The Unified Patent Court has postponed the introduction of a new login process for its content management system, based on a strong authentication schema, to the end of October.
Late August, the UPC announced the implementation would take place ‘in the next release of the UPC CMS v0.65’ and would be activated mid or end of September 2022, but apparently this deadline turned out not to be feasible. According to the UPC IT team, this is ‘due to the time required to acquire electronic IDentification certificates and physical secure devices (smart Card or token)’.
The delay has seemingly no influence on the start date of the UPC. As JUVE Patent reported, ‘during this year’s AIPPI World Congress in San Francisco, it was speculated that the UPC launch has been postponed to the second quarter of 2023. However, (…) UPC Administrative Committee chair Alexander Ramsay (…) denied any further delay to the court’s start.’
Last July, the UPC announced ‘the timing of the start of operations of the Court can reasonably be expected to occur in early 2023’. The first of March 2023 has regularly been mentioned.
According to Article 89, the UPC Agreement will enter into force and the UPC will open its doors on the first day of the fourth month after Germany deposits its instrument of ratification with the secretariat of the European Council. If this blogger interprets this clause correctly, it means Germany would have to complete the ratification formalities in November, in order for the court to start functioning in March.
_____________________________
To make sure you do not miss out on regular updates from the Kluwer Patent Blog, please subscribe here.
Kluwer IP Law
The 2022 Future Ready Lawyer survey showed that 79% of lawyers think that the importance of legal technology will increase for next year. With Kluwer IP Law you can navigate the increasingly global practice of IP law with specialized, local and cross-border information and tools from every preferred location. Are you, as an IP professional, ready for the future?
Learn how Kluwer IP Law can support you.
Have any of the readers of this blog managed to identify a secure device that has been:
– tested by its provider (using the UPC’s test page, https://cmsdemo.netserv.it/login); and
– confirmed to meet the UPC’s eIDAS certification requirements?
My efforts on this point have so far drawn blanks … and I have reason to believe that even exhaustive searching might not (yet) yield any positive results. However, I would be very interested to hear if any readers have had more luck (and, if so, with which provider).
In any event, I note that the UPC’s IT team have indicated that a FAQs section will be added for the secure device / eIDAS certification requirements. This, I believe, represents an acknowledgement that the information provided to date is somewhat lacking … if not verging on completely useless.
The FAQs section is not there yet. We are therefore still left guessing precisely which (eIDAS) certificates will need to be loaded onto our secure devices. Further, in the absence of any delay to Germany’s ratification timetable, we are likely to no more than about a month to obtain our devices once the UPC’s requirements have been clarified … assuming, of course, that by then there will be at least one provider of suitable secure devices!
The UPC therefore seems to have arrived at a situation where it will be impossible for all eligible patent attorneys to obtain working secure devices in time for the start of the sunrise period. Although I hesitate to cast aspersions, this mess seems to be entirely of the UPC’s own making, and can only serve to seriously dent its reputation before it even gets off the starting blocks.
Concerned, may we ask which of the eIDAS providers in your country have you tried without success? From the tone of your post it would appear that all have been tried and none have been satisfactory.
I’ve not heard confirmation of a working device yet either. We’ve looked at a couple of providers that could supply to the UK market but neither currently has a product that would meet the UPC requirements (as far as they are understood). One of these providers is trying to speak to the UPC IT team but aren’t getting any response at the moment.
If the March 2023 start date is what’s being aimed for then this would be concerning from the point of view of anyone that’s going to be expected to register a ton of opt-out requests in the sunrise period. As noted by Concerned Observer, it wouldn’t leave much time at all to get the devices in place before needing to use them.
There are also still issues with the opt-out process itself on the CMS platform. Manually opting out a case is time intensive and I’m not aware of a working bulk opt-out solution yet (and if there are any such solutions out there then they’ll presumably need retooling slightly to account for the authentication scheme).
It’s unfortunate that the way the processes have been designed that the newly minted CMS platform is likely to see one of it’s busiest periods shortly after it is switched on. Can’t help but think this will lead to its own issues.
