employment or as of the last pension payment (Upon termination of the contract on employment the data are kept to assist the pension service and the Joint Sickness Insurance Scheme). The data are definitively disposed of after the staff member’s death and pension payment to descendents ends. To harmonize best practice, data of unsuccessful candidates as well as data of candidates whose name is put on a reserve list but who are not offered a job at the OHIM or who don’t accept it: 2 years as from the date of notification of unsuccessful candidates and 2 years after the expiration of the reserve list on which the candidate’s name was placed. This data refers to TA/Contract Agents/ trainees and SNEs. Minimum information is kept for indefinite period (50 years) for the purpose of providing trainee’s certificate (first name, last name, time of duration, department involved in the training and remuneration perceived).

Data Subjects:

Selection phase: Applicants who submitted their applications in reply to the publication of a vacancy notice.

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 184 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Recruitment phase: Selected candidates who have been offered a position by the OHIM as official, temporary, contract agents, trainees, seconded national experts and agency staff. Information to Data Subjects:

Yes

When and Data Subjects are informed:

Selection phase: The vacancy notice published on OHIM website includes information on the rights of the data subjects. Applicants sending their candidatures have to read and accept the privacy statement on personal data protection within the framework of pre-selection, selection and recruitment procedures within the OHIM. The notification to the Candidate about the fact that his/her name was included in a reserve list for future recruitment includes information about possible future reference check based on the data provided by the Candidate in his candidature. Recruitment phase and establishment of the personal file: During the recruitment phase, selected candidates offered a job provide all the documents mentioned above. Staff member can have access to their personal file at any time upon request to the Controller. They can rectify or request a correction if they consider there has been a mistake or they detected any inaccuracy, in accordance with article 26 of the Staff Regulations / article 11 of the CEOS. New staff members are informed about their rights at their entry into service. Regarding the agency staff, the data subjects are informed by the interim agency that their data can be used and submitted to third parties with regard to their eventual employment at the third parties premises.

Right to Block Data:

In case of blockage to the collection of the data the data subject may be excluded from the selection procedure.

Right to Erase Data:

In case of erasure to the collection of the data the data subject may be excluded from the selection procedure.

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

- Recruitment procedure as provided for the Staff Regulation (Articles 27-28) and 12, 82 (CEOS) - President’s Decision No ADM-03-38 REV on unpaid traineeships offered by the OHIM to young university graduates - Decision No ADM-06-26 on paid traineeships offered by the OHIM to young university graduates - Decision No ADM-07-02 on paid traineeships offered by the OHIM to national and international IP office employees - Decision No ADM-06-35 on the rules applicable to national experts on secondment to the departments of the OHIM - the framework contract under which interim staff can be hired

Recipients:

Selection phase: - Recruitment team (HR Area); - Members of the selection committees, - Members of the Advisory Committee for the Evaluations of Applications or external human resources consultant hired specifically by the OHIM to assess the competencies of candidates (Vacancies for Senior Officers) or to provide technical assistance during the selection procedure; - Management of the Resources Department (director, deputy director of the HR Area, head of the Staffing, Entitlements & Staff Welfare Service); - the A.I.P.N./Authority Empowered to Conclude Contracts of Employment (i.e. the President of the OHIM) and their delegates; - Relevant staff in the Finance Area of the Resources Department (financial verification, accountancy): Access to data that is necessary for the payment of a contribution towards travel expenses; - Travel agency staff of the travel agency under contract with the Office, who deal with the arrangement of travels for interviews of candidate (only name and surname of the candidate, place of origin and destination, passport number, travelling days). Recruitment phase: Availability to take up duties and final result of the medical aptitude: - Recruitment team (HR Area); - Management of the recruiting department (director, foreseen superior(s) and reporting officer); - Management of the Resources Department (director, deputy director of the HR Area, head of the Staffing, Entitlements & Staff Welfare Service); - the Authority Empowered to Conclude Contracts of Employment (i.e. the President of the OHIM) and their delegates. - Details related to the medical aptitude: Medical Service of the OHIM (HR Area). - The external provider that carries out the medical tests and supplies data on the medical status of candidates receives the name of candidates who are invited to the medical check. (Only candidates on a reserve list to whom the OHIM considers making a job offer are invited to the medical check.) - Data related to the classification of the new staff member: relevant personnel in the HR area (Recruitment team, Entitlements team), members of the Finance Area (providing financial verification of all files related to costs to the OHIM).

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 185 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs - Data necessary for the reimbursement of travel expenses for entry into service to the new staff member is accessible to relevant staff in the Finance Area of the Resources Department (financial verification, accountancy). - All other data collected during the recruitment phase: Entitlements team (HR Area), director of the Resources Department, deputy director of the HR Area and head of the Staffing, Entitlements & Staff Welfare Service (Resources Department); some service within the European Commission with which the OHIM has a Service Level Agreement, such as the PMO (Paymasters’ Office). - In case of complaint and audit, data will be disclosed accordingly to the EU Ombudsman, the Civil Service Tribunal, OLAF, Court of Auditors, OHIM Internal Audit Service. - In specific situations (e.g. complaints or interpretation of the applicable rules) some limited details might be shared with other Commission services such as the DG HR and the EPSO. In terms of selection of seconded national experts and trainees, the final selection, based on the list of candidates presented by the National Offices and data and documents thereof, will be made by the corresponding line manager of the OHIM department to which he/she will be assigned. With respect to covering the most suitable candidates for the senior posts at the highest management level of the OHIM, the short list with the names of the most suitable candidates (up to a maximum of three), accompanied by the relevant documentation, is transmitted to the Council, in view of the final decision on appointment. Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2012-0852

Notification Status:

REGISTERED

Keywords Class:

SELECTION

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 186 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2012-008

Organisational Entity:

RD-HRA

Processing Operations:

Medical files (Update of DPN-2005-037 & DPN-2005-039)

Purposes:

Compliance with the recruitment, occupational health and personnel management requirements of the Staff Regulations of Officials and CEOS. The pre-recruitment medical exams determine whether or not a person is physically fit to perform his/her duties, needs certain accommodations at the workplace, or to assess whether a limitation on benefits is necessary. The regular medical check-up at work, as a measure of preventive medicine and beyond the statutory check-up requirements, is beneficial for the health of employees helping to early detect health risks and problems, and for the employer, as it helps maintain human resources in better health, increase productivity and reduce sick leaves and joint sickness insurance costs.

Categories of Data:

Administrative data: full name, staff number, age, nationality. Anthropometic measurements: weight and heigth. Medical data: medical tests and analysis, medical history, family diseases, allergies, etc. The data collected for the annual visit and the pre-employement check-up are detailed in annexes 3 and 6. Most of the data collected are the same for both visits, with some supplementary data for the pre-employement check-up. Processing of special data. In the context of processing data on medical files, the file of the data subject may reveal special categories of data such as data concerning health or sex life. Such information will only be processed and stored if it is relevant in the context of the case and proportional to the intended purpose. OHIM will process such data in compliance with Article 10(2)&(3) of Regulation (EC) No 45/2001.

Processor:

Medical Service

Retention Period:

Most of health data collected is kept in safe custody in the individual medical record 30 years starting from the end of service of the concerned person. Health protocol questionnaires are maintained until the next medical review. Data on candidates not ultimately recruited shall be kept for a period of one year during which the candidates can ask for the return of medical data provided from the medical service of the OHIM. Beyond this period, the data is destroyed. In case of appeal, the data is kept until the end of the appeal process. Non-medical related documents: E-mail reminders; planning of medical appointments, daily planning, etc, are not kept in the medical records and are automatically deleted once it has served its informative purpose at every medical review.

Data Subjects:

Candidates who have been offered an employment in OHIM, officials, temporary and contractual agents.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

There is a declaration of confidentiality and data protection at the bottom of the programme for the annual medical visit and in the programme for the pre-employment medical examination providing the information indicated in Articles 11 & 12.

Right to Block Data:

Yes. Upon justified request as soon as possible

Right to Erase Data:

No. Data has to be stored 30 years in the medical archives. Only after that period of time the affected person can ask to erase the file/data

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

 Pre-recruitment examination: Articles 28(e) ["An official may be appointed only on condition that: ... (e) he is physically fit to perform his duties"] and 33 [“Before appointment, a successful candidate shall be medically examined by one of the institution's medical officers in order that the institution may be satisfied that he fulfils the requirements of Article 28(e)"] of the Staff Regulations and Articles 12(d), 13 (2) and 83 (2) of the CEOS.  Annual medical visit, occupational medicine visits and other medical visits: Article 59 (6) ["officials shall undergo a medical check-up every year either by the institution's medical officer or by a medical practitioner chosen by them"] of the Staff Regulations, Articles 16 (1), 59 and 91 of the CEOS. Besides, the obligation of supervising the health of the Commission employees is provided for by the Framework Directive 89/391/CEE.

Recipients:

The controller does not process data in relation to the annual visit, nor with respect to the preemployment check-up. All data is collected and kept by the contracted doctor with the assistance of the nurse. Authorised agents of the Resources Department can only process and store the administrative part of the documentation relating to health, i.e., the appointments and visits plan for the recruited candidates and the certificate of fitness to work.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference:

2012-0958

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 187 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Status:

REGISTERED

Keywords Class:

SENSITIVE

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 188 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2012-009

Organisational Entity:

OD

Processing Operations:

Quality Management System, Ex Post Quality Checks (EPQC) (Update of DPN-2010-005)

Purposes:

The aims of this activity is, on one side to monitor the global quality of the outputs of the Office in relation to the Office’s service standards using both objective and suitable for interpretation criteria, and on the other side to use the objective criteria’s as one of the elements taken into consideration for the appraisal report of the Data Subject concerned, as well as the respective management responsible. The staff will be informed by the quality checker about the result of the quality check to confirm the quality of their work when it was correct or to prevent repetition of errors.

Categories of Data:

Personal Data pointing to quality of individual’s work.

Processor:

Each staff member concerned, their Head of Service and their Head of Sector. The members of the EPQCG, the Head of the Service in charge of the EPQC and his hierarchical superior.

Retention Period:

The EPQC data shall be kept for a period of no longer than 2 years after the end of the appraisal period After this period, all individual data in electronic form shall be deleted and hard copies destroyed including any copies that may have been archived.

Data Subjects:

Staff of the Operations Department

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data Subjects – Staff of the Operations Department have been informed about the way quality is going to be assessed, how the data is going to be used and where it is going to be stored. This information was communicated by Heads of Services as well as by Directors in the form of an official communication.

Right to Block Data:

Yes. Upon justified request as soon as possible

Right to Erase Data:

24 months after the end of the appraisal period

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

DECISION No ADM-12-118 concerning the Ex Post Quality Checks carried out with respect to trademarks and designs first instance decisions in the Operations Department at the Office for Harmonization in the Internal Market

Recipients:

The members of Ex Post Quality Check Groups (EPQCG), the Head of Legal Practice Service of ICLAD and the Deputy Director for Legal Affairs of ICLAD, the Director of the Department concerned with regard to Objective EPQC Data, one expert in statistics (sampling, etc) from the Quality Management Service (QMS), two experts (database administrators) from the Information Technologies (IT) area of the Infrastructure Department (ID), the UQCT project Manager, one of the Department Quality Officers/Data Miners.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2012-0999

Notification Status:

REGISTERED

Keywords Class:

APPRAISAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 189 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2012-010

Organisational Entity:

ID-IBA

Processing Operations:

Psychosocial risk assessment

Purposes:

The questionnaire is designed, in the framework of the Prevention of Occupational Risks, to identify and measure psychosocial working conditions created by the work organization that have been identified scientifically as possible health risks for workers. It is a tool for evaluating psychosocial occupational hazards, which is necessary in order to prevent work-related hazards, so that the work performed is carried out in an environment that does not pose a risk to our health.

Categories of Data:

Official e-mail addresses of all OHIM employees. The survey consists of 120 questions, divided into four parts: • Social context • Health and personal wellbeing • Employment and working conditions • Psychosocial dimensions The questionnaire is confidential and anonymous, and as such you are asked not to specify your name at any time in the questionnaire. The information will be analyzed by SGS technicians exclusively in order to measure occupational hazards. The presentation of the results does not allow for the identification of any individuals answers.

Processor:

SGS Tecnos, SA and Occupational Health and Safety Committee

Retention Period:

20 days

Data Subjects:

Whole of OHIM statutory staff

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Subjects were informed on 05.11.12 at the earliest, through communications annexed to direct emails

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument: Recipients:

Director for prevention of occupational risk in SGS Tecnos S.A.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 190 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2012-011

Organisational Entity:

ID-IBA

Processing Operations:

Survey Sustainable Mobility Plan

Purposes:

Within the framework of the Eco-Management and Audit Scheme (EMAS) the Office is developing a Sustainable Mobility Plan (SMP) with the long term objective to improve where possible the accessibility to the Office premises by walking, cycling or use of public transportation, so that staff can use means of transport with lower negative impact on the environment. In the diagnosis phase of the mobility plan a questionnaire aimed at all employees has been used.

