New customs database to be established under new rules on IP rights enforcement

The database is to be established no later than 1 January 2015 under a new regulation on customs enforcement of IP rights (22-page / 995KB PDF) which was approved earlier this year by the European Parliament and the EU's Council of Ministers, and which has now been set out in the Official Journal of the EU.

Under the new framework rights holders will be able to submit applications to customs authorities to enforce their IP rights. Rights holders will be required to fill out a standard application form and provide customs bodies with certain information, such as how to identify their goods and information that can help identify counterfeit products.

Customs bodies will have powers to seize or even destroy fake goods, in some cases without a court order, and will decide whether to grant rights holders' applications. Those decisions, as well as completed application forms, will have to be shared with other customs authorities throughout the EU via a centralised electronic database.

In addition, customs authorities will also generally be required to submit "relevant information" to the database about when it has decided to continue to detain goods or has released them from suspension. Personal data should not be submitted in these cases, but other information "including information on the quantity and type of the goods, value, intellectual property rights, customs procedures, countries of provenance, origin and destination, and transport routes and means" should be shared, according to the new framework.

All customs bodies across the EU will be able to access the information submitted to the database in line with the new regulation.

Any personal data that is contained within the information submitted to the database will have to be processed in line with EU data protection laws. Customs bodies will be considered to be data controllers under the new framework and will be responsible for complying with data subject access requests and adhering to a number of other data protection requirements.

The personal data featured on the database would have to be deleted within six months "from the date the relevant decision granting the application has been revoked or the relevant period during which the customs authorities are to take action has expired" or within six months after it has been determined in legal proceedings whether the individual has infringed an IP right.

The European Data Protection Supervisor (EDPS) previously raised concerns about how individuals' privacy rights would be protected through the operation of a new database of IP infringers. 

The EDPS had wanted the new rules to make clear the purposes for which personal data would be processed, place limits on how long data could be retained on the database before being deleted, and provide individuals' whose details were contained on the database a right to access that information, among other things.