To mark the 20th anniversary of the EU Trademark and Design Court,

Last week, we examined the evolution of this court. To continue this commemorative series, this week we will take a closer look at the achievements made possible by its specialization.

Over the years, the Alicante court system has established a solid body of judicial doctrine that has influenced European case law. In this article, we will explore how specialization has enabled the court to successfully handle complex cases and establish itself as a leading authority in this field.

Judicial Specialization: A Tangible Reality

Twenty years later, it is clear that the dream of judicial specialization in European Union trademarks and designs has become a tangible reality. The development of case law by the Spanish courts has gone hand in hand, it must be said, with the prolific activity of the Court of Justice of the European Union, which issues about twenty rulings a year, primarily on trademark matters.

But our court has also played a part in this. Of the 27 preliminary rulings requested by Spanish courts, 6 came from Alicante. And some, such as theCynologiqueruling,which put an end to registration immunity, have set new directions for litigation.

The Achievements and Progress of the EU Trademark and Design Court

This specialization we are referring to is evident in theease withwhich Spanish courts today issue rulings that were once almost unthinkable: preliminary injunctions against online infringements, which involve the blocking of websites; the interplay of the principles of good faith or abuse of rights, or the doctrine of estoppel in infringement or nullity actions; and the awarding of damages that, while not punitive, at least provide real satisfaction to the plaintiff—to name a few examples.

It is not surprising that the number of cases before this court remains high. According to statistics from the General Council of the Judiciary (CGPJ), nearly one hundred cases were filed in 2023 with the Courts of Alicante regarding Community trademarks. 

Despite its achievements, new challenges have arisen for this court, which, despite its years of experience, seems to be constantly put to the test. Its ability to adapt and evolve in the face of these challenges will be crucial to maintaining its status as a leader in the protection of industrial property rights in Europe.

We will discuss the court's new challenges in our next issue.

María Cadarso, Associate in the Litigation Department at ELZABURU  

In light of the recent anniversary of the EU Trademark and Design Court, in this first installment we explore how the decision to establish this court in Alicante came about.

In this second installment, we will analyze the many changes the Court has undergone during its 20 years of existence. We will examine how it has evolved in terms of both its structure and its jurisdiction, and how it has established itself as a leading authority in the protection of industrial property rights in Europe.

Changes to the Court's Name and Structure: A Continuous Evolution

Over the past twenty years, the Alicante court specializing in trademarks and designs has undergone continuous evolution, evident in three key areas.

First, its name has changed several times. Initially known as the Community Trademark Court, it was renamed the European Union Trademark and Design Court, and more recently, the term “European Union Trademark Court of First Instance” has come into use.

These are not merely cosmetic changes; the latter name suggests a collegial approach by the courts with jurisdiction over the matter, similar to the Barcelona Patent Court of First Instance.

The Expansion of the Court: Creation of New Specialized Bodies

Another significant development is the expansion of the court system. While initially only Commercial Court No. 1 in Alicante had jurisdiction over disputes involving European Union trademarks and designs, Commercial Court No. 2 soon assumed these functions, and more recently, the newly created Commercial Court No. 4, also in Alicante. Only Commercial Court No. 3, located in Elche, has been excluded from this specialized jurisdiction.

This proliferation of courts may require a certain degree of collegial or coordinated action to prevent inconsistencies—both procedural and substantive—despite how unusual this may seem in the organization of the trial courts.

Expansion of Jurisdiction: New Frontiers in Jurisdiction

Jurisdiction has been the third area in which the Court has shown significant evolution. Since its inception, one of the most significant debates in litigation practice has been the scope of the jurisdiction of the European Union Trademark and Design Court. Originally limited to actions for infringement of European Union trademarks or designs, this restrictive approach was soon replaced by the application of the procedural principle of vis atractiva. This allowed the Court to hear actions for the invalidation of corporate names, infringement of national trademarks in conjunction with European Union trademarks, and copyright actions related to European Union trademarks.