Categories of Data:

Official e-mail addresses of all OHIM employees. This questionnaire is fully anonymous, and the data extracted from it will be analyzed and presented in a comprehensive manner to ensure data confidentiality in all cases. Under no circumstances will individual results be extracted. The results will be used exclusively for purposes of the project, and will be presented in a global form.

Processor:

IT Administrator from Novosoft 2 Environment Consultants from Novotec Consultores

Retention Period:

30 days

Data Subjects:

OHIM staff

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By communications sent through direct e-mails

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument: Recipients:

Novotec Consultores S.A. Eco Management team

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 191 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-001

Organisational Entity:

The Academy (Observatory)

Processing Operations:

OHIM Academy Learning Portal (OALP)

Purposes:

The OALP (OHIM Academy Learning Portal) is an initiative which will bring to OHIM the capacity to be a true Learning and knowledge-based organisation and to project its knowledge to key constituents and stakeholders, providing: • user friendly, interactive and engaging eLearning modules and online tutorials tailored to meet specific staff needs; • online resources for supporting some Face to Face courses, such as syllabus, exercises, assignments, presentations, schedules, policies, hyperlinks, etc.; • discussions/debates and peer assessments, and Web 2.0 communication tools; • recorded events, such as seminars, conferences, webinars; • manuals, guidelines and useful information concerning training activities of the OHIM.

Categories of Data:

User’s profile data: Full name, Country, City, email address, OALP Courses enrolled in, First access to the OALP (date and hour), Last access to the OALP (date and hour), Department, Phone and location. User’s comments posted in forums, information published in blogs, and user’s statistics and reports concerning these data: • Logs (date and hour of each access to the platform and action developed) • Activity report and course participation: interaction between the user and the resources and activities of the courses (E.g.: open a Word document, complete a test activity, etc.)

Processor:

(See recipients)

Retention Period:

No time limits are foreseen for these data. The retention periods are aligned with the contractual duration of the employment contract with the office.

Data Subjects:

OHIM internal staff and OHIM external stakeholders

Information to Data Subjects:

Yes

When and Data Subjects are informed:

After applying for the course, by means of an e-mail. Besides, the Data Protection information is available for everybody in the OALP main page.

Right to Block Data:

Yes

Right to Erase Data:

No

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument: Recipients:

There are several roles in the platform and the stakeholders for each one are: • Administrator: A member of the OIS department in charge of managing the technical configuration of the OALP, • Manager: A member of the Academy department in charge of creating the OALP courses and enroling students and trainers on them (Business Platform Manager), • Academy Professional: Academy staff that need to manage the training for all the courses, • Trainer: Linguarama teachers and internal staff in charge of any OALP course, • Students: general OHIM staff enrolled in one or more courses, • Authenticated user: general OHIM staff not enrolled in any course, • Visitor: Some OHIM Heads of Services that need to review the OALP contents without modifying them; with different permissions to access to the data for each profile.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

TRAINING

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 192 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-002

Organisational Entity:

ID-IBA

Processing Operations:

Listado del personal de la obra - coordinación seguridad y salud

Purposes:

Intercambio de información legalmente necesaria en el marco de la seguridad y salud en el trabajo y de la prevención de accidentes.

Categories of Data:

Se guarda la documentación en el servidor X y una vez comprobada se envía el nombre y DNI a los vigilantes de seguridad para que den acceso al edificio.

Processor:

PRL

Retention Period:

5 años

Data Subjects:

Personal de las compañías subcontratadas que interviene en los trabajos de construcción del edifico anexo

Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data:

Yes. Upon written justified request as soon as possible.

Right to Erase Data:

Yes. Upon written justified request as soon as possible.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument: Recipients:

Personal del servicio de prevención encargado del control de seguridad y salud (Departamento de Infraestructuras)

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

CONTROL / MONITORING

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 193 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-003

Organisational Entity:

OD & OSD

Processing Operations:

Follow up of individual production and timeliness

Purposes:

The aims of this activity is, on one side, to monitor the global outputs of the Office in relation to the Office’s service standards (including the timeliness service standards), and, on the other side, to use this objective criteria’s as one of the elements taken into consideration for the appraisal report of the Data Subject concerned, as well as the respective management responsible. Such production and timeliness management system must be carried out in order to measure the production and timeliness of the concerned staff taking into account all the other relevant factors.

Categories of Data:

Personal Data pointing to quantity of individual’s work, namely, the identification of the file concerned; the type of task measured; the date when the task has been allocated; the date when the task has been executed; the time limit when the task was expected to be executed; the identification of the Data Subject concerned; the organizational service where the tasks was performed; etc. Data from the production database will be extracted on a regular basis. The data will contain basic information about all the trade mark applications, opposition or designs files which were finalized in the given period, such the file number, CTM Name, date of action, etc.

Processor:

(see recipients)

Retention Period:

The summaries of production data by Data Subject shall be kept for no more than two years after the end of the appraisal period in order to allow the management to use the data for the appraisal of the staff members concerned, and the latter to exercise their rights as provided for in Decision ADM-04-18-Rev and/or in Article 90(2) SR. After this period, all individual data extracted in electronic form shall be deleted and no longer archived, and all other copies in any form shall be destroyed.

Data Subjects:

Examiners of the Office dealing with tasks which are subject to evaluation

Information to Data Subjects:

Yes

When and Data Subjects are informed:

the Data Subjects – Staff of the Operational Departments - will be informed about the way their production is going to be measured, how the data is going to be used, how they may exercise their rights of access and rectification, where it is going to be stored, etc. This information will be communicated by Heads of Services as well as by Directors in the form of an official communication and by a formal Decision adopted to that effect.

Right to Block Data:

In the case of identification of inaccurate personal data, the examiner has the right, in accordance with article 15 of the Regulation (EC) No 45/2001, to block their data.

Right to Erase Data:

The Data Subject shall be entitled to the erasure of personal data referring to her/him which has been collected or processed in a manner incompatible with the legitimate purposes pursued by the Director of the Department concerned and the manner in which that data was obtained by submitting a written request to the Director of the Department concerned.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

- Administrative Decision to be formally adopted (See draft Decision enclosed with the present Notification) - Council Regulation (EC) No 207/2009 of 26 February 2009 on the Community trade mark, in particular Article 131 referred to the examiners. - Council Regulation (EC) No 6/2002 of 12 December 2001 on Community Design, in particular Articles 45 to 49 (Title V – Registration Procedure). - Staff Regulations (Articles 34, 43,and 45) - CEOS(Articles 14, 84 and 87)

Recipients:

Each Data Subject concerned, his Head of Sector, Head of Service and Director.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2013-0680

Notification Status:

REGISTERED

Keywords Class:

APPRAISAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 194 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-004

Organisational Entity:

FD-FRA-CPS

Processing Operations:

Procurement procedures

Purposes:

Management and administration of procurement procedures by Control & Procurement service including in particular: - the provision of evidence of the technical and professional capacity of tenderers, their staff and subcontractors. This data is collected and processed with the purpose of ascertaining eligibility of economic operators to participate in the procurement procedures and to be awarded a contract.

Categories of Data:

Personal data of tenderers, their staff or subcontractors and their staff which may include in particular: • Name (first name, family name, previous family name); • Gender, nationality, title, function; • Contact details (e-mail address, business telephone number, mobile telephone number, fax number, postal address, company and department, country of residence, internet address); • Personal data contained, certificates for social security contributions and taxes paid, extract from judicial records; • Bank account reference (IBAN and BIC codes), VAT number, national insurance number, passport number, ID number and personnel number; • Place and date of birth; and • Other personal data contained in CVs (expertise, technical skills and languages, professional experience including details on current and past employment). • A declaration on their honour that they are not in one of the exclusion situation referred to in article 106 of Regulation (EU, Euratom) nº 966/2012 of the European Parliament and of the Council of 25 October 2012 (“FR”). The following processing operations are likely to present specific risks to the rights and freedoms of data subjects (Art.27 of the Regulation (EC) nº 45/2001). - Processing of data relating to offences, criminal convictions or security measures (when Data Subject is an individual, participating as an economic operator in a procurement procedure); - Processing operations for the purpose of ascertaining that the operator is not in a situation which would require exclusion from the procurement procedure (when Data Subject is an individual, participating as an economic operator in a procurement procedure); - Processing operations intended to evaluate personal aspects relating to the data subject, including his or her ability or efficiency (when Data Subject is individual, participating as an economic operator in the procurement procedure; or when Data Subject is an employee or subcontractor of an economic operator participating in a procurement procedure and their personal data is included in the candidature or the tender).

Processor:

(See recipients)

Retention Period:

Procurement Files (documents in paper/electronic or mixed media) should have an administrative retention period (ARP) of 10 years. After 10 years, paper documents are destroyed following ad hoc security measures and mandatory legal electronic documents are archived permanently in SAP. The retention period runs from the date when the file is closed. It might be necessary to reopen a closed file in case of investigation or dispute, CoA and or OLAF request.

Data Subjects:

Persons possibly participating in procurement procedures of the OHIM: Tenderers or subcontractors and their respective staff.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

1. Invitation to tender. Annex I: Tender specifications (24. Personal Data) Annex III: Special conditions (1.9. Data Protection) Annex IV: General Terms and Conditions (Art.12 Processing of Personal Data) 2. Guidebook for tenderers (6.3.4 Protection of personal data) with reference to 6.4.3. 3.Website for download of procurement procedures documents. http://oami.europa.eu/ows/rw/pages/OHIM/publicProcurement/otherPublications.en.do

Right to Block Data:

In the case of identification of inaccurate personal data, the examiner has the right, in accordance with article 15 of the Regulation (EC) No 45/2001, to block their data. Legitimate requests are treated immediately and in any case not later than 15 days from the date of receipt of the request.

Right to Erase Data:

Yes, at any time.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”). In particular, the processing is necessary to ensure the selection of the best tenders in a fair and transparent way.

Legal Instrument:

Recital 27 of the Regulation must be also taken into consideration according to which "processing of personal data for performance of tasks carried out in the public interest includes the processing necessary for the management and functioning of those institutions and bodies". The legal basis of the processing of personal data within procurement procedures can be found

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 195 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs in the following legal instruments: - Regulation No CB-3-09 of the Budget Committee of the Office for Harmonization in the Internal Market (Trade Marks and Designs) of 17 July 2009 laying down the financial provisions applicable to the Office (“FR”). - Regulation No CB-1-10 of the Budget Committee of the Office for Harmonization in the Internal Market (Trade Marks and Designs) of 24 November 2010 laying down detailed rules for the implementation of Regulation nº CB-3-09 of the Budget Committee of the Office for Harmonization in the Internal Market of 17 July 2009 laying down the financial provisions applicable to the Office (“FR”). - Regulation (EU, Euratom) nº 966/2012 of the European Parliament and of the council of 25 October 2012 on the financial rules applicable to the general budget of the Union and repealing Council Regulation (EC, Euratom) nº 1605/2002. -Commission delegated Regulation (EU) no 1268/2012 of 29 October 2012 on the rules of application of Regulation (EU, Euratom) no 966/2012 of the European Parliament and of the Council on the Financial rules applicable to the general budget of the Union. Recipients:

- Finance and Procurement Service staff participating in procurement procedures; - Opening Committee; - Evaluation Committee or Evaluator; - Legal advisor, if requested; - European Court of Auditors (ECA), OLAF, Internal Audit; and - Members of the public. Personal data of the winner of the call for tender will be made available to the public in accordance with the obligation to publish information on the outcome of the procurement procedures.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2013-0668

Notification Status:

REGISTERED

Keywords Class:

FINANCIAL REGULATION

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 196 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-005

Organisational Entity:

ICLAD - Institutional Relations

Processing Operations:

Livechat Tmclass

Purposes:

Increase customer support quality by using a live chat system in order to gather feedback and questions from the users and give real time help to users.

Categories of Data:

Content of the chats. Browsing information (IP address). Name and e-mail address (optional).

Processor:

Liveperson

Retention Period:

The data is automatically stored on the servers of the external service provider for 13 month

Data Subjects:

Users of Tmclass

Information to Data Subjects:

Yes

When and Data Subjects are informed:

There is a privacy statement posted on the TMclass home page

Right to Block Data:

Yes. Upon justified request as soon as possible.

Right to Erase Data:

Yes. Upon justified request as soon as possible.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument: Recipients:

Direct users of the LivePerson platform (chat agents and administrators)

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

E-BUSINESS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 197 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-006

Organisational Entity:

RD-HRA-DRS

Processing Operations:

Attestation procedure (ex-C and ex-D categories)

Purposes:

According to Article 10, paragraph 3 of Annex XIII of the Staff regulations, the purpose of the Attestation procedure is to allow officials established in the C or D categories before 1 May 2004 to benefit from career development allowing them to advance up to grade AST 11 by becoming members of the assistant function group without career restriction (AST function group).