I’ve also heard the comment that prototype bulk opt out tools have run into speed limitations when trying to send test opt out requests to the system.
@Han Shot First:
Like you, I’ve also heard that the UPC is simply not responding to enquiries (multiple patent firms in my own country report the same). I wonder if this is a sign that the UPC is overwhelmed by the volume of correspondence. Or maybe just that nobody is monitoring it.
It is quite simply incredible that the UPC has apparently decided on IT requirements which nobody knows how to meet, and has placed the onus on its prospective users to figure all of this out, while also leading us to believe that the sunrise period will start imminently. Surely the UPC should have discussed this with potential providers first before putting us all in this position?
The issues with the CMS and the opt-out process are also a big cause for concern. Clients are increasingly asking us when we will need instructions to process opt-outs – and how much (if anything) we will charge for doing so. At the moment it doesn’t feel like we can give a good answer to that without knowing how well the CMS will cope with automated requests, and how much time and effort will be needed on the part of the users.
Another unhelpful factor is the lack of any real knowledge about the timetable that we all face. Start dates of 1 March and 1 April have both been rumoured recently, putting the start of the sunrise period close to the end of 2022 or start of 2023, but we still have no clear idea if that is realistic or whether we will get any kind of official notice before the DE ratification is completed. The nightmare scenario for so many practitioners is that Germany ratifies “by surprise”, starting the sunrise period without real warning. UPC preparation is one of many tasks being dealt with simultaneously by IP law firms and I find it frankly unacceptable that we have to rely on guesswork and rumours to try to work out how to prioritise any outstanding tasks and get ourselves completely ready for the start of the sunrise period, never mind keeping non-European patent holders engaged (so many of them have heard the phrase “the UPC is imminent” so many times over the last decade that they’ve stopped paying attention, and in many cases are still confused about basic aspects of the Unitary Patent and UPC).
It’s a fiasco.
As far as my search went, just take your already established electronic signature (mobile or smartcard) and check with your provider whether this service is conform with eIDAS. If yes, you should be in, if no, just order a better card now.
As to the CMS authentication test site, I interprete the start with end of November according to a pdf published by the UPC yesterday (also disclosing a likely UPC-A entry into force date).
@Inventive but not New
The UPC has released two documents relating to the strong authentication system, the first of which states that a physical secure device will be required. That statement is missing from the second document but as it stands we seem to be looking at smartcard or USB token solutions and not mobile based solutions.
From your message I presume you already have a smartcard for some reason though this is not the case for all potential users of the system (will any non-EU EPA already have a smartcard that works?). Incidentally, who is the provider of your smartcard?
A sunrise start date at some point in December would be fine as far as it goes but the reality is many potential users are in the dark about the strong authentication requirements and the practicalities of opting-out thousands of EP patents during sunrise is concerning given the fact the CMS is still not at a production version and there are no bulk opt out tools available (there is no option, for example, to upload an Excel spreadsheet of cases. We’re either looking at manual data entry or a potentially cumbersome bulk opt out tool, the development of which falls on the users of the system).
I note that as well as all the above, yesterday’s release from the Prep Committee also makes it look like registration to become a UPC representative won’t open before sunrise starts. So not only do we have to solve the authentication and opt-out practicalities we will have to wait (for how long?) to be approved as a UPC representative while the sunrise period ticks away.
At the moment, it would appear that the test login page is confusing authentication certificates, which are not eIDAS certified, with eIDAS approved digital signature certificates.
My signature card has a non-eIDAS authentication certificate and an eIDAS signature certificate. Trying to lo in to the CMS test page, only the authentication certificate can be selected, which leads to an error message. Hopefully they will be able to sort out their software by the end of the month.
LightBlue, I am guessing that you now see a problem here.
I am also guessing that you have obtained a signature card from a German provider, and that to obtain it you attended an in-person identity check at a German location. Spare a thought for the thousands of other eligible attorneys for which attending such in-person checks will be impractical, expensive, time-consuming and/or immensely frustrating (especially for those trying to reduce their carbon footprint).