This interpretation was subsequently endorsed by the legislature, which transformed what were initially jurisprudential criteria into statutory criteria. An example of this is the recent Organic Law 7/2022, which amended Article 86 quinquies of the LOPJ. This development has allowed the court to focus on what is truly essential: the development of a solid body of judicial doctrine.

In our next installment, we'll take a closer look at the achievements made possible by this specialization.

Ana Sanz, Associate Partner in the Litigation Practice Group at ELZABURU  

Violating the trade secrets of U.S. companies could land you in U.S. court  

The U.S. Court of Appeals for the Seventh Circuit recently issued a ruling in a case involving the misappropriation of trade secrets under the Defend Trade Secrets Act (DTSA), which will have implications for transatlantic trade relations.

The case involves the U.S. company Motorola, which sued the Chinese company Hytera, alleging that Hytera misappropriated trade secrets through illegal means to develop products nearly identical to Motorola's.

Much of the misappropriation of these trade secrets took place between 2010 and 2014, but after the DTSA went into effect in 2017, Motorola filed a lawsuit against Hytera for that misappropriation, seeking substantial damages.

The extraterritorial application of the DTSA extends its legal reach beyond the United States

So far, this case is not very different from other cases that have been and continue to be brought in the United States regarding trade secrets. But what is significant about this case is that the court has awarded damages not only for those incurred in the U.S., but also—and primarily—for infringing activities carried out outside the country.

The court finds that there is a possibility of extraterritorial application of the DTSA, which extends its legal reach beyond U.S. borders. It interprets the statute as leaving this possibility open in several scenarios, such as “acts in furtherance,” which are acts that contribute to the commission of other unlawful acts and are considered a single offense.

Once an “act in furtherance” has been performed in the United States, all acts related to and directed toward the same purpose—even if performed outside the United States—have an effect within that territory and give rise to the jurisdiction of its courts.

A ruling that could affect Spanish companies

This ruling is crucial for Spanish companies that do business with U.S. companies or operate in global markets. From now on, there is a risk that, in the event of disputes over trade secrets or business secrets, U.S. companies may prefer to litigate in their own courts. By arguing that there is a connection between activities carried out both inside and outside the United States, they could attempt to extend their jurisdiction globally.

The United States has a robust and sophisticated legal framework for the protection of trade secrets and business secrets, supported by extensive case law and regulations at both the state and federal levels. Therefore, facing litigation in a U.S. court is not a particularly desirable situation for a Spanish company.

Is the ruling appropriate? To reach a conclusion on this matter, one must consider the circumstances of the case; however, if there is a breach of trade secrets with global implications, is it necessary to travel to different countries and file lawsuits in as many courts to seek a declaration of infringement and claim damages? It may not be necessary; the court finds sufficient grounds in the text of the DTSA to establish jurisdiction.

A ruling that sets an important precedent

Will this be an isolated case? I don't think so. Once the extraterritorial effect of the DTSA is established, there will be new cases, as U.S. companies will find it more appealing to play on their home turf than to have to venture onto other fields. In fact, there are already law firms recommending that this possibility be considered.

Will this affect Spanish companies? Without a doubt—you don’t have to be Chinese for an American company to sue you. This will happen when the same circumstances as in the Motorola case arise, but even in less serious and blatant situations. The ruling sets a precedent that will extend to other cases; reading it gives a glimpse of this possible future.

How to Manage Trade Secrets: Prevention Is the Best Defense

For Spanish companies, this ruling underscores the importance of handling any trade secrets or business secrets received from international partners—especially U.S. companies—with the utmost care. Even if the acquisition of these secrets is legal, mishandling or improper management could result in serious legal consequences under the DTSA.

The best defense is prevention: implement a robust trade secret management plan and follow it meticulously. This approach not only protects the company from potential litigation but also strengthens its position in the global market.

With the recent ruling in the Motorola v. Hytera case, the legal landscape is changing. Companies must be prepared for an environment in which the protection of tradesecrets and business secrets requires greater attention and care than ever before. Adapting to these new legal realities will be key to avoiding disputes and maintaining healthy and productive business relationships on the international stage.