Categories of Data:

Personal data of staff applying to the Attestation procedure: - name and surname; - personal number; - function group ; - administrative position as indicated in Article 35 of the Staff Regulations; - level of education; - professional experience; - seniority in the service and in the C or D category; - periodical reports covering the five last years.

Processor:

The Attestation procedure data is disclosed in the Human Resources Information System, section Career.

Retention Period:

The Attestation decision of the successful applicants is kept in the personal files and has the same retention period (30 years after leaving the institutions). The same for the data registered in the Human Resources Information System, Career (digitalisation of personal data - electronic files). The working documents disclosed in the personal database X, Development, Attestation, shall be kept during the Attestation working period until the deadline for filing a claim under article 90 of the Staff regulations is totally closed and a further period of 5 years (statistic/ historical purposes). Or, for a longer period necessary for resolving an appeal under the article 90 of the Staff Regulations, or a disciplinary procedure, or if an invalidity procedure may be undertaken. According to the Article 4(e) of Regulation (EC) No 45/2001 the personal data related to the Attestation procedure shall be kept for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Personal data related to the Attestation procedure is kept for statistical purposes or historical (to be used in the next procedure to assure equality of treatment between candidates from one year to another year).

Data Subjects:

OHIM officials in categories C and D before the 01.05.2004.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

OHIM officials are informed through a publication done on the OHIM Intranet which includes the following: - OHIM Administrative Decision Nr. 12-90 concerning the rules implementing Article 10(3) of Annex XIII of the Staff Regulations related to the Attestation procedure (see Annex 1); - call for applications (see Annex 2); - information related to the Attestation procedure, including a list of answers to the most frequent questions; - draft list of the officials who have submitted applications and are considered to be admitted to the Attestation procedure; - final list of the officials who have submitted applications and are considered to be admitted to the Attestation procedure. This list includes two groups: a first group of officials who perform primarily duties of an assistant without career restriction and a second group of officials who do not perform primarily these duties. The officials included in the second group are subjected to a special training plan with the purpose of enabling them to primarily perform duties of an assistant without career restriction; - individual Attestation decision sent to the group of officials who perform primarily duties of an “Assistant without career restriction” ; - individual decision sent to the group of officials who has to take part in a special training with the purpose of enabling them to perform duties of an “Assistant without career restriction”, after participation in the special training course(s) and after amendment of their job description or change of post.

Right to Block Data:

The person concerned may request to block the data considered to be inaccurate for any of the reasons mentioned in Article 15 of Regulation (EC) No 45/2001, for the time necessary to assess their accuracy.

Right to Erase Data:

N/A

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

Article 10(3) of Annex XIII of the Staff Regulations OHIM Administrative Decision Nr.12-90 of 08/10/2012 on rules implementing Article 10(3) of Annex XIII of the Staff Regulations relating to the Attestation procedure.

Recipients:

- all OHIM staff (information related to the call for applications of the Attestation procedure is

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 198 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs published in OHIM Insite); - staff of the Development and Recognition Service in the Resources Department who are in charge of the Attestation procedure (one Assistant, the Head of Service, the Director of the Resources Department and Appointing Authority. The working documents are disclosed in database X, Personal, Development, Attestation. - staff of the Resources Area of the Resources Department who are in charge of registering the decision of the Appointing Authority in the Human Resources information System and in charge of archiving the individual Attestation decision in the personal file of the persons concerned; - joint attestation committee (where applicable appeals committee); - other EU institutions in case of a transfer (personal files are also transferred). Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2013-0797

Notification Status:

REGISTERED

Keywords Class:

APPRAISAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 199 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-007

Organisational Entity:

RD-HRA-SESWS

Processing Operations:

Working time management, Flexi-time and Leave (Update of DPN-2005-040)

Purposes:

Management of data related to presences and absences in compliance with the Staff Regulations and the implementing provisions on working hours, part-time work and leave. Management of data contained on the Human Resources Information System under Working time management, Flexi-time/ Absences, which includes working hours, requests for flexitime, part-time, leave on personal grounds /unpaid leave, special leave, parental leave, family leave, maternity leave. This includes the verification of the supporting documents (e.g.: marriage certificates, birth certificates, death and sickness certificates of the relatives, etc.) Management of travelling time related to special leave.

Categories of Data:

Personal data of staff concerned: - Name of the staff members or SNE, personal number, civil status, statutory status; - Name of the relatives mentioned in the supporting documents (child, ascendant, etc.). when necessary, e.g. in the case of family or parental leave, special leave due to illness of a relative, spouse in the case of marriage, etc. For agency staff, only flexi-time is allowed, so no supporting documents are needed. Only the request introduced in the system must be processed. Supporting documents for various categories of special leave: - certificates received by the HR assistants managing the absences in Human Resources Area of the Resources Department: marriage, birth, adoption of a child, death related to relatives (etc.); - certificates related to the sickness of relatives received by the Medical service. The processing at stake may involve medical data in the strict sense and/or data relating to health of the data subject to the effect that the data reveal information concerning the health status of the person (absence for sick leave). In addition, justifications of leave or absence may also contain information revealing the religious beliefs or the sex life of the person. Supporting documents are forwarded to the staff managing the absences in the Resources Department with exception of the medical certificates which are directly sent by the person concerned to the Medical service for validation.

Processor:

Personal data are processed through the general Human Resources Information System, Under Presences: - the staff member registers clocking in and out. The system calculated the number of hours worked and shows a balance. The hours worked over the normal working hours are computed as a basis for taking flexi-time leave. Under Absences, with the following workflow system for part-time and leave: - request done by the person concerned through the hierarchy; - validation done by the hierarchy / and or validation by the Medical service (in case of relatives sickness); - approval and register done by the staff managing the absences in the Human Resources Area of the Resources Department; - supporting documents sent to the staff managing the absences in the Human Resources Area of the Resources Department (e.g. birth certificates, etc.); - supporting documents sent to the medical service if the request of special leave is related to the sickness of the relatives of the person concerned. In case that part-time or leave has an incidence on the remuneration of the person concerned, the OHIM staff managing absences /entitlements send a Note to Finance Area staff (for ex-ante verification) and to PMO staff managing the remunerations of OHIM staff (for salary rectification).

Retention Period:

Personal data related to part-time work, leave on personal grounds / unpaid leave, parental leave and family leave shall be retained for the entire career of the person concerned and 30 years after leaving the service to keep track when the total time granted reaches the maximum permitted (Article 42(b) of the Staff Regulations) and for calculation of pension rights (e.g.: need in case of transfer / or taking up duties to another institution). Personal data and supporting documents related to special leave (e.g.: sickness of relatives) shall be kept for a maximum of two years, except for cases where a complaint or appeal is launched or, a disciplinary procedure is engage or an invalidity procedure may be undertaken. In case of death of a family member, data are retained for the whole career to avoid the possibility of any similar leave requests for the same deceased person in the future (transfer to other institutions). The data will also be retained where the leave has an incidence on the calculation of the pension or substantiates a change in the calculation of entitlements. Maternity leave data are retained for the whole career and 30 years after leaving the institutions (same as the personal file) in case that the descendants or the administration might need this information for entitlements rights of the person concerned /or descendants for pension calculations.

Data Subjects:

OHIM Statutory staff members (officials, temporary agents and contract agents), Seconded National Experts (SNE), trainees and agency staff (“intérimaires”). In connection to special categories of leave, relatives of OHIM staff, including spouse, children and relatives in ascending line.

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 200 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Information to Data Subjects:

Yes

When and Data Subjects are informed:

New staff members and SNE receive information related to special leave (Staff Regulations and implementing rules). This information is available in OHIM Intranet under “Resources”, “Administration and me”, “Staff Regulations”, “Commission decisions applied by analogy”. Newcomers also participate in presentation sessions on leave given by the staff of the OHIM Human Resources Area managing the entitlements and absences. Agency staff is only allowed flexi-time in the context of the organization of work of the unit. The information on the scheme is given by the vendor at the start of the contract and the line manager of the OHIM to whom the agency staff is appointed and is responsible for approving or denying flexi-time. Each data subject is informed by a data protection statement available on the Employee-SelfService workspace initial page.

Right to Block Data:

The person concerned may request to block the data considered to be inaccurate for any of the reasons mentioned in Article 15 of Regulation (EC) No 45/2001, for the time necessary to assess their accuracy. The data will be corrected within a maximum of 5 days or the delay necessary for the adjustments of the Human Resources Information System data.

Right to Erase Data:

N/A

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

- Articles 15, 37, 40, 42, 42a, 42b, 55 to 61, Annex IVa and Annex V of the Staff Regulations; - Articles 11, 16, 17, 18, 88a, and 91 of the Conditions of Employment of Other Servants of the European Communities; - Decision OHIM Nr. ADM 12-99 of 3/12/2012 regarding to the application by analogy of some general implementing rules of Staff regulations adopted by the Commission; - Decision Commission (C-2010) 7495 final of 05/11/2010 on the implementing provisions on leave; - Decision Commission (C-2010) 7573 final of 05/11/2010 concerning part-time work; - Decision Commission (C-2010) 7572 final of 05/11/2010 concerning parental leave; - Decision Commission (C-2010) 7494 final of 05/11/2010 concerning family leave; - Decision Commission (C-2004) 1597 of 28/04/2004 concerning leave on personal grounds and unpaid leave; - Decision OHIM Nr. ADM 10-49 of 10/11/2010 concerning working hours; - Decision OHIM Nr ADM 10-10 Rev on the rules applicable to national experts on secondment to the departments of the OHIM.

Recipients:

Data are disclosed to all staff working at OHIM who is obliged to fill in working time in the Human Resources Information System database. This includes: - officials / temporary agents / contract agents / Seconded national experts, for register of working hours, consultation, request of flexi-time or other leave, cancellation and rectification . If relevant for the processing of individual rights, data related to relatives of the staff members concerned; - agency staff (“intérimaires”) for invoicing purposes in order to check that working hours are effectively those hours invoiced by the contractor for each agency staff; - the hierarchy of the person concerned (for consultation and validation); - the staff managing the absences and the entitlements in the Resources Department (Resources Area / Finance Area) for verification of working hours, flexi-time and leave against the entitlements rights, payment of annual travel, verification of supporting documents and register of approval in the database of absences; - the staff of PMO managing the remunerations of the OHIM staff (in case of parental leave, family leave or annual travel, the note sent to PMO includes the name of the person concerned, personal number, period of leave and the name of the relatives (children, parents, etc.); - a limited number of staff managing entitlements in the Resources Department (for consultation of absences); - in case of absence due to leave, the staff members concerned may also disclose the information to external contacts by setting their out-of-office auto reply in their email account. Data categories will only be filled in when relevant for the staff concerned.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

2013-0798

Notification Status:

REGISTERED

Keywords Class:

CONTROL / MONITORING

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 201 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-008

Organisational Entity:

ID-IBA

Processing Operations:

"Quien es quien” - Tabla de personal UTEs, Proyecto AE4 2

Purposes:

Control permisos de acceso y registro de datos de contacto de los intervinientes obra Proyecto AE4 2.

Categories of Data:

Mantenimiento de varias tablas en formato Excel con los nombres, empresas, teléfonos, DNIs (sólo Tabla personal UTE Proyecto AE4 2) y dirección de correo electrónico.

Processor: Retention Period:

Final del Proyecto (10/2014)

Data Subjects:

Personal interviniente en la obra de la nueva sede de la OAMI

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Aviso de privacidad accesible en lugar destacado

Right to Block Data:

Yes. Upon justified request as soon as possible.

Right to Erase Data:

Yes. Upon justified request as soon as possible.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument: Recipients:

Quien es Quien => Equipo de Proyecto Tabla personal UTEs Proyecto AE4 2=> Project Manager y asistente administrativo

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

ARCHIVED

Keywords Class:

ACCESS CONTROL / SECURITY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 202 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-009

Organisational Entity:

ICLAD - International Cooperation

Processing Operations:

Tmview

Purposes:

TMview can be used to: • Carry out 24/7 trade mark searches in at least one official language of each participating office. • Gain first hand, daily updated information from the official registers. • Access millions of trade mark applications and registrations. • Check for the availability of a trade mark name (e-filing pre-clearance). • Discover what your competitors are protecting. • View details on trade marks such as legal status, graphic representation, list of goods and services, etc. • View the trade marks details in the office of origin. • Print or export trade mark information to PDF, Excel & XML. • Provide information to & be a working tool for trade mark examiners.

Categories of Data:

For a PO to become part of TMview is must first upload into the portal through a file transfer protocol (FTP) a summary of selected and pre-established CI data for all its trade marks. Subsequently, the CI data is then updated daily by the POs. This means that on a daily basis the POs must perform a differential upload to TMview via the FTP of the trade marks which in their system/database are either new or have been modified or removed. However, a distinction should be made between the CI data provided by a PO to TMview and the CI date which is searchable and/or publically available in TMview. The CI data provided by a PO (with respect to personal data) is: Basic applicant (owner) information • Applicant identifier • Applicant name • Applicant URI

Processor: Retention Period:

A trade mark remains in TMview as long as it is not removed or deleted by the corresponding PO through the daily update procedure to the FTP.

