Official Journal of the European Union

EN

C series

—

C/2024/5240

(Case T-349/24)

(C/2024/5240)

Language of the case: English

Parties

Applicant: WS (represented by: H. Tettenborn, lawyer)

Defendant: European Union Intellectual Property Office

Form of order sought

The applicant claims that the Court should:

—Annul the decision of EUIPO to reject the applicant’s requests under the EUDPR, (1) submitted by his letters of 01/02/2024 to EUIPO’s Data Protection Officer (DPO) and of 16/02/2024 to EUIPO’s Executive Director (ED), namely:

—to reject the applicant’s right of access to get a copy of data and logs relevant in the case of the modified data (including the restoration of the modified data), pursuant to Article 17 EUDPR;

—to reject the applicant’s right to restriction of processing, pursuant to Article 20 EUDPR;

—to reject the applicant’s right to object, pursuant to Article 23 EUDPR; and

—to reject the applicant’s request that the applicant and the EDPS be informed of the data breach, in accordance with Articles 34 and Article 35 EUDPR.

—Order EUIPO to pay the procedural costs.

Pleas in law and main arguments

In support of the action, the applicant relies on the following plea in law.

With his plea in law the applicant claims EUIPO breached its obligation of complying with Article 4(2), Article 14(1), (2), (3) and (4), Article 17(1) and (3), Article 20, Article 23, Article 33, Article 34(1) and Article 35(1) EUDPR.

The applicant backs his claim especially by submitting that EUIPO did not reply at all to his two letters to EUIPO’s DPO of 01/02/2024 and to EUIPO’s ED of 16/02/2024 and did not even acknowledge their receipt, while at the same time the EUIPO was in contact with the EDPS, obviously trying to keep the EDPS out of the matter by incorrectly stating that the data breach reported was already a subject matter of two already running court cases.

The applicant submits that, by not replying at all to the two letters of the applicant of 01/02/2024 and of 16/02/2024, EUIPO breached its obligations under Article 4(2) EUDPR to demonstrate compliance with Article 4(1) EUDPR, under Article 14(1) EUDPR to take provide appropriate information, under Article 14(2) EUDPR to facilitate the exercise of the applicant’s rights under Articles 17 to 24 EUDPR, under Article 14(3) and 14(4) EUDPR to provide information on action taken and on the reasons for not taking action, under Article 33 EUDPR to grant the security of processing, under Article 34 EUDPR to notify a personal data breach to the EDPS and under Article 35 EUDPR to communicate a personal data breach to the data subject, and violated the applicant’s rights (requested by his said letters) under Article 17 EUDPR of access, under Article 20 EUDPR of restriction of processing and under Article 23 EUDPR to object to processing of personal data.

(1) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39).

ELI: http://data.europa.eu/eli/C/2024/5240/oj

ISSN 1977-091X (electronic edition)

—