To engage with substantive law, I participated in rotations in the Trademarks and Opposition Board (TMOB), the Patent Appeal Board, the Trademarks Branch, and the Patent Branch. While at the TMOB, I worked with a Hearing Officer at the Trademarks Opposition Board (TMOB) to draft section 45 (expungement) decisions. I enjoyed reviewing the evidence before me and discussing how the law applied to the facts at hand. Through this process, I learned a great deal about how to write concisely, and how to marshal facts to support a conclusion. At the Patent Appeal Board, I discussed the patent examination and appeal process, Patented Medicines (Notice of Compliance) [PM(NOC)] Regulations and litigation in Federal Court surrounding PM(NOC)s. I conducted a review of Supreme Court decisions and how they might change office practices at the Patent Branch and Patent Appeal Board. At each of the Trademarks Branch and at the Patent Branch, I was able to follow an Examiner as she walked me through the full lifecycle of a patent and trademark application at CIPO.

During policy rotations, I worked with the Copyright and Industrial Design (CID) Branch, the Information Branch, and the Policy, International and Research Office (PIRO). While with CID, I researched the possible policy implications of 3D printing. I was also able to observe bilateral meetings between the Canadian Copyright and Industrial Design office and its Japanese counterpart to learn about Japan’s accession to the Hague Agreement. At PIRO, I conducted research on the accessibility and availability of information on CIPO’s patent database from the perspective of a new user. I also conducted a comparative analysis of the patent databases of the intellectual property offices of the United Kingdom, Europe, Australia, and the United States. In a final memorandum, I provided suggestions to improve the functionality of CIPO’s database. These suggestions support CIPO’s goal of increasing the transparency of CIPO’s information offerings, maximizing opportunities for innovative research, and lowering transaction costs for innovators and small businesses.

Overall, it was a great privilege to spend my time at CIPO conducting instructive, thought-provoking, and challenging research while being surrounded by people who were genuinely friendly and passionate about their work.

Lisa Hartman is a JD Candidate at Osgoode Hall Law School and was enrolled in Osgoode’s Intellectual Property Law Intensive Program. As part of the program requirements, students were asked to write a reflective blog on their internship experience.

The post IP Intensive: Ottawa - The Best of Both Worlds appeared first on IPOsgoode.

Background

In 1998, the European Commission’s went into effect, which prohibited transferring personal data of EU citizens to jurisdictions outside the European Economic Area that did not have “adequate” levels of data protection. To ensure that data could be transmitted from Europe to the US, the US Department of Commerce and European Commission developed the , which allowed US companies to self-certify that they adhere to seven principles and fifteen frequently asked questions outlined in the Directive, and thus have adequate levels of data protection.

Only US companies that are subject to the Federal Trade Commission (FTC) or Department of Transportation (DOT) are eligible for the Safe Harbour program. Therefore, financial institutions, telecommunication common carriers, labour associations, and non-profit organizations are generally excluded, and are subject to other data protection requirements.

Court of Justice of the European Union’s Decision

The European Court of Justice (ECJ), the highest court in the European Union on matters of European law, that European Commission decision 2000/520, which approved the Safe Harbour framework, is invalid. The ECJ also found that national Data Protection Authorities have the ability to investigate whether countries outside the EU have sufficient levels of data protection, even after the European Commission has issued a decision.

Maximillian Schrems, an Austrian citizen, challenged Facebook’s transfer of his personal data from Facebook’s Irish subsidiary to the US before the Irish Data Protection Authority. He argued that because Facebook stored personal data in the US, that personal data could be accessed by the US intelligence services such as the National Security Agency (NSA), thus it was not afforded adequate protection as defined by the Directive on Data Protection.

After the Irish Data Protection Authority refused to hear the claim, Mr. Schrems brought the action to the Irish High Court. The High Court stayed the proceedings and referred the matter to the ECJ.

The ECJ that, despite the Safe Harbour program, “United States authorities were able to access the personal data transferred from the Member States to the United States and process it in a way incompatible, in particular, with the purposes for which it was transferred, beyond what was strictly necessary and proportionate to the protection of national security.” The ECJ also found that EU citizens do not have legal remedies to correct or delete their data. Therefore, the ECJ found that the Safe Habour program does not provide the level of protection of fundamental rights that are equivalent to those guaranteed by the .

What Now?

The Irish Data Protection Authority is now required to examine Mr. Schrems’ complaint and determine whether transfer of the data of Facebook’s European subscribers to the United States should be suspended.

The US Department of Commerce acknowledges the ECJ’s decision, but has indicated that it will US businesses that wish to participate in the Safe Harbour program in view of the “current rapidly changing environment”.

Companies such as have expressed that they will continue operating as usual, arguing that their privacy and data protection policies are compliant with the Directive on Data Protection. In addition to certifying with the Safe Harbour program, some companies have put in place additional safeguards such as to govern the transfer of data outside the European Economic Area.

Canada’s data protection laws provide adequate protection as defined by the Directive on Data Protection; Canadian businesses’ operations with the EU are not affected (See Cassels Brock ).

Analysis

Although protection of personal information is undeniably a laudable goal, invalidating frameworks that govern international transfer of data does not achieve that end. Without international frameworks, companies that collect, use, and transfer personal information will be pushed to store data within national borders to ensure compliance with domestic legislation. Although technically possible, this hampers the free and efficient flow of data and commerce. Citizens of every country should have easy access to the global economy and international flow of information.

International frameworks with stronger oversight and enforcement mechanisms should be enacted that create a balance between protection of personal information and the global nature of today’s economy. If courts are worried about protection of personal information, they should turn their minds to intelligence agencies or companies that misappropriate data about individuals, not frameworks that aim to protect personal information.

Lisa Hartman is a JD Candidate at Osgoode Hall Law School and is enrolled in Osgoode’s Intellectual Property Law Intensive Program. As part of the program requirements, students were asked to write a blog on a topic of their choice.

The post US: Safe Harbour No Longer appeared first on IPOsgoode.