Data Subjects:

In the category of searchable and/or publically available data, only the information on the Applicant name can be considered personal data and is at the same time the data subject.

Information to Data Subjects:

NO

When and Data Subjects are informed:

TMview does not notify the applicant/owner of a trade mark that his/her name is searchable and publically available in the portal because TMview is a reflection of the trade mark information contained in the online systems and databases of the POs. As regards Community trade marks (CTM) the data protection statement on OHIM’s web page, which embraces filing a CTM online (aka e-filing), covers this. For more information, please click here. Regarding each PO, this depends on their specific statement on their websites. TMview contains a summary of selected and pre-established trade mark information in the form of the above-mentioned CI data, including the Applicant name. Any manipulation of the CI data is not possible directly from the TMview portal but must be done by the POs via the daily update of the the differential file(s) which will either add new trade marks or modify or remove existing ones.

Right to Block Data:

Yes. Upon justified request. It must be carried out by contacting the PO where he/she filed the trade mark. The delay depends on the PO.

Right to Erase Data:

Yes. Upon justified request. It must be carried out by contacting the PO where he/she filed the trade mark. The delay depends on the PO.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

Regulation (EC) No 207/2009 on the Community trade mark

Recipients:

None. The trade mark data is only accessible to all Internet users connecting to www.tmview.europa.eu either directly or via www.tmdn.org or www.oami.europa.eu (aka OAMI Online).

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

E-BUSINESS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 1/0/201

Page 203 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-010

Organisational Entity:

ICLAD - International Cooperation

Processing Operations:

Designview

Purposes:

Designview can be used to: • Carry out 24/7 design searches in at least one official language of each participating office. • Gain first hand, daily updated information from the official registers. • Access hundreds of thousands of design applications and registrations. • Check for the availability of a designs name (e-filing pre-clearance). • Discover what your competitors are protecting. • View details on designs such as legal status, graphic representations, indications of products, etc. • View the designs details in the office of origin. • Print or export design information to PDF and Excel. • Provide information to & be a working tool for design examiners.

Categories of Data:

Basic applicant and previous applicants (owner) information • Applicant name • Applicant address Basic Designer detail information: • Designer name The searchable and/or publically available CI data (with respect to personal data) is : 7.Owner name 8.Previous Owner name 9.Designer name 10.Representative’s name

Representation • Representation Processor: Retention Period:

A design remains in Designview as long as it is not removed or deleted by the corresponding PO through the daily update procedure.

Data Subjects:

In the category of searchable and/or publically available data, only the informaiton on the Applicant/owner, representative and designer name can be considered personal data and is at the same time the data subject.

Information to Data Subjects:

NO

When and Data Subjects are informed:

Designview does not notfiy the appliant/owner, representative and designer of a design that his/her name is searchable and publically available in the portal because Designview is a reflection of the design information contained in the online systems and databases of the POs. As regards Registered Community designs (RCD) the data proctection statement on OHIM’s web page, which embraces filing a RCD online (aka e-filing), covers this. For more information, please click here. Regarding each PO, this depends on their specific statement on their websites. Designview contains a summary of selected and pre-established design information in the form of the above-mentioned CI data, including the Applicant/owner, representative and designer. Any manipulaition of the CI data is not possible directly from the Designview portal but must be done by the POs via the daily update of the the differential file(s) which will either add new designs or modify or remove existing ones.

Right to Block Data:

Yes. Upon justified request. It must be carried out by contacting the PO where he/she filed the design. The delay depends on the PO.

Right to Erase Data:

Yes. Upon justified request. It must be carried out by contacting the PO where he/she filed the design. The delay depends on the PO.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

Regulation (EC) No 6/2002 on Community designs

Recipients:

None. The design data is only accessible to all Internet users connecting to https://www.tmdn.org/tmdsview-web

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 204 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

E-BUSINESS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 205 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-011

Organisational Entity:

RD-FR

Processing Operations:

FBP Area Customer Feedback Survey 2013

Purposes:

To receive feedback from the OHIM Finance actors related to the services provided by the FBP Area. To help to improve the services of the FBP Area.

Categories of Data:

Official e-mail addresses of all OHIM Financial actors and opinion of the staff of the FBP Area working in the survey.

Processor: Retention Period:

Individual answers and all personal data collected will be deleted no later than two months after the anonymous results have been delivered.

Data Subjects:

All OHIM Financial actors

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Subjects will be informed at the moment of launching the survey through the e-mail providing the link to the questionnaire.

Right to Block Data:

N/A

Right to Erase Data:

N/A

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument: Recipients:

The Director of RD, the Deputy Director of the FBP Area and a limited number of staff of the FBP Area working in the survey.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 206 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-012

Organisational Entity:

HRD

Processing Operations:

Missions

Purposes:

Management of data related to missions in compliance with the Staff Regulations and the Guide of Missions. Estimation of mission costs / statement of payment orders related to the liquidation of expenses / issue of the priority pass to the airport lounges / issue of the mission credit card/ statistics per Department / budget estimations.

Categories of Data:

Forms : Request / Statement / External Events / External training: It includes the name of the person on mission, personal number, department of assignment, location of the mission, date of departure /return, date of start/end of work, purpose of the mission, costs for travel, number of hotel nights and cost, number of meals offered, if the mission costs are being borne by organisers, if the mission is combined with annual leave and if there is a need for advance of payment. Moreover, the statement of mission also includes the invoices related to hotel costs, taxis, travel tickets, etc. In the cases indicated on point 2.3 of the Missions Vademecum (participation on an external event, training or any other activity to be held on behalf of the Office), the event participation form contains the purpose and location of the event, the date, target (audience), name of the organiser, language used, program, presentation, name and number of participants, name of other non-OHIM speakers and the email of the staff member concerned. The request related to the participation on an external training contains the name of the person concerned, personal number, email, department of assignment, date and purpose of the training, location, the address of the training provider and the amount of the enrolment fees. Travel Agency Travel arrangements and hotel reservations are done through the travel agency having signed a contract with OHIM. The agency receives the name of the person travelling on mission, his/her email address, location of the mission and date of start / end of work. In certain cases, depending on destination and/or the flight companies, the agency needs the number of passport, date of validity and the birth date of the person concerned. If a Visa is required, the travel agency sends the passport to the company CAP 2/70 for the administrative formalities. Missions Office The register of missions contains the following data : name of the person concerned, department of assignment, standard /or extended mission, dates of start/end of work, location and costs. All paper documents related to the liquidation of mission expenses (request /statement forms / invoices) are scanned by the external provider having signed a contract with OHIM to process the work done at the Mail Dispatch. The staff of the Mission Office receives all the documents necessary to support the mission requests and the statement of expenses. Mission Insurance and Assistance The information transmitted by the Missions Office to the insurance company having signed a contract with OHIM is anonymous. It is limited to the number of days of mission per person, per year. In case of accident /or other incident for which compensation could be claimed, the insurance company asks the necessary personal data of the person concerned according to the information published in OHIM Insite / Missions / Travel Insurance. Priority pass The Priority Travel Group working with OHIM offers a service of Priority Pass Card which gives access to the airport VIP/lounges. The Missions Office sends to the Travel Group a list with the name and the membership level (Prestige / Standard plus / Standard) of the persons who are granted a Priority Pass. The monthly invoice includes a report with the name of the persons concerned, date of the visit to the lounge, number of guests, lounge code, city, airport and voucher reference. The indication of the number of guests is necessary for reasons of invoice payment. In case of need for professional reasons, OHIM pays the access cost for the guest of the cardholder. Mission Credit card An agreement between OHIM and a provider has been settled for the use of corporate credit cards by the persons travelling on mission The credit card is issued after a contract has been signed between the person concerned and the credit card issuer. The request form is sent for approval to a limited number of staff members managing the credit cards (Finance Area). It contains the name of the person concerned, his/her passport or Nie references, bank account, home address, date of birth, phone and email. The mission credit card is personnel and the cardholders are solely responsible for settling any debit balance on their statement. However, OHIM is ultimately responsible for all costs incurred. For this reason, OHIM may, exceptionally, request information on card operations if, for example, debit amounts are not paid by the cardholder and these are charged to the OHIM’s account or if the contract of the cardholder expires before the clearance of the last credit.

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 207 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Access to this information is exceptional and restricted to a limited number of staff of the Finance Area managing bank operations. The cardholders are informed of any request for information related to the operations done with their mission credit card. Processor: Retention Period:

Data related to the liquidation of mission expenses, payments to the travel agency, insurance, priority pass and credit card debits paid by OHIM is kept during 7 years for budgetary discharge by the Court of Auditors, control and audit purposes. This period is justified on the provisions of Article 25 {Article 38(6) of the Financial Regulation} of the detailed rules (Regulation N°CB-1-10 of the Budget Committee) for the implementation of the Financial Regulation (Regulation N° CB3-09 of the Budget Committee laying down the financial provisions applicable to the OHIM. The Priority Pass and the Credit Card are immediately destroyed and / or deactivated by the end of service of the person concerned /or if the person concerned no longer fulfils the conditions to receive a card. Data is also kept until the deadline for filing a claim under Article 90 of the Staff regulations is totally reached or the time necessary for resolving an appeal or a disciplinary procedure. Data related to statistics / historical purposes is archived during 7 years. For a longer period the lists will be anonymous.

Data Subjects:

Persons travelling on mission: OHIM statutory staff members, Special Advisers and Seconded National Experts. Exceptionally, trainees and any other person employed by an external provider having a contract with OHIM (ej: project consultant) who travels with the staff member. If it’s the case, the payment is done in line with the payment conditions established on the contract signed between OHIM and the external provider.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

All important information related to missions is published permanently in OHIM Insite, under Missions.

Right to Block Data:

N/A

Right to Erase Data:

N/A

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

Article 71 of the SR, Articles 11 to 13a of the Annex VII of SR, Article 22 and 92 of the CEOS, Article 19 of the Decision ADM N°10-10Rev of 08/09/2011 concerning the SNE, Article 4 of Decision ADM 12-68 of 05/09/2012 concerning the provision of services by Special Advisers, Decision OHIM ADM N°09-52 of 20/08/2009 (Guide of Missions).

Recipients:

Administrative formalities / reservations / priority pass The person travelling on mission and, in certain cases, his/her secretaries. The staff members of the Resources Area managing the missions and those of the Finance Area for the payments. Access is limited to what is strictly necessary for treating the files: staff of the Travel Agency, Insurance Company, Priority Pass Group, Bank handling the Credit Cards and staff of the Provider scanning the documents at the Mail Dispatch. Mission authorization The Line Manager of the person concerned, the Institutional Relations Service of the ICLAD (external events), the Director of the Academy (external training) and the Authorizing Officer by Sub-Delegation (Resources Area). Payments (SAP workflow) The authorized Line Managers, the members of staff of the Verification Office and Accounting Service (Finance Area), the Authorizing Officer by Sub-Delegation (Resources Area). Credit Cards A limited number of staff managing the bank operations (Finance Area). In case of complaint, the data may be disclosed to the Legal Service and / or to the EU Court of Justice. Upon request, the data may also be disclosed to the staff of OLAF and/ or to the Internal Audit Service, and / or to the Court of Auditors. The data transfer is limited to what is necessary for official investigations or for audit purposes. Upon request for Audit purposes: The staff members of OHIM Audit Service and the Court of Auditors.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

MISSIONS / MEETINGS / EVENTS

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 208 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 209 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2013-013

Organisational Entity:

OSD

Processing Operations:

Multi-functionality database

Purposes:

Be able to measure the Multi-functionality indexes and manage the available talent. The data are not going to be used for appraisal or promotion of staff.

Categories of Data:

Basic identification data – Professional experience – Diplomas and certificates (Education) – Languages – Tasks development and potential. Data categories will only be filled in when relevant for staff member.

Processor:

All staff working for or in OSD. This includes: -Statutory staff member: bound by the rules and procedures laid down by the Staff Regulations of Officials of the European Communities and the Conditions for Employment of Other Servants of the European Communities. (temporary agents, official, contract agent, auxiliary, special adviser) and, wherever relevant for the processing of individual rights, data related to relatives of said staff member.

Retention Period:

While the employees are under an Office contract filling a job position in the OSD.

Data Subjects:

All staff working for or in OSD. This includes: - Statutory staff member: bound by the rules and procedures laid down by the Staff Regulations of Officials of the European Communities and the Conditions for Employment of Other Servants of the European Communities. (temporary agents, official, contract agent, auxiliary, special adviser) and, wherever relevant for the processing of individual rights, data related to relatives of said staff member. - Non statutory personnel: Seconded National Expert.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Insite

Right to Block Data:

The person concerned may request to block the data considered to be inaccurate for any of the reasons mentioned in Article 15 of Regulation (EC) No 45/2001, for the time necessary to assess their accuracy.