Javier Fernández-Lasquetty, Partner in the Business and Contracts Practice at ELZABURU  

September 1 marks the 20th anniversary of the launch of the European Union Trademark and Design Court, based in Alicante.

At ELZABURU, we have been closely involved in the launch of this judicial body, where we have been active from the very beginning. For this reason, we will be celebrating its anniversary throughout the month of September with a series of articles that will allow us to look back on its development, achievements, and the challenges it currently faces.

We invite you to join us on this journey.

The Origin and Evolution of the Court

How do you measure the maturity of a court? Is it simply a matter ofage?Should we heed the famous tango and think thattwenty years are nothing?

Two decades have passed since the launch, on September 1, 2004, of the European Union Trademark and Design Court and the court of the same name within the Provincial Court of Alicante. To say the least, during that time the new judicial body has not only grown (in scope and number of cases) but has alsoexpanded(in the number of courts) and is now in more than reasonable shape (thanks to the prestige earned through its rulings). 

It’s not all sunshine and roses, of course. In any journey, it’s impossible to avoidthe occasionalshadow. But overall, as we’ll try to highlight, we’re dealing with a newly established jurisdiction that has achieved a remarkable level of specialization and represents a very viable option for industry and business when it comes to litigation. 

Specialization as the Key to the Success of the Trademark and Design Court in Alicante

Much of the success of this unique jurisdiction is due to the decision made by the Spanish authorities at the time to establish a single court, based in Alicante, to hear cases arising from Regulation 40/94 on the Community trademark. It was not the only option the new regulation offered to Member States, but concentrating these cases in Alicante was consistent with the location of the then Office for Harmonization in the Internal Market (OHIM) in that city and ensured faster and more effective specialization.

The startingpointwas none other than the 2003 insolvency reform, with the amendment of Articles 86 bis cuatri and 82.4 of the Organic Law on the Judiciary by Organic Law 8/2003; but thegoalwas achieved with Royal Decree 1649/2004, dated July 9. This was the regulation that designated Commercial Court No. 1 of Alicante to serve as the Community Trademark Court and did the same for the appellate level with the Eighth Section of the Provincial Court of Alicante.

Rafael Fuentes Devesa and Enrique García Chamón: Pioneering Judges of the Court

Those who tookup the causeof establishing a new jurisdiction at that time were Mr. Rafael Fuentes Devesa, who was in charge of Commercial Court No. 1, and Mr. Enrique García Chamón, president of the Eighth Division.

Both judges, who still share a courtroom, have left an indelible mark on the development of this judicial body.

The International Reach of the Alicante Trademark Court

However, this court’s decision was nonetheless a risky one. The Community trademark system (a newly created title with a single registration and effects throughout the European Union) had come into effect with the first applications in 1996, and judicial involvement was key to assessing the impact of this new instrument.

Not surprisingly, depending on the chosen jurisdiction criterion, the system provides for a Spanish court to extend its jurisdiction to the entire European Union, since its judgments are enforceable in all other countries.

The truth is that, in a short time, the court inspired such confidence that there was a clearshiftin trademark litigation toward Alicante.

But he still had a long way to go… We’ll save the rest of his story for the next installment.

Enrique Armijo, Partner in the Litigation Practice Group at ELZABURU  

In an effort by lawmakers to bring Spain’s legal framework up to date with the new dynamics of the audiovisual market—which has been significantly affected by technological advancements and the emergence of new players— Royal Decree 444/2024 (“RD”) came into effect on May 2; it was approved on April 30 by the Council of Ministers and regulates the requirements for determining who qualifies as a “user of special relevance” on video-sharing platforms, also known as influencers.

The regulation also aims to align with Directive (EU) 2018/1808, which, while not explicitly including influencers, gave Member States the freedom to regulate this category, recognizing their growing importance in the dissemination of audiovisual and advertising content. This inclusion seeks to ensure, among other things, the protection of users—especially minors—from content that is potentially harmful and could affect their physical, mental, or moral development.