In any event, it seems that your early confidence in your signature card was perhaps a little misplaced. From the outset, I was confused by the UPC’s apparent requirement for an eIDAS certificate for authentication purposes. This is because the eIDAS legislation does not cover certificates for authentication. In other words, it always seemed to me that the UPC was asking attorneys to obtain qualified eIDAS certificates that simply do not exist.
It is telling that the UPC has yet to explain precisely which certificates are required. It is even more telling that the only type of authentication certificate available (ie the kind of NON-qualified certificate that is loaded on your signature card) does not appear to work with the UPC’s systems.
Putting all of this together, it seems to me that two things are possible. Firstly, it is possible that those designing the UPC’s web-based CMS do not have a good understanding of the eIDAS legislation and/or the kind of secure devices and certificates that are available “in the wild”. Secondly, it is possible that the CMS that was supposed to be ready for September is simply not fit for purpose … because it looks for a type of certificate that does not exist. Only time will tell whether one or both of these things are true. I would not want to place a bet against neither being true.
In any event, one thing seems pretty certain. That is, the pre-launch testing of the CMS has been woefully inadequate. Indeed, it seems that there cannot possibly have been any attempt at “real world” testing, where a subject obtains (from a commercial source) and then tests a suitable secure device. The lack of such “real world” testing would certainly explain the lack of any pointers to providers of suitable secure devices.
I really hope that this is not an indicator of the kind of levels of preparedness that we can expect from the UPC as a whole. Because, frankly, it is hard to characterise this episode as anything other than a shambles.
One provider we spoke to suggested that the qualified authentication certificate is functionality that no-one (to their knowledge) has implemented. There’s apparently space within the data structure to add that as enhanced functionality but they’ve not implemented it.
Having said that I’ve heard that LuxTrust has been identified as a provider that can supply the required certificates. I’ve not had confirmation that their cards work though.
Was your signature card something you already had, i.e. separate to the UPC strong authentication requirements, or did you order it for this purpose?
UK is still a requirement according to UPCA art 89, but readers already know countries and the Council Legal Service will ignore this rule for the entry into force, with a creative interpretation of replacing the UK with Italy.
The question is whether someone can and will file a complaint about this gross violation of the law.
Article 6 ECHR?
@ Simona Fonzi,
You think that the UK problem (also for Art 7(2)UPCA) is a gross violation of the law.
I would say, paraphrasing the EBA it is just a dynamic interpretation, not of the case law (inexistent at the UPC), but of the law itself. The aim justifies the means…
If we, those who will benefit from the system, say it is all OK, it must be OK. Anything else is bad faith and you should be ashamed.
I am waiting to see how a decision in life sciences taken in Paris, Munich or in Italy will be enforceable in any member state of the UPCA, the other EU member states and third states.
The long arm jurisdiction of the UPC might end up being rather shortened!
The CMS problem is a minor problem, the real problems are simply ignored as you rightly say.
Attentive, the problems with the CMS might be more practical than legal. However, their impact upon patent attorney firms should not be underestimated. Indeed, I have no doubt that, at this very moment, many attorneys all over Europe are pulling their hair about the current impossibility of fully planning and preparing for the start of the sunrise period.
The lack of responsiveness of the UPC is exacerbating matters greatly, as is the fear that – despite the currently impossible situation regarding the CMS – there will be no further delay to the start of the sunrise period. Indeed, such fears appear to be well placed. This is because, instead of answering questions regarding the CMS, the “UPC Preparatory team” is busy announcing a plan to start the sunrise period in December (https://www.unified-patent-court.org/news/latest-state-play-view-launch-unified-patent-court).
I share your concerns regarding the shaky (to say the least!) legal foundation for the UPC. However, as a practical matter, I cannot simply ignore the fact that the UPC will come into being. I also fear that the political support that the UPC enjoys will mean that the CJEU (and ECtHR) will somehow find a way of “dynamically” interpreting their prior case law in order to keep the show on the road.