Right to Erase Data:

N/A

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument: Recipients:

The director of the OSD – full access. The Heads of Service – only for the respective team members within their own Service. The Heads of Sectors - only for the respective team members. The Department Secretaries – restricted to the sole task of solving technical problems. QPRO – for the maintenance of the database.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

STAFF MANAGEMENT

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 210 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-002

Organisational Entity:

ICLAD

Processing Operations:

Events Platform

Purposes:

To control all internal and external events the Office manages or is involved in. To provide a sound system for reporting in order to fully understand all the activities the Office’s staff takes is involved in and to keep relevant information related to each event to manage it appropriately.

Categories of Data:

The event database is fed from the Event Participation and the Event Report electronic form, both accessible from Insite. Amongst others, there is personal data related to each individual attending an event either internally or externally such name, surname and department; event name; location or definition of the event, event report, etc, as requested in the forms. The Event Participation form is also used for the mission authorization process.

Processor: Retention Period:

Collected personal data are recorded and stored as long as follow-up actions are needed in the context of the meeting or event concerned. All personal data will be deleted 7 years after the last action in relation to the event. Reports containing personal data will be archived according to the OHIM's Retention Policy and Schedule for Files.

Data Subjects:

Any person, either internal or external, participating in events organised by OHIM or an external party.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Through a link placed on the Events Calendar page at the Intranet is accessible the privacy statement.

Right to Block Data:

On written request to the controller, the data subject shall have the right to obtain from the controller the blocking of data under the conditions laid down in the Regulation.

Right to Erase Data:

N/A

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

- Article 124-2(a) of Regulation (EC) No 207/2009 on the Community trade mark. - Event guidelines

Recipients:

Via the events database: authorised staff that has access to it and the system Administrator. Via the events calendar: all Office’s staff through with access to the interface in Insite through a login and password. No OHIM’s staff names are disclosed in the OHIM Website at the moment.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

MISSIONS / MEETINGS / EVENTS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 211 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-003

Organisational Entity:

HRD

Processing Operations:

User Satisfaction Survey: Seconded National Experts (SNE) Programme

Purposes:

To receive feed-back to improve the quality service for the selection and recruitment of the SNE, as well as to integrate quality objectives in the SNE guidelines and to the improve communication to the National Offices and to the SNE.

Categories of Data:

Official e-mail addresses of all persons concerned and their opinion

Processor: Retention Period:

Individual answers and all personal data collected will be deleted no later than 5 years after the anonymous results have been delivered. Active; 5 years Unactive: in line with IT security measures

Data Subjects:

Persons concerned of the National Offices, SNE, international experts and OHIM managers

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects will be informed at the moment of launching the survey through the e-mail providing the link to the questionnaire

Right to Block Data:

N/A

Right to Erase Data:

N/A

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument: Recipients:

The results of the survey will be accessible to the Director and Deputy Director of the RD, the Head of the Service Development and Recognition, the OHIM management, the persons concerned of the National Offices and a limited number of staff of the Resources Area of the RD and other Departments working in the survey.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 212 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-004

Organisational Entity:

HRD-Medical Service

Processing Operations:

Acuerdo entre la Consellería de Sanidad y la OAMI: Vacunas

Purposes:

Facilitar el acceso directo del Servicio Médico al Registro de Vacunas de la Consellería de Sanidad - Generalitat Valenciana

Categories of Data:

Nombre, apellido, No de DNI, SIP, SS y fecha de nacimiento da los empleados de la OAMI que solicitan una vacuna al Servicio médico/o que tienen la obligación de vacunarse antes de viajar en misión.

Processor:

Conselleria de Sanidad de la Comunidad Valenciana

Retention Period:

El mismo tiempo que los expedientes médicos de la persona que ha solicitado la vacuna / o que viaja en misión (30 años a partir de la fecha de fin de servicio del empleado en la OAMI).

Data Subjects:

Empleados de la OAMI

Information to Data Subjects:

Yes

When and Data Subjects are informed:

En el momento de pedir la vacuna / o antes de viajar en misión

Right to Block Data:

N/A

Right to Erase Data:

N/A

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

ORDEN de 23 de mayo de 2005, del conseller de Sanidad, por la que se crea el fichero informatizado Registro de Vacunas Nominal (RVN)

Recipients:

El personal autorizado de la Conselleria de Sanidad, el Médico y la Enfermera de la OAMI

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

MEDICAL FILE / HEALTH

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 213 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-005

Organisational Entity:

HRD

Processing Operations:

Traineeship Programme Satisfaction Survey

Purposes:

To receive feed-back (opinion) to improve the quality service for the administrative procedures, selection, recruitment and communication with the Traineeship Office and to maintain high standards.

Categories of Data:

E-mail addresses of all persons concerned and their opinion.

Processor: Retention Period:

Individual answers and all personal data collected will be deleted no later than 2 years after the anonymous results have been delivered and in line with the OHIM IT security measures. The anonymous statistic results will be kept according to the OHIM retention policy (5 years for the surveys).

Data Subjects:

Trainees, Mentors, Directors / Deputy Directors

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects will be informed at the moment of launching the survey through the e-mail providing the link to the questionnaire.

Right to Block Data:

N/A

Right to Erase Data:

N/A

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

Decision ADM N°12/81 on paid traineeships offered by the Office to young University graduates

Recipients:

The results of the survey will be accessible to the Trainees, Mentors, Directors/Deputy Directors, the Head of the Entitlements and Welfare Service, the OHIM management, the staff of the Resources Department working in the survey and the IT staff processing the survey tool.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 214 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-006

Organisational Entity:

ID-BITA

Processing Operations:

Verification procedure of telecommunication services bills in case of excessive costs

Purposes:

Execution of the budget for professional communications via telecommunication services of the Office. The verification procedure aims at reimbursing excessive costs done for private calls using telecommunication services. The procedure is designed to monitor the records of telecommunication devices usage particularly in relation to excess data charges but not the communication itself.

Categories of Data:

The Directors or heads of Service will be provided on an annual basis a listing of all their staff that has made use of telecommunication services via any devices. Devices refer to any fixed phone, mobile phone, smartphone, tablet, laptop or hybrid device. The data provided to the OHIM by the telecommunications service provider are a) the monthly mobile phone invoice that specifies the SIM mobile device linecard number and with the corresponding total costs for the period per mobile phone ; b) the itemised phone bill per mobile device line number SIM card specifying the individual telephone numbers dialled, in the event of the opening of a verification procedure, and c) the itemised phone bill per fixed phone line number, in the event of the opening of a verification procedure. OHIM’s management of telecommunication costs (BITA-VMSS) will maintain a list of the individuals that have exceeded the monthly threshold amount. Data that are the object of the processing are the following: Data subject related information: - name and surname, - Department / Unit name, - fixed / mobile device line number(s) of data subject. Traffic and billing data: - date of the bill, - date of communication, time, - duration of call or quantity of data downloaded, - called number or data server identification number, - type of communication (phone call, data transfer, roaming,…) - country of origin of the communication, - country of destination of the communication, - amount corresponding to the duration of call or quantity of data downloaded, - monthly consumption of the device.

Processor:

Telecommunication service provider (MOVISTAR)

Retention Period:

Traffic data, according to Article 37(2) of regulation 45/2001, shall be erased or made anonymous as soon as possible and no later than six months after collection, unless they need to be kept for a longer period to establish, exercise or defend a right in a pending legal claim involving such data. This list of the individuals that have exceeded the monthly threshold amount will have a history of 12 months maximum, - i.e. records of over 12 months will be deleted. The data relating to billing (only aggregate data) are retained for a period of 5 years from the date of decision granting discharge in respect of implementation of the OHIM’s budget.

Data Subjects:

Members of staff in possession of a mobile device of the OHIM.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

When staff member requests a telecommunication device via the appropriate process (Remedy i.need), user is informed of the OHIM Telecommunication Policy. Users have to acknowledge receipt of the telecommunication device and declare having read the information about the the OHIM Telecommunication Policy, which has also been placed on the respective Intranet page (URL link: http://insite.prod.oami.eu/id/information-security/security-policies).

Right to Block Data:

Yes, to block data on justified request of the data subject will be processed in 15 working days.

Right to Erase Data:

Yes, to erase data on justified request of the data subject will be processed in 15 working days.

Legal Basis:

Articles 5(a) and 5(b) of Regulation 45/2001

Legal Instrument:

- Article 37(2) of Regulation 45/2001. - Financial Regulation - Policy on OHIM Telecommunication Services

Recipients:

Access to printed and electronic information is limited to what is strictly necessary for the purposes of this processing of data, namely to these - The Controller and the Director of the concerned staff member that has exceeded the given threshold (monthly reports), - only the total net costs attributed individually to staff members.

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 215 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs - Limited staff of the Vendor Management Service within the Business Information Technology Area of the Infrastructure Department with respect to the itemised bills on the use of telecommunication devices by staff members exceeding the monthly threshold amount, provided on a monthly basis by the telecom provider, and only for storing purposes in a folder with restricted access in order to forward them, if applicable, to the concerned staff member for verification purposes. - Payroll department of the OHIM (PMO), in relation to the deduction of sums due by the concerned staff member after completion of the review procedure of telephone bills. Besides, only aggregate data are included in the corresponding financial circuits for payment to the telecom provider. - The Controller as regards the data subject declarations and replies by e-mail in relation with the billing verification procedure. Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

CONTROL / MONITORING

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 216 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-007

Organisational Entity:

SC

Processing Operations:

Survey of fiscal non-residents on Spanish tax issues

Purposes:

Actions in order to move forward towards finding a solution to the discriminatory situation affecting a large number of OHIM’s staff, namely, who are fiscal non-residents in Spain, which requires previous gathering of data on Spanish tax issues from interested data subjects via a survey and subsequent processing of personal data provided for the intended purpose.

Categories of Data:

E-mail address and the answers to the various questions of the survey, such as check boxes to identify whether required tax has been paid, whether related court proceedings have been started, whether the property constituting the ordinary residence in Alicante has been sold, etc.

Processor: Retention Period:

The individual data will remain in the database until the results have been completely analysed and will be rendered anonymous when they have been usefully exploited for the intended purposes, and, at the latest, after 1 year from the end of the mandate of the current Staff Committee. The anonymous statistic data in connection with this survey will be kept according to the OHIM retention policy (5 years).

Data Subjects:

Members of staff who are considered to be fiscally non resident in Spain

Information to Data Subjects:

Yes

When and Data Subjects are informed:

By a privacy notice accessible through a link embedded in the invitation e-mail to the survey.

Right to Block Data:

Yes. Data subjects may also under certain circumstances ask from the Controller to have these data blocked and for the erasure of data about them which they consider to have been unlawfully processed.

Right to Erase Data:

Yes.

Legal Basis:

Article 5(d) of Regulation 45/2001 (“the data subject has unambiguously given his or her consent”)

Legal Instrument:

Article 9.3 of the Staff Regulation

Recipients:

The access to personal data, if any, as well as all information collected in the context of this survey is only granted through User Id/Password to a defined population of users. These users typically are members of the team of the Staff Committee organising the survey and the selected members of the Resources Department with whom the information will be shared for the purposes of the survey. No personal data is transmitted to parties, which are outside the recipients and the legal framework mentioned.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 217 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-008

Organisational Entity:

HRD

Processing Operations:

Teleworking (Update of DPN-2006-008)

Purposes:

The purpose of collecting personal data is to process requests on regular or occasional teleworking resulting in teleworking agreements with OHIM staff members.

Categories of Data:

Name and surname of the person concerned, his/her personal number, email address, telephone numbers, place of teleworking, home address, IP (computer address), reason for teleworking, opinion of the line manager (including emails); compliance with selection criteria (current post and suitability for teleworking), job description, targets, organization of the time, arrangements at work or at home.

Processor: Retention Period:

Teleworking agreements and related working documents will be retained for three years after the teleworking ceases. Applications not granted will also be retained for three years. Anonymous statistic reports will be stored for a period of five years according to the OHIM retention policy.

Data Subjects:

Officials, temporary agents and contract agents having at least one year of service at OHIM, as well as having an overall assessment in the last appraisal report corresponding to the level required.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Publication in OHIM Insite, under Resources - Teleworking: Link to the Specific Privacy Statement

Right to Block Data:

N/A

Right to Erase Data:

N/A

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

Decision ADM N° 04/10 Rev of 29/03/2012 on teleworking

Recipients:

The superiors of the data subject and their assistants /secretariat / HR correspondents (teleworking request / agreement). ID staff (computer logging) and Telefonica (connection of telephone lines). RD staff processing the agreements for teleworking. The staff of the Common Services (Health & Safety) in charge of the inspection of the place of work. OHIM contracts with external companies have a clause of confidentiality. External staff is requested to sign a declaration of confidentiality.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

TELEWORKING

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 218 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-009

Organisational Entity:

HRD

Processing Operations:

Prevention and management of conflicts of interests

Purposes:

The management of the declarations of interests is necessary to encourage the highest standards of administration, professional ethics, integrity and independence. It serves to identify and disclose, in a transparent and consistent manner, the handling of situations where potential conflicts of interests may arise to avoid any conflict between the OHIM public duties and any kind of private interest of staff.