Specifically, the Royal Decree states that individuals or legal entities that use video-sharing services and meet the requirements set forth in Article 94.2 of Law 13/2022 of July 7, the General Law on Audiovisual Communication, are considered users of particular significance; therefore, the rights and obligations under this regulation apply to these entities.

Criteria for Being Considered an Influencer

Among the criteria for being considered a user of special significance are, first, that annual gross income be equal to or greater than 300,000 euros in the previous calendar year, derived exclusively from the users’ activity across all video-sharing services on the platforms they use. Additionally, they must have a substantial audience on the platforms, a requirement that is deemed met when, in the previous calendar year, they reached 1 million followers on a single video-sharing platform or 2 million followers across all platforms, and the user has posted or shared 24 or more videos per year.

These users must register with the State Registry of Audiovisual Communication Service Providers within two months of the Royal Decree taking effect. In this way, their obligations are brought into line with those of other audiovisual operators.

In summary, the Royal Decree is an important step toward modern regulation of the audiovisual market in our country, addressing the challenges and opportunities presented by the digital age and ensuring that both new and traditional market players fulfill their responsibilities by protecting the general public from content that promotes violence, pornography, terrorism, or hate, complying with regulations on the broadcast of commercial audiovisual material they advertise, and ensuring the protection of minors and limiting their exposure to content that could negatively affect their physical, moral, or mental development.

Inés de Casas, Senior Associate at ELZABURU

The European Data Protection Board has finally weighed in on the controversy surroundingthe“pay or OK” policyintroduced in Europe last yearbyMeta, the company that owns Facebook and Instagram.

The Committee, known by the acronym EDPB, concludes that the procedure used by the tech giant in an attempt to comply with the General Data Protection Regulation (GDPR) is invalid.

First of all, it should be clear that this is neither a court decision nor new legislation, nor is it a binding resolution. What the EDPB has issued is an opinion in which, at the request of several European data protection authorities, it provides its interpretation of how “pay or ok” fits within data protection legislation.

However, the impact could be significant, especially for large platforms that, until recently, allowed access to their content completely free of charge. This is because, in practice, the EDPB report establishes as a general rule that paying a fee (whether a one-time payment or a subscription) cannot be offered as the sole alternative to cookies.

Thus, platforms that maintain the pure “pay or ok” model, without additional options, will be required to demonstrate that the system they have adopted does not force their users to accept cookies, but rather that users consent to them of their own free will—and this, given the assumptions contained in the EDPB’s opinion, is extremely complicated, if not impossible.

It is not new legislation, but the ruling must be taken into consideration

It is important to note that the EDPB is not issuing a ruling specifically and individually regarding Meta, even though that is the case underlying its opinion; however, this opinion must be taken into account not only by Meta but by all major web platforms.

Cookie legislation requires that cookies that are not strictly necessary for the website to function must be expressly consented to by users in order to be enabled. Among these cookies are behavioral advertising cookies, which are used to profile users in order to later target them with advertisements. And the consent that users provide must be given of their own free will.

A large part of the business of major platforms is based on selling brands the ability to target their advertising at users who, based on their profile, are more likely to purchase their products or services. But profiling as invasive as that carried out by many platforms—whether through cookies or any other system—requires user consent, and the EDPB understands, in essence, that if the only alternative to such consent is to pay a fee, it must be presumed that the consent is not freely given—especially if the fee is disproportionate and if the platform had previously offered its content or services for free for a long time.

Furthermore, it should be noted that the “pay or ok” approach also violates one of the conditions for valid consent, namely that consent must be specific to the particular data processing in question. If users’ consent is required both to track and profile them and to subsequently serve them advertisements, both types of consent should be requested separately rather than as a single, blanket consent, as is the case with Meta’s “pay or ok” system and others.

Among the possible solutions, the Committee suggests using “random” advertising

If Meta wanted to comply with the EDPB’s interpretation, it seems clear that it should avoid offering payment as the only alternative to profiling and behavioral advertising. The EDPB itself suggests, in addition to setting non-excessive amounts for the payment option, that companies also offer the alternative of “random” advertising or advertising that is less invasive of users’ privacy.