Categories of Data:

Personal data of internal and external staff applying to the Prevention and Management of Conflicts of Interests procedure: - forename and surname of staff members and members of the Board of Appeal, as well as of the AB/BC members; alternates, experts and advisers; - personal number; - start/end date at OHIM (employment/contract/activity); - assignment (Department and functions); - previous and current activities with an interest or related to the field of activity of OHIM; - gifts worth between 50€ and 150€; - financial interests (shares/stocks exceeding 50 000€ or equivalent) in the capital of companies having an interest related to the OHIM activity and/or assets or any intellectual property rights that may have a potential impact in the person’s activity at OHIM; - spouse’s/legally recognized partner’s/dependant family member’s current professional activity and financial interests; - any other relevant interests that may have a potential impact in the OHIM activities such as to impair the person’s independence at OHIM.

Processor: Retention Period:

Data will be kept during the time of the employment / contract /activity plus 7 years for budgetary discharge, control and audit purposes or for a longer period until the deadline for filing a claim under article 90 of the Staff Regulations is totally reached or the time necessary for resolving an appeal or a disciplinary procedure.

Data Subjects:

It concerns OHIM officials, temporary agents, contract agents, former staff, interim staff, persons employed under private law contracts, external experts and consultants, experts on secondment or on placement from national civil services or from international organisations, and trainees, etc. working for the OHIM. They will be required to sign a declaration of interests and a confidentiality statement upon entry into service /activity to follow the rules set out in the Guidelines on the Prevention and Management of Conflicts of Interests.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

OHIM internal and external staff is informed through the following documents published in the OHIM Insite: - Staff Regulations of Officials and the Conditions of Employment of other Servants of the European Communities; - OHIM Decision N°ADM-00-37 of 09/07/2001 on the Adoption of a Code of Good Administrative Behaviour; - Guidelines on the Prevention and Management of Conflict of Interests for Staff Members and Members of the Board of Appeal; - Forms related to the Declarations of Conflict of Interests; - Specific Privacy Statement for Data Protection related to the processing of data for the Prevention and Management of Conflicts of Interests.

Right to Block Data:

Yes. The person concerned may request to block the data considered to be inaccurate for any of the reasons mentioned in Article 15 of Regulation (EC) No 45/2001, for the time necessary to access their accuracy.

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

- Articles 11, 11a((1),12b(1), 12b(2),13,17(1),17(2), 19 and 40 of the SR; - Article 1(2) (c) of Annex VII of the SR; - Articles 11, 17, 52 and 81 of the Conditions of Employment of other Servants (CEOS); - OHIM Decision N° ADM-00-37 of 09/07/2001 on the adoption of a Code of Good Administrative Behaviour; - OHIM Guidelines on the Prevention and Management of Conflicts of Interests for Staff members and members of the Board of Appeal.

Recipients:

- the Line Manager and the Appointing Authority; - the Ethics Committee consulted on matters related to real or potential conflict of interests. It is composed by the Head of the Legal Service, the Director of the Resources Department and the Line Manager or the Chairperson of the Administrative Board for staff appointed by the Council of the European Union or by the Administrative Board; - the Office will publish in its website the names of the staff appointed by the Council of the

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 219 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs European Union and of the members of the Boards of Appeal appointed by the Administrative Board; -electronic data (forms and Register) stored in SHAREDOX and ALLEGRO (Human resources Department); - a limited number of authorized staff of the Human Resources Department registering the Declarations of Interests and giving an indicative level of real or potential conflict of interests with regard to a specific activity; - a limited number of authorized staff (internal or external) administrating the OHIM Information Systems; - in case of complaints, the Legal Service and /or the Court of Justice; - under request the data may also be disclosed to the staff of OLAF and to the Internal Audit Service and /or to the Court of Auditors; Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

WORK ASSIGNMENT / PROFILE

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 220 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-010

Organisational Entity:

HRD

Processing Operations:

Management of personal data of staff on general HR database (update of DPN-2009-010)

Purposes:

Management of the OHIM statutory staff according to the rules and procedures laid down by the Staff Regulations: - Staff directory (organisational structure) - Management of statutory staff, establishment plan and organisational assignments - Management of recruitment (applications) and internal mobility - Management of contracts - Management of individuals career: administrative career, training, promotion, appraisal, certification - Management of the skills, expertise/talents (polyvalence and expertise level, staff CV, working experience in/outside OHIM). This data will not be used for appraisal or promotion of staff - Organisational assignment - Management of individual rights and obligations - Entitlements (salary, allowances and reimbursements) - Time management, absences, working conditions, teleworking - Contact information (addresses, telephone, emails; contact persons, relatives.) - Personal file (stored in Alfresco) will be transferred to Allegro database - Management of Missions (a new module will be integrated in Allegro) - Management of the Seconded National Experts / Trainees / External staff/Agency staff - Staff statistics

Categories of Data:

See Annex I dor a full description

Processor: Retention Period:

Any data/document that is important for the staff member’s career is stored in the personal file and kept during 8 years after the extinction of all rights of the person concerned and of any dependents, and at least 120 years after the birth data of the person concerned. There are some exceptions for personal data/documents which can be destroyed in a shorter period of time that the whole of the documents constituting the personal file (The OHIM retention period and schedule for files is applied).

Data Subjects:

All statutory staff working at OHIM and the relatives : Statutory staff member: bound by the rules and procedures laid down by the SR and CEOS (officials, temporary agents, contract agents, special advisers) and, whereever relevant for the processing of individual rights, data related to the relatives of the staff members concerned Non statutory staff: Seconded National Experts, Trainees, Agency staff and External Consultants. The data categories will only be filled in Allegro when relevant for the staff member.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Each data subject is informed by a Data Protection Statement published on the OHIM Insite and availabe on HR Portal.

Right to Block Data:

Yes, data subjects may address a written request to the HRD Director for blocking data in the cases foreseen by Article 15.

Right to Erase Data:

Yes.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

- Decision ADM-08-40 implementing Regulation N°45/2001; - Staff Regulations (SR), Conditions of Employment of Other Servants (CEOS) and the administrative decision related hereto

Recipients:

Each statutory staff member has a read-only access to his/her own data. For some data categories (CV and diplomas, requests of absences, time management) it is foreseen that the staff members may complete their own data. The authorized staff of the Resources Department is in charge of processing the data. The statutory staff may have the support of interim staff or trainees to carry out their functions which must sign a declaration of commitment and confidentiality when taking up duties at the start of their employment. All OHIM managers, as defined by the current organigram, have access to the CV information of all staff (languages, education, OHIM/non-OHIM training, professional experience in/outside OHIM; technical skills and expertise, personal interests and competencies. Personal data is disclosed as follows: - Each staff member has read-only access of own data; - Authorized staff of the RD for the files that they are in charge; - Authorized staff of the Academy Service (data processing for the training of statutory/nonstatutory staff /SNE/trainees); - All managers as defined in the current organigram have access to the CV information of all staff; - The line managers have read-only access to a limited number of data (working time, absences, information on administrative career, CV module, appraisal, etc. depending on the specific profile of the line manager); The line managers assistants in charge of Resources issues may also be

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 221 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs authorised to access to the same personal data as their line managers; - The Information Center with regard to the availability of the staff member in order to attend incoming calls, and generally improve OHIM users’ satisfaction; - PMO and Finance Area for salary/payments/bank account details; - The Legal Service and the Court of Justice may have access to any personal data in the framework of legal consultation or claim raised by the staff member; - The Audit Service/ Court of Auditors (under request of the necessary data for audit purposes) and the OLAF within the framework of their enquiries; - The IT Service (technicians), on a temporary and restricted basis for customization, development, updating, technical tests, repair, support and improvement of the data base. A declaration of confidentiality is signed by the persons having access to the HR database. Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PERSONAL FILE

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 222 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-011

Organisational Entity:

OBS

Processing Operations:

Orphan Works database

Purposes:

Implemented as a single EU database by means of which it can develop a collaboration network in order to ensure the exchange of the information related to orphan works between all the Member States.

Categories of Data:

The database can store and process personal information (names and surnames) of natural persons related with orphan works, namely identified right holders, such as authors, co-authors, performers, phonogram producers, producers of first fixation of film, co-producers, publishers, broadcasters, translators etc. In addition, the database can store and process personal information (names, surnames, emails, addresses, telephone numbers) of potential right holders that would like to file a claim for a status change of orphan work. Such information will not be disclosed to the public and will be made available only to the beneficiary organisations using orphan works (libraries, museums, archives, broadcasting organisations). The database will also contain personal information (names, surnames, e-mails, addresses, telephone numbers) of individual users that login with the appropriate credentials to the orphan works database, such as representatives of beneficiary organisations and Competent National Authorities. Personal information of individual users of the database will not be disclosed to the public.

Processor: Retention Period:

Taking into account that one of the purposes of Directive 2012/58/EU is to facilitate right holders' identification in respect of works that appear to be orphans, personal data related to orphan works will be stored in the database for an unlimited period of time.

Data Subjects:

There are various categories of data subjects: - Right holders (natural persons) holding rights to orphan works, such as authors, co-authors, performers, phonogram producers, producers of first fixation of film, co-producers, publishers, broadcasters, translators etc. - Potential new right holders claiming status change of orphan work. - Individual users that login with the appropriate credentials to the orphan works database.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

According to Privacy Statement containing the information foreseen in Articles 11 and 12 of Regulation 45/2001.

Right to Block Data:

The data subjects can obtain from the Data Controller the blocking of data.

Right to Erase Data:

The data subjects have the right to have their data erased. This right is applicable if the processing of data is unlawful.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

- EU Directive 2012/28/EU on certain permitted uses of orphan works. - Regulation (EU) No 386/2012 on entrusting the Office for Harmonization in the Internal Market with tasks related to the enforcement of intellectual property rights.

Recipients:

The general public will have access to personal information (such as names and surnames) of right holders of orphan works which have been identified but not located. Information about identified and located right holders which authorized use of work in relation to rights they hold (partial orphan works) will be made available to the beneficiary organizations but not to the general public. From the general public such data will be hidden and replaced by a mention "identified and located". OHIM IT administrators will have access to personal data stored in the database for the purposes of maintenance of the database.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SEARCH TOOL / REGISTER

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 223 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-012

Organisational Entity:

OBS

Processing Operations:

Enforcement database

Purposes:

The enforcement database is an up to date database to help enforcement agencies to better identify counterfeit goods.

Categories of Data:

Information stored related to master users and users (contact persons in the companies). Master user (physical person that works for a company): name, middle name and last name of the person, employee’s company, language, professional e-mail address… Users (physical persons that work for a company): name , middle name and last name of the person, employee’s company, language, professional e-mail address… Details of right holders (owners natural persons): email of the applicant, address of the owner. Reference to reported cases of counterfeiting will not contain personal data of suspects.

Processor:

The Observatory is only responsible for maintaining the tool. Processing of the data contained is done by enforcement authorities having access to the tool.

Retention Period:

No limit. For the lifetime of EDB.

Data Subjects:

Individual contact persons of the companies registered in the database

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A privacy statement will be available on the Enforcement Database webpage.

Right to Block Data:

Yes

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

Regulation (EU) No 386/2012 of 19 April 2012 on the European Observatory on Infringements of IP Rights.

Recipients:

Outside OHIM: validated users and master users : Enforcement authorities (national customs authorities, national police departments or other EU-wide operating enforcement authorities such as Europol or Olaf. Inside OHIM: CG Administrators, EDB project staff, Service Desk, Data Base Administrators.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

DATABASE / REGISTER

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 224 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-013

Organisational Entity:

OBS

Processing Operations:

ACRIS database

Purposes:

EU Observatory will use the data provided in ACRIS exclusively for the purpose of generating anonymised statistics and reports, while DG Trade will analyse this data only for the reason of shaping dialogues for the bilateral negotiations with the countries of interest. The data will not be used in any other way.

Categories of Data:

ACRIS will collect data on IPR infringement cases of EU companies in countries outside of the EU. For the purpose of ACRIS, a case refers to situations in which either: 1. Formal action was taken - a single IPR enforcement action before the administrative or judiciary authority (administration of commerce, police; customs; civil, criminal court); or 2. No action was taken – of the alleged IPR infringements which were not brought before authority; Data disclosed in the above scenarios: - Personal names of the parties (defendants or complainants) in the IPR enforcement actions in the countries outside of the EU - Personal names of the parties in the decisions (judgments and administrative decisions) in the IPR enforcement actions in the countries outside of the EU. - Addresses of the individual parties Other personal data contained in a judicial decision: - Names of legal professionals involved in the judicial proceeding: judges, members of the Court, legal representatives, attorneys, etc - Names of witnesses, experts, etc Personal data mentioned will be collected in the database via the direct input provided by the companies and as indicated in the original decisions uploaded. The recipient of this information will be exclusively DG Trade and the EU Observatory.The information entered into the database is structured in two complementary but distinct sections: mandatory and non-mandatory fields.

Processor: Retention Period:

Once the data are no longer needed for the purposes they were collected, they will be erased, made anonymous or, in certain cases, blocked. The need to store personal data must be reviewed regularly, with time limits set for their erasure.

Data Subjects:

Persons involved in a judicial or administrative proceeding related to an IPR infringement case whose information appears in these proceedings in the form of personally-identifiable information.

Information to Data Subjects: When and Data Subjects are informed: Right to Block Data:

N/A

Right to Erase Data:

N/A

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

Regulation (EU) No 386/212, entrusting the OHIM with tasks related to the enforcement of IPR…….as a European Observatory on Infringements of Intellectual Property Rights (particularly, in accordance with the tasks and objectives to be undertaken in relation with Article 2.2(b), 5.2(b).

Recipients:

The judicial decisions will only be visible by the company which uploaded it and the EC DG Trade. Personal data mentioned will be collected in the database via the direct input provided by the companies and as indicated in the original decisions uploaded. The recipient of this information will be exclusively DG Trade and the EU Observatory. The access conditions by the different groups of stakeholders to the database vary depending on the role of the stakeholder organisation. Registered users will input and update information into the system and consult intelligence in the form of anonymous statistics. DG Trade and OHIM will have access to details of cases together with decisions and comments, and to statistics level I and II.

Transfer to Third Parties Security Measures:

YES

EDPS Reference: Notification Status:

PENDING NOTIFICATION

Keywords Class:

DATABASE / REGISTER

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 225 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2014-014

Organisational Entity:

OD

Processing Operations:

OD Contribution to Events Missions & Training

Purposes:

In order to monitor the time spent by each OD colleague in tasks related to events organised by the Office, such as seminars, conferences, etc., OD-QMCS created this tracking sheet. We have inserted the information we have kept on events organised by the Academy and ICLAD where we had been requested to provide speakers.

Categories of Data:

Date of the event, Title of the event, topic(s) covered in the event, trainer (complete name), solicitant (Academy / ICLAD / others), number of days of the event, delivery time needed, travel days for the trainer, place of the event, preparation factor (time spent by the trainer for preparing the event), total number of hours spent in each event (automatically calculated using a mathematical formula).

Processor: Retention Period:

2 years

Data Subjects:

OD Staff who give any kind of training, attend to events or missions in which the potential public does not belong to OD Department.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

They are informed by email at the time a new event in which they participate is approved.

Right to Block Data:

The data subjects can obtain from the Data Controller the blocking of data.

Right to Erase Data:

The data subjects have the right to have their data erased. This right is applicable if the processing of data is unlawful.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

Article 124-2(a) of Regulation (EC) No 207/2009 on the Community trade mark

Recipients:

OD concerned staff participating in the events, OD Management (Team Leaders, Deputy Directors and Director), OD Secretariat, OD Central Team, Alfresco Administrators, DMOs. Some of the persons in the groups above may be employed by other companies (e.g. Deloitte, Adecco). In this connection it should be noted that OHIM contracts with external companies have a clause of confidentiality. External staff is requested to sign a declaration of confidentiality.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

DATABASE / REGISTER

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 226 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2015-001

Organisational Entity:

HRD

Processing Operations:

Staff Appraisal (Update of DPN-2008-007)

Purposes:

Drafting appraisal reports for: - Members of staff in compliance with Article 43 of the SR, mainly used to assess the performance and achievements of the staff member with regards to his/her job description, his/her objectives, the conduct and the personal and career development of the person. The application of the new provisions of Staff Regulations involves processing of personal data for other purposes, specifically, the blocking of the advancement in step in case of an unsatisfactory performance evaluation report. - SNE’s and /or international experts on secondment at OHIM.

Categories of Data:

• administrative data: Full name, personal number, function group, grade, seniority in grade, administrative address, statutory link, working conditions / teleworking (if it applies). • data relating to the job: job assignments, department, position, job profile, data of previous job, starting date in job. • data relating to the appraisal: employee self-assessment, objectives (what was to be accomplished), success criteria or key performance indicators, name of the reporting officer(s) / countersigning officer / appeal assessor, assessment / comments regarding the staff member competencies including conduct in the service, efficiency, abilities, potential to assume another function / other duties and the jobholder’s comments.

Processor: Retention Period:

Electronic word files used for drafting the individual reports (stored on individual PCs of the reporting officers until the report are deemed final) will be deleted by the reporting officers at the conclusion of the annual appraisal exercise. The final report (completed and signed) is stored in the personal file (Allegro/Alfresco) and kept during the same period of retention as for the personal files (8 years after the extension of all rights of the person concerned and of any dependents, and at least 120 years after the birth date of the person concerned). Prolonged period are considered for this document as it is integral part of the jobholder personal file existing in the Office until transfer to another institution, permanent leave or retirement.

Data Subjects:

Staff members( officials, temporary and contract agents), except grades AD16/AD15 and chairpersons and members of the Boards of Appeal. SNE’s and/or international experts on secondment at OHIM.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Data subjects are informed by a Data Protection Statement published on the OHIM Insite, HR Portal, under Appraisals.

Right to Block Data:

Yes. Data subjects may address a written request to the HRD Director for blocking data in the cases foreseen by Article 15 of Regulation N°45/2001.

Right to Erase Data:

Yes. Data subjects may address a written request to the HRD Director for erasing data in the cases foresees by article 16 of Regulation N°45/2001.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

- Article 43 and 44, par. 1 of the SR, Articles 15, par. 2, and Article 20, par. 4 of the CEOS. - Decision of OHIM N°04-10 Rev; - Decision of the Commission C(2013)8995 of 16/12/2013 applied by analogy

Recipients:

Data will only be disclosed to: - the person concerned; - the reporting officer(s) who is(are) in charge of drafting the appraisal report; - the countersigning officer who is in charge of validating the report; - the persons authorized by the reporting/countersigning officers and appeal assessors to assist them in the management of appraisals or probationary reports (ej: assistants, teamleaders); - the members of the Management Committee for harmonisation purposes; - the authorized staff of the HRD in charge of appraisals (ej: assistants, team leaders); - the authorised staff working in Entitlements, Financial Office, and PMO to block the advancement in step/downgrade or dismiss (in case of unsatisfactory appraisal/report). Only the strict necessary information is disclosed; - the IT technician, if need for technical assistance; In case of refusal to accept the report: - the appeal assessor; - the members of the Joint Evaluation and Promotion Committee, only in case of an appeal on the appraisal report; - the case arising, the Legal Service and the Court of Justice; The appraisals of SNE’s/international experts on secondment can be sent to their administration of origin if requested.

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 227 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference:

Ref. 2008-0415

Notification Status:

REGISTERED

Keywords Class:

APPRAISAL

Compliance with R45/2001:

YES

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 228 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2015-002

Organisational Entity:

AB/BC

Processing Operations:

Prevention and management of conflicts of interests for AB/BC members

Purposes:

The management of the declarations of interests is necessary to encourage the highest standards of administration, professional ethics, integrity and independence. It serves to identify and disclose, in a transparent and consistent manner, the handling of situations where potential conflicts of interests may arise to avoid any conflict between the OHIM public duties and any kind of private interest of staff.

Categories of Data:

Personal data of internal and external staff applying to the Prevention and Management of Conflicts of Interests procedure: - Forename/surname of the AB/BC members, alternates, experts and advisers; - Forename/surname of spouse/legally recognised partner/dependent family member and his/her employer/professional position. Interests that are or could be related to the activity of OHIM and which may have a potential impact such as to impair the person’s independence as AB/BC member, alternate, expert or adviser: - Past activities : posts held and professional activities held over the past 2 years (nature of the post, dates, name of the employer, foundation, institution or other organization); - Current activities: posts and professional activities held ( the same data as those required for past activities); - Financial interests: shares/stocks exceeding 50 000€ or equivalent in the capital of companies having an interest related to the OHIM activity and/or assets or any intellectual property rights; - Spouse’s/legally recognized partner’s/dependant family member’s current professional activity and financial interests; - Any other relevant interests that may have a potential impact in the OHIM activities.

Processor: Retention Period:

Data will be kept during a period of 5 years after the end of the mandate.

Data Subjects:

It concerns the examination of declarations provided by the AB/BC members, alternates, experts and advisers.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

- OHIM Guidelines on the Prevention and Management of Conflict of Interests (annex) for AB/BC members, alternates, experts and advisers; - Forms related to the Declarations of Conflict of Interests (annex); - Regulation (EC) N°45/2001 of the European Parliament and of the Council of 18 December 2000; - Specific Privacy Statement for Data Protection related to the processing of data for the Prevention and Management of Conflicts of Interests.

Right to Block Data:

Yes. The person concerned may request to block the data considered to be inaccurate for any of the reasons mentioned in Article 15 of Regulation (EC) No 45/2001, for the time necessary to access their accuracy.

Right to Erase Data:

Yes.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

OHIM’s AB and BC Guidelines on Conflicts of Interests which is based on Community Trade Mark Regulation, Regulation on Community Designs and Regulation on the European Observatory.

Recipients:

- The Chairperson of the AB/BC. In situations covered by point 6 of the Guidelines, the access is given to the Deputy Chairperson or to the longest serving member or to the oldest one; - Access is also given to the authorized persons working in the Secretariat of the AB/BC; - Upon request, the data may also be disclosed to the staff of OLAF and/or to the EU Court of Auditors. The data transferred is limited to what is strictly necessary for managing the requests or official investigations or for audit purposes; - Publication in the Office Website: Guidelines on Prevention and Management of Conflict of interests together with the names of the AB/BC members, alternates, experts and advisers, together with the organization they are representing, as well as the minutes of the AB/BC meetings along with the list of participants.

Transfer to Third Parties Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

PUBLICATION

Compliance with R45/2001: DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 229 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 230 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2015-003

Organisational Entity:

Staff Committee

Processing Operations:

Open space survey

Purposes:

Opinion poll concerning the refurbishment of office spaces

Categories of Data:

Name, department, preferences as regards work environment

Processor: Retention Period:

3 years: mandate of SC

Data Subjects:

Staff members in general

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Specific privacy statement

Right to Block Data:

Data subjects may also under certain circumstances ask from the Controller to have these data blocked and for the erasure of data about them which they consider to have been unlawfully processed.

Right to Erase Data:

Yes

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument: Recipients:

Staff Committee members and DPO for verification purposes, if needed.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY / OFFICE SPACE

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 231 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2015-004

Organisational Entity:

HRD

Processing Operations:

Request of information to OHIM Temporary and Contract Staff

Purposes:

Efficient management of the Workforce planning 2016-2020 following the OHIM communication of 28th October 2014 on recruitment of officials for needs related to support functions.

Categories of Data:

Forename /surname, personal number, reference of EPSO reserve list and its date of validity, administrative status in another Institution/Agency, Function group and grade.

Processor: Retention Period:

For a period no longer than 5 years.

Data Subjects:

OHIM temporary staff members.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

Each data subject is informed by a Data Protection Statement attached to the information note sent to the temporary staff and published in OHIM Insite.

Right to Block Data:

Yes. Data subjects may address a written request to the HRD Director for blocking data in the cases foreseen by Article 15 of Regulation N°45/2001.

Right to Erase Data:

Yes. Data subjects may address a written request to the HRD Director for erasing data in the cases foresees by article 16 of Regulation N°45/2001.

Legal Basis:

Articles 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

Decision ADM N°ADM08-40 implementing Regulation N°45-2001; The provisions of the Staff Regulations and Conditions of employment of other Servants; The administrative decisions related hereto.

Recipients:

The Appointing Authority and the authorized staff of the HRD in charge of processing the data. In case of complaints: The Legal Service / EU Court of Justice. Upon request: internal Audit Service /Court of Auditors / OLAF.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

SURVEY

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 232 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2015-005

Organisational Entity:

ICLAD - International Cooperation

Processing Operations:

Events, meetings, etc, organized by ICLAD

Purposes:

The main purpose of collecting and processing the personal data is to manage the applicant's participation in the event, including the reimbursement of expenses when applicable. In addition, the data may also be used for the following purposes: • to draw up a list of participants which will be distributed at the event; • to publish information about the event; • to enable OHIM to provide to participants further information after the event, which can be related to the event itself or to future events.

Categories of Data:

Name of the participant, title, number of ID/Passport, nationality, address, e-mail addresses, phone and fax numbers, name of organization represented, department and position, travel and accommodation information and invoices and bank accounts (in case of reimbursement of expenses). If it is envisaged that photographs and audio-visual footage of participants will be taken and published thereafter, the participants will be expressly informed in the corresponding Privacy Statement related to the specific event.

Processor:

An external subcontractor acting as processor of the personal data may participate in the organisation activites.

Retention Period:

Personal data will be kept by the International Cooperation Area or its subcontractor(s) exclusively in order to enable OHIM to provide to participants further information after the event or to invite them and manage their participation in future events. It will be deleted if not used for 5 years after the last registration. Participants may at any time opt out if they do not want to receive any further information. When a participant has received any payment from OHIM (e.g. as reimbursement of expenses) the supporting documents will be kept for the time established in OHIM’s financial regulations.