For example, by letting users themselves select, from a closed list of options, their interests or the topics for which they would like to see promotions and advertisements.

One possible solution would be for users to be able to choose from several options, such as: a) an ad-free payment plan, b) a free plan with ads tailored to the user’s preferences, c) a free plan with “random” ads without any profiling, and d) a free plan with behavioral advertising cookies.

Each of these options could entail some differences in terms of service provision or platform use, but in essence they should be equivalent so that the user does not feel compelled to choose just one of them, as doing so would otherwise cause unjustified or disproportionate harm. Furthermore, for any other cookies that also require user consent, such consent should be obtained separately.

However, the platforms—which understand their business and their users—will likely find other solutions or different models that are in line with the EDPB’s position. In some cases, it may be sufficient to lower the price charged, while in others, it may be necessary to adopt alternatives accompanied by some form of compensation or additional benefit for the user. However, the latter must be evaluated very carefully, bearing in mind that the EDPB also states that personal data cannot be used as a bargaining chip.

The Committee provides guidance on evaluating the criteria for informed, specific, and unambiguous consent that major online platforms must take into account when implementing “consent or pay” models

In addition to this opinion, the EDPB also announced that it will develop guidelines on “consent or compensation” models with a broader scope and will collaborate with stakeholders on these upcoming guidelines.

Ruth Benito, Of Counsel for Data Protection and Privacy at ELZABURU

The annual Mobile World Congress, the world's largest mobile phone and technology trade show, is fast approaching. As usual, the event will take place at the Fira de Barcelona exhibition center over four days, beginning on Monday, February 26, and ending on Thursday, February 29.

Given that more than 2,000 leading companies in the fields of information technology, electronics, and telecommunications participate in this conference—showcasing new telecommunications products, mobile applications, and software innovations to a global audience—the Mobile World Congress becomes, year after year, a setting prone to potential conflicts between companies, primarily due to possible infringements of intellectual and industrial property rights.

For this reason, for several years now, the Commercial Court of Barcelona, as well as the EU Trademark Court in Alicante, have implemented an On-Call and Rapid Response Protocol. This protocol serves the dual purpose of avoiding, to the extent possible, the adoption of interim measures without a hearing for the defendant and, at the same time, implementing effective measures to protect those rights.

Under this Protocol, the courts undertake to rule on the admissibility of requests forpreliminary orders(intended to prevent the adoption of interim measures without a hearing of the defendant) on the same day they are filed (within 24 hours). In addition, they undertake to rule on requests forprecautionary measureswithin 2 days (48 hours), scheduling a hearing within 10 days if apreventive brief has been filed.

The Protocol will take effect on February 1 and will remain in effect throughout the month of February until the last day of the conference, February 29.

The report on the implementation of the Protocol, published by the courts of Barcelona and Alicante regarding the 2023 Mobile World Congress, revealed that the overall number of cases filed that year was the highest in the past four years. This demonstrated a clear recovery in the volume and number of cases filed compared to the years prior to the pandemic, a growing trend that the report forecasts will continue for the upcoming 2024 Mobile World Congress.

Now is the time for companies participating in the Mobile World Congress to plan ahead and take the necessary steps to ensure the protection of their rights and avoid potential setbacks during the event.

ELZABURU has played a significant role, participating in approximately 25% of the cases resolved by the courts under the Mobile World Congress Protocol over the past 6 years. This year, the firm will once again provide support to its clients by implementing measures both to effectively safeguard their industrial and intellectual property rights and to mitigate any risk of unexpected actions by third parties that could jeopardize their normal participation in the upcoming congress.

María Cadarso, Associate at ELZABURU

As part of this series, we now turn our attention to Spain, delving into the complexities of trademark protection challenges and the best solutions at the country’s borders and points of entry.

Juan José Caselles, Head of the Anti-Counterfeiting Department at Elzaburu, shares his insights on fostering effective collaboration with customs officials at Spanish border crossings and ports. He then provides a comprehensive guide to successfully monitoring and enforcing measures against counterfeit and gray-market products in the marketplace.

Can rights holders register information about trademarks and intellectual property with customs authorities, and if so, how?

In Spain, as throughout the EU, Regulation (EU) No. 608/2013 on customs measures to protect intellectual property rights applies. The application for customs intervention (AFA) is filed with the Department of Customs and Excise of the Tax Agency, using the form provided in the aforementioned EU Regulation. It can be submitted online using an electronic signature. In this application, the applicant may select all or only some of the EU countries in which customs protection is sought and designate representatives in each country for notification purposes. Currently, no administrative fees are required. The applicant for customs intervention in the country of origin may make any changes to the application by updating the information.

In addition to trademark registrations, can copyright registrations be filed with customs?

The latest amendment to Regulation (EU) No. 608/2013 provides for the protection of all intellectual property (IP) rights, including trademarks, copyrights, patents, designs, geographical indications, and plant varieties. The only difference among all these IP rights is the different methods of proving their existence or registration; any reliable means of proving the asserted right is valid. In addition, the right invoked must have EU-wide scope. If the right has only national scope, the AFA must be requested with coverage for the Member States in which it is valid.

Can trademark owners provide customs officials with a product information guide or any other supplementary materials to help them identify genuine products?

The more information provided to customs authorities, the more effective the monitoring will be. The information required on the application form includes: specific and technical details about the genuine products, including marking elements such as barcodes and images where applicable; the information necessary for customs authorities to easily identify the products in question; and information relevant to the customs authorities’ analysis and assessment of the risk of infringement of the intellectual property right or rights in question, such as authorized distributors. At least in Spain, the AFA and all information provided must be in digital format. This ensures that all customs officials have access to the same information and can communicate with authorities in other EU countries.

What is the standard procedure for seizure or further investigation if customs officials identify potentially counterfeit products?

Customs officials review the shipment’s documentation and assess risks from various perspectives, such as the country of origin, the route taken, the declared value of the goods, and the importer. If they need more information, they request it from the person declaring the shipment. When customs officials detect a suspicious shipment, they detain it.

How are trademark owners typically contacted when suspicious or counterfeit products are identified?

Once the shipment is officially detained, the party subject to the customs protective measures is notified and given 10 days to inspect the products. These actions may include requesting the destruction of these counterfeit products and, if the importer refuses to destroy them, filing civil or criminal charges within the same 10-day period. If these actions are not taken within the deadline, the shipment will be released.

Are there any time-sensitive factors that trademark owners should take into account regarding the protection of IP rights at customs?

All actions must be taken within the aforementioned 10-day period. Although an extension may be requested, there are no specific rules governing whether it will be granted; therefore, it is at the discretion of each customs office. Because this is a short timeframe, IP rights holders must act as quickly as possible in the event of a detention.

What are the potential costs of working with customs officials to protect a brand's intellectual property?

The party responsible for the customs intervention must bear the costs associated with the detention, such as the costs of storing and destroying the detained goods. In addition, they must also cover the costs of translations into certain EU languages. Currently, no fees are required to be paid to the customs administration. This fee-free policy was a practice adopted by Spanish customs authorities that eventually spread to the rest of the EU. It is essential to proceed with destruction as soon as possible to save on storage costs.

Can you provide examples of successful collaborations between international companies and customs authorities that have yielded tangible results?

Of particular note are Operation Fake Star and other joint international EMPACT operations. To this end, the private sector used IPEP’s alert and “cases of interest” features to share relevant information with the various competent authorities, while the authorities could request data from the private sector by submitting “suspicious cases.”

Meanwhile, the European Commission has just published the results of customs seizures in the EU for 2022. In terms of both the number of items seized and their estimated value, the top six Member States accounted for nearly 97% of all seizures in the internal market in 2022. Italy tops the ranking with more than 63% of the total number of items seized and nearly 55% of the total estimated value. Spain, France, the Netherlands, and Hungary also rank among the top six in both the number of items and the estimated value of seizures, while Bulgaria and Greece round out the ranking in terms of the number of items seized and estimated value, respectively.