Data Subjects:

All the persons (internal and external) participating in events organized by OHIM – International Cooperation Area.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The attached Privacy statement will be adapted to each specific event and made available to the data subjects, usually through a link in the registration/participation form.

Right to Block Data:

Yes. Data subjects can exercise their rights of blocking of personal data via a specific request as specified in the Privacy Statement.

Right to Erase Data:

Yes. On request of data subjects within a few working days.

Legal Basis:

Article 5(a) and 5(d) of Regulation 45/2001

Legal Instrument:

- Actions in the framework of the Strategic Plan of the OHIM - Article 124-2(a) of Regulation (EC) No 207/2009

Recipients:

Access to data will in principle be restricted to OHIM staff who is personally involved in organizing each event (personnel from the International Cooperation Area and other relevant departments such as Finance or Communication). In case of events organized by OHIM and managed by one or more external subcontractors, the data will also be accessible for specifically authorized staff of the subcontractor(s) which participate in the management of each event, when applicable, subject to the appropriate contractual clauses regarding data protection. The name, nationality and passport ID number of each visitor will also be communicated to the Security services of OHIM, in case of events that take place at OHIM, or to the Security services of other external venues, if applicable, exclusively for access control purposes. A list with the names of the participants, together with other data such as their nationality and the organization to which they belong may be distributed to all participants, in which case it will be expressly mentioned in the Privacy Statement of the specific event. Likewise, if any personal data of participants are going to be made publicly available after the event, the Privacy Statement will specify which data will be published and under which conditions.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

EVENTS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 233 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2015-006

Organisational Entity:

OBS

Processing Operations:

Ideas Powered

Purposes:

Ideas Powered consists in an online competition aimed at developing awareness for the increasing importance of intellectual property.

Categories of Data:

Registering interest The participant needs first to complete the log in / sign up registration process through Facebook, Twitter or www.ideaspowered.com, by entering his/her full name, phone number or email address, password and username, to see photos, comments and Tweets from Ideas Powered. All contributions must be entered via the submission form on the website www.ideaspowered.com.All data requested in the submission form must be provided in full and accurately. Checking eligibility criteria The winners will be required to provide proof of their age (copy of ID card or passport) before receiving the prize as well as a declaration on the honour that they do meet the criteria for participation. They will also be requested to proof that they are the owner of the idea, creation that they have presented in the winning entry. Failure of proving compliance with eligibility criteria will lead to automatic exclusion of the participants. In case of lack of compliance with the eligibility criteria by the winner OHIM reserves the right to either cancel the prize or select another winner. Publication of results The names of the authors of the winning entries shall be announced on the website and shall also feature in relevant press releases related to the development of the initiative

Processor:

The Contractor who delivers hosting services and web maintenance services for the interactive site/on-line platform. The Contractor is selected by a call for tenders. The contract of the external company contains the standard data protection clause which implies to comply with Regulation (EC) No. 45/2001.

Retention Period:

Registered users: Personal data are automatically deleted after ??? months of inactivity. Winners: Personal data will be kept for a maximum period of years after the contest. Published data on the public websites my be preserved for an indefinite period of time.

Data Subjects:

Entitled online participants: EU citizens residing in Europe aged 18 – 24.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

A specific Privacy Statement will be publicly available on the official website of the video contest and in the Facebook interface of ‘Ideas Powered’.

Right to Block Data:

Yes. The data subjects can obtain from the Data Controller the blocking of data.

Right to Erase Data:

Yes. Data subjects may address a written request to the controller for erasing data in the cases foresees by article 16 of Regulation N°45/2001.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

• Regulation (EU) No 386/212 (“entrusting the OHIM with tasks related to the enforcement of intellectual property rights […]”) • The video contest is an action under Line of Action 4 ‘Raising public awareness of IP’ of the Multiannual Plan 2014-2018 of the EU Observatory on Infringements of Intellectual Property Rights.

Recipients:

The responsible team of the Observatory involved in the processing and dealing with participants' accounts and management of the online competition, as well as the contractor. The members of the jury, composed by 2 representatives from OHIM and 3 contributors to the ideas powered web site, as far as winner decision is concerned. The names of the authors of the winning entries shall be announced on the website and shall also feature in relevant press releases related to the development of the initiative.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

CONTEST/COMPETITION

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 234 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2015-007

Organisational Entity:

Academy

Processing Operations:

Organisation and management of events by the Academy

Purposes:

To develop and foster interchange and cooperation in the dissemination of IP knowledge among different audiences through the organization of seminars, trainings and related events aimed to external participants (e.g. national judges, representatives of national IP offices, IP associations and NGOs, INTA, etc.).

Categories of Data:

Name of the participant, title, number of ID/Passport, nationality, address, e-mail address, functional e-mail address of organisation mobile phone numbers, fax number, name of organisation represented, working position, eventual banking information of invited experts or participants' organisation. If it is envisaged that photographs and audiovisual footage of participants will be recorded or published afterwards, the possibility to opt-out could be offered. In this case, before registering for the event, the data subject has to read and accept the Privacy Statement which includes the following sentence: "Photographs and audiovisual footage may be taken during the event and published thereafter. By agreeing to this privacy statement, you also agree to have your photograph and/or audiovisual footage taken and published by the OHIM after the event". For any specific query, the applicants can use the contact information point in the privacy statement.

Processor:

Subcontractor

Retention Period:

Personal data is kept as long as follow-up actions to the event are necessary with regard to the purposes of processing of personal data. All personal data will be deleted at the end of the period of time specified in the privacy statement related to the specific event, after the last action in relation to the event. Nevertheless, personal data linked to the user account created during the first registration are part of a list of contact details filed of the contact data bank of potential participants in subsequent events held by the Academy. They will be deleted if not used for 5 years after the last registration. If data subjects do not agree with this or do not wish to be part of the list of contacts anymore, they may contact the Controller by using the Contact Information as mentioned in the Privacy statement.

Data Subjects:

All the persons (internal and external) invited and participating to the "events"

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The attached Privacy statement is adapted to the event and issued on the relevant page of the OHIM website and available via a link from the registration/participation form. The Controller of each event and his/her contact details shall be clearly mentioned in the appropriate privacy statement.

Right to Block Data:

Yes. On request of data subjects within a few working days

Right to Erase Data:

Yes. On request of data subjects within a few working days

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

- Actions in the framework of the Strategic Plan of the OHIM - Article 124-2(a) of Regulation (EC) No 207/2009

Recipients:

Authorised officials and agents of the Academy and, if applicable, designated employees of the subcontractor for the organization of the event, acting as a processor. Participants of the "event" and a wider public if it is provided that minutes/reports/notices/proceedings/photographs and pictures of groups of participants and organizers are published on Internet. In case of an event organised by both the OHIM and an external company, the external contractor will act as Processor too. In case of in-house events, the Security Service of the OHIM site receive a list of participants for access control and entrance permission purposes. In some exceptional circumstances may be communicated – under confidential obligation - to other OHIM’s departments.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

PENDING NOTIFICATION

Keywords Class:

EVENTS

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 235 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2015-008

Organisational Entity:

OD & CSD

Processing Operations:

Work allocation statistics in OD and CSD (Update of DPN-2005-002)

Purposes:

To enable a fair and allocation of workload. To enable the management of the service.

Categories of Data:

Allocated workload

Processor: Retention Period: Data Subjects:

Staff members of the Formalities Service in OD and CSD

Information to Data Subjects:

Yes

When and Data Subjects are informed: Right to Block Data:

Yes. The data subjects can obtain from the Data Controller the blocking of data.

Right to Erase Data:

Yes. Data subjects may address a written request to the controller for erasing data in the cases foresees by article 16 of Regulation N°45/2001.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

Regulation (EC) No 207/2009 on the CTM

Recipients:

Respective Team Leader, Line Manager, Deputy Director and Department’s Director.

Transfer to Third Parties

NO

Security Measures:

YES

EDPS Reference: Notification Status:

PENDING NOTIFICATION

Keywords Class:

WORK ASSIGNMENT

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 236 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2015-009

Organisational Entity:

CSD

Processing Operations:

RCD-Download

Purposes:

Provide third parties and public authorities with the information they need to enable them to exercise the rights conferred on them by the CDR and to determine the existence of priori rights belonging to third parties (as foreseen in Article 6(2) of Decision No EX-14-3 of The President of OHIM).

Categories of Data:

With regard to persons information, the service supplies the following data if available with regard to a particular RCD: - Designer: o Name, Identifier - Applicants/Owners: o Applicant Identifier, First Name, Middle Name, Last Name o Address, Country Code, Street, City, State, Country, Postal Address - Representative: o Identifier, First Name, Middle Name, Last Name o Representative Type Code (Professional Representative, Lawyer, Association, Employee, Other) o Phone, Fax, Email, URL o Address: Country Code, Street, City, State, Postal Address -Appeals: Appellant ID, Appellant's representative ID, Respondent ID, Respondent's representative ID - Recordals related: Claimant ID, Claimant's Representative ID.

Processor: Retention Period:

For the lifetime of the service provision

Data Subjects:

Individuals whose data have been entered as RCD particulars

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The information about international data transfers related to the particulars of RCD applications, upon requests for bulk data available for download by authorized licensees, will be given in the OHIM general data protection statement on the website.

Right to Block Data:

Yes. Data subjects may address a written request to the Controller for blocking data in the cases foreseen by article 15 of Regulation 45/2001.

Right to Erase Data:

Yes. Data subjects may address a written request to the Controller for erasing data in the cases foreseen by article 16 of Regulation 45/2001.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

• Council Regulation (EC) No 6/2002 of 12 December 2001 on Community designs (CDR). • Article 71 of the Commission Regulation (EC) No 2245/2002 of 21 October 2002 implementing Council Regulation (EC) No 6/2002 on Community designs amended by Commission Regulation (EC) No 876/2007 on 24 July 2007. • Decision No EX-14-3 of The President of OHIM

Recipients:

Outside OHIM: Authorized users, be individuals or public and private entities, as for example, IP rights owners, representatives, IP information providers, National IP Offices, etc, both EU, as well as non EU sited. Inside OHIM: BITD responsible staff

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

DATABASE / REGISTER

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 237 of 238

Office for Harmonization in the Internal Market Trade Marks and Designs Notification Reference

DPN-2015-010

Organisational Entity:

CSD

Processing Operations:

CTM-Download

Purposes:

Provide third parties and public authorities with the information they need to enable them to exercise the rights conferred on them by the CTMR and to determine the existence of priori rights belonging to third parties (as foreseen in Article 6(2) of Decision No EX-14-3 of The President of OHIM).

Categories of Data:

With regard to persons information, the service supplies the following data if available with regard to a particular CTM: - Applicants/Owners: o Applicant Identifier, First Name, Middle Name,Last Name o Address: Country Code, Street, City, State, Country, Postal Address - Representative: o Representative Identifier, Representative Type Code (Professional Representative, Lawyer, Association, Employee, Other) o Representative First Name, Middle Name, Last Name o Phone, Fax, Email, URL o Address: Country Code, Street, City, State, Postcode, Postal Address - Oppositions: Opponent ID, Representative ID - Appeals: Appellant ID, Appellant's representative ID, Respondent ID, Respondent's representative ID - Recordals related: Claimant ID, Claimant's Representative ID.

Processor: Retention Period:

For the lifetime of the service provision

Data Subjects:

Individuals whose data have been entered as RCD particulars.

Information to Data Subjects:

Yes

When and Data Subjects are informed:

The information about international data transfers related to the particulars of CTM applications, upon requests for bulk data available for download by authorized licensees, will be given in the OHIM general data protection statement on the website

Right to Block Data:

Yes. Data subjects may address a written request to the Controller for blocking data in the cases foreseen by article 15 of Regulation 45/2001.

Right to Erase Data:

Yes. Data subjects may address a written request to the Controller for erasing data in the cases foreseen by article 16 of Regulation 45/2001.

Legal Basis:

Article 5(a) of Regulation 45/2001 (“processing is necessary for the performance of a task carried out […]”)

Legal Instrument:

• Council Regulation (EC) No 207/2009 of 26 February 2009 on the Community trade mark (CTMR). • Rule 87 Commission Regulation (EC) No 2868/95 of 13 December 1995 implementing Council Regulation (EC) No 40/94 on the Community trade mark. • Decision No EX-14-3 of The President of OHIM.

Recipients:

Outside OHIM: Authorized users, be individuals or public and private entities, as for example, IP rights owners, representatives, IP information providers, National IP Offices, etc, both EU, as well as non EU sited. Inside OHIM: BITD responsible staff.

Transfer to Third Parties

YES

Security Measures:

YES

EDPS Reference: Notification Status:

REGISTERED

Keywords Class:

DATABASE / REGISTER

Compliance with R45/2001:

DATA PROTECTION REGISTER Last updated: 01/07/2015

Page 238 of 238