What proactive strategies can trademark owners use to improve their collaboration with customs officials?

Close collaboration between customs authorities and rights holders, as well as the quality of the information provided by rights holders in their communications, are of the utmost importance for risk assessment in the area of intellectual property rights protection.

The first step is to request customs protection in the EU by appointing a representative in each country who has extensive experience in these matters and maintains excellent relations with the authorities. In addition, the information provided to customs must be kept up to date. If we have information—as detailed as possible—about the upcoming arrival of a suspicious shipment in Spain or another EU country, we recommend using the “red alert” mechanism so that the shipment is physically inspected upon arrival. Another very useful measure is to conduct training sessions for customs officials on how to identify infringements of the rights of IP-holding companies. Finally, since the ultimate goal is to locate the manufacturing site of counterfeit products, the customs information obtained must be analyzed intelligently, cross-referencing data and conducting investigations in the country of origin.

Juan José Caselles, Associate Partner at ELZABURU

Originally published on WTR on December 8, 2023.

On November 24, the Spanish Data Protection Agency (AEPD) published its Guide on Attendance Tracking Using Biometric Systems. The truth is that, following several reports and guidelines from other supervisory authorities, the sector was eagerly awaiting the Agency’s definitive stance, as it had not previously issued such a comprehensive opinion on these processing activities. Specifically, we are referring to time-and-attendance systems (clocking in) and access control systems using biometric identification (such as clocking in with a fingerprint or gaining access via facial recognition, etc.).

The truth is that, after learning of the AEPD’s opinion, many would surely have preferred that it had not weighed in on the matter. The fact is that this guide is a direct blow to the very foundation of biometric identification systems in general, and particularly to attendance and access controls in the workplace. In it, the AEPD revises some of its previous criteria on the matter and clarifies some of the essential requirements that must be met when processing data.

We could oversimplify things and just say that, as of now, such activities cannot be carried out. But, even if only by a very small margin, that’s not exactly the case, so below we’ll outline the most important points from the Agency’s new guide. We promise to focus on what matters and explain it as simply as possible.

The General Data Protection Regulation (GDPR) generally prohibits the processing of special category data, which may be processed only in exceptional cases if any of the circumstances provided for in the Regulation itself apply. Biometric data constitutes special-category data when used to“uniquely identify a natural person.” Based on this mathematical concept of “uniqueness” associated with the purpose of identification, it appears that the AEPD initially interpreted that, if biometric data were used for identification purposes, it would be considered special-category data, but not if it were used in authentication systems. We will not delve further into this point, given that the European Data Protection Board has already clarified that, ultimately and to put it very simply, if an authentication process requires identification or if identification occurs simultaneously, the biometric data is being used to identify a specific natural person—and that is what matters in determining whether special-category data is being processed. This is one of the reassessments now being made by the AEPD.

It is therefore no longer possible to argue that what takes place during a time-and-attendance check or an access control check is authentication rather than identification, since it amounts to the same thing.

It is therefore necessary to determine whether the prohibition on the processing of biometric data can be waived under any of the exceptions set forth in the GDPR. Among the scenarios outlined in the Regulation for the processing of special-category data, only the following two would apply for the purposes discussed here:

• If the employees' consent has been obtained, which must be informed and given unequivocally, specifically, and freely.

• If necessary to fulfill obligations or exercise rights under labor law and social security and social protection laws. Note, however, that this is subject to authorization by a European or national regulation or a collective bargaining agreement that establishes adequate safeguards for the rights and interests—in this case, those of employees.

Limitations

And this is where the story starts to turn into such a horror movie that it puts “The Exorcist” or the entire “Saw” series to shame. Why? Because in this new guide, the AEPD practically, practically, practically shuts the door tight on these two options:

• I previously understood that these processing activities could be justified by the existence of a legal provision that addressed them: Article 20.3 of the Workers’ Statute regarding access control and Article 34.9 regarding time tracking, attendance monitoring, or clocking in for the workday—whatever we choose to call it. Now, echoing the position of other data protection supervisory authorities, it has revised its stance and determined that those articles are insufficient because they do not expressly mention the processing of biometric data and because they do not include the safeguards that must be applied to protect employees’ privacy.

• It also states that consent cannot serve as a legal basis for such processing either, since in an employer-employee relationship it must be presumed that the employee will not freely give consent, given the company’s dominant position.

• Even if free consent were possible, this would imply that an alternative must be provided for those employees who do not consent to the processing of their biometric data; and if that alternative is less invasive of employees’ privacy, this implies that the processing of biometric data is not indispensable and, therefore, pursuant to the principle of data minimization (not processing data that is not strictly necessary), it is not proportionate and cannot be carried out.

Conclusion: It becomes extremely difficult, if not impossible, to rely on biometric identification systems for these purposes within the company.

Is there no solution? We very much fear that, as long as there is no European or Spanish regulation specifically governing these biometric checks, the only way to process this type of data in the workplace is to negotiate it and expressly include it in a collective bargaining agreement, along with the safeguards that companies must implement when adopting these systems to ensure their employees’ rights.

Furthermore, if—with a great deal of luck—you manage to overcome this first hurdle, you would then have to meet the rest of the requirements set forth by the AEPD in this guide. And be warned: these requirements are neither few in number nor easy to meet, and they extend to other possible uses of biometric data outside the workplace.

So, if by any chance lawmakers were to decide to regulate these biometric control systems, please—while they’re at it—don’t skip the data protection impact assessment process, as that will ultimately save companies money when it comes to adopting these systems.

Ruth Benito Martín, of Counsel at ELZABURU

Today, as on every June 8, we celebrate World Anti-Counterfeiting Day—the perfect occasion to discuss the harm caused by this scourge.

In Spain, there is a tendency to think that counterfeits are always associated with luxury products from large global companies, but the reality is quite different. The sale of counterfeit goods poses a serious socioeconomic risk worldwide. As shown in the latest report published by the EUIPO and the OECD in January of this year, titled“Risks of Illicit Trade in Counterfeit Goods for Small and Medium-Sized Enterprises,” SMEs whose intellectual property is infringed are 34% less likely to survive after five years.

Product counterfeiting threatens a large number of industries. Counterfeit goods can be found in everyday consumer products, such as clothing, as well as in luxury items. In addition to economic damage, counterfeit goods often pose a serious risk to consumer health—as is the case with counterfeit medicines, food, cosmetics, etc.—because while legitimate suppliers are subject to strict regulations that ensure their products do not harm consumers, counterfeiters do not comply with these standards.

According to the Spanish Food Code, any food product shall be considered counterfeit if any of the following circumstances apply: a) it has been prepared or labeled to imitate a well-known product; b) its actual composition does not match the composition declared and advertised; and c) any other circumstance capable of misleading the consumer.

Among the most commonly seized counterfeit food products in recent years are olive oil—more than 60,000 liters of which have been seized—and wine. In 2021, the Mossos d’Esquadra seized 750,000 bottles of wine and 3.2 million counterfeit quality seals.

Other counterfeit products that pose a serious threat to people’s health and safety include vehicle parts and accessories, tobacco—11 illegal factories were shut down last year—and face masks; between 2020 and 2021, at the height of the pandemic, 60% of the face masks purchased were counterfeit.

A RECENT CASE

A few days ago, details emerged of a large-scale operation led by the National Police in various European countries, in collaboration with agencies such as the EUIPO and EUROPOL, in which approximately 2 million counterfeit products were seized and more than 370 people were arrested.

More than 3,900 seizures were carried out in 17 countries, resulting in the removal from the market of products affecting 258 brands and valued at 85.8 million euros. During the operations, it was determined that most of the seized products originated in China, Hong Kong, Turkey, and Vietnam.

Alberto Gallo, junior associate at ELZABURU