The legal issues that I can see being raised before the UPC are multiplying by the day. My current favourite is the apparent ability for a party filing a revocation action before the UPC to continue with their action REGARDLESS of the fact that the patent concerned has been opted out. Apparently, and provided that the patentee raises the issue of an opt-out by way of a preliminary objection, this will simply lead to a decision by the judge-rapporteur (“As soon as practicable” after 14 days from notification of a preliminary objection) upon the patentee’s preliminary objection. Alarmingly, however, it seems that the filing of a preliminary objection (and the existence of an opt-out) will NOT lead to suspension of the requirement for the patentee to file (within 2 months of service of the Statement for revocation!!) a Defence to the revocation and, optionally, a counter-claim for infringement.
The reason that this is my current favourite is that I simply cannot see any legal basis under the UPCA for the UPC hearing any matters in connection with an opted-out patent. I therefore struggle to see why a patentee should be forced to engage with the UPC at all, let alone be forced by the UPC’s stupidly short deadlines to at least prepare to file a Defence (or a counter-claim) at a court that has no jurisdiction to hear matters relating to their patent. Also, since both Article 32 UPCA and the UPC’s rules of procedure are entirely silent upon the matter, I cannot see how the UPC can possibly have jurisdiction to hear (let alone to determine) a third party challenge to the validity of an opt-out.
It remains to be seen whether any of these matters will be litigated, and hence eventually resolved. My suspicion is that the UPC will claim competence to determine the validity of opt-outs, by virtue of the fact that Rule 5A of the UPC’s Rules of Procedure provides for challenges by patentees to opt-outs filed on their patents. However, this would ignore the fact that the UPC only has the competence afforded to it under international law (by way of Article 32 UPCA), which competence does not extend to determining the validity of opt-outs … for which the national courts remain competent. In this regard, I believe that there is an argument that Rule 5A is ultra vires. However, I won’t hold my breath waiting for a court decision that reaches the same conclusion.
To Concerned Observer:
If you are right about the possibility to bring proceedings at the UPC in respect of an opted-out patent, this is an extraordinary loophole in the rules. I wonder, if the proprietor of an opted-out patent has to incur the costs of preparing a preliminary objection and a full defence against such proceedings, and the Judge-Rapporteur eventually decides that the proceedings are baseless due to the opt-out and cannot continue, can the proprietor then reclaim those costs from the other party?
However, I wonder if this is as real a risk as you suggest. Rule 16.1 (infringement proceedings) states:
The Registry shall as soon as practicable check whether the patent concerned is the subject of
an opt-out pursuant to Article 83(3) of the Agreement and Rule 5. In the event of an opt-out the
Registry shall as soon as practicable inform the claimant who may withdraw or amend the
Statement of claim as appropriate.
By virtue of Rules 47.1 and 65 this provision also applies in the case of revocation actions and actions for declaration of non-infringement.
In practice this seems to act as a roadblock to proceed with actions in respect of opted-out patents, though I wonder how a party might seek to “amend the Statement of claim” to proceed further. If a patent is opted out it is difficult to see what sort of amendment to the case could be possible – unless of course this opens the door for a challenge to the validity of the opt out?
All very well, but do you see anything in the Rules that prevents a claimant from continuing with their action regardless of the communication from the Registry under Rule 16.1?
Or is there anything which indicates that the Registry MUST dismiss an action that relates to an opted-out patent?
And why is it that the rule governing preliminary objections specifically mentions the existence of an opt-out as one of the grounds upon which a patentee may object? Given that the Registry will have already checked whether the patent in question is opted out, what is the purpose of giving the patentee an option to object on this ground?
Finally, what is the Registry to do if the third party alleges that the opt-out is invalid?
As you will appreciate, NONE of the above considerations suggests that the UPC will refuse to proceed with a revocation action just because the patent in question is opted out. Whilst it MAY develop practice along those lines, this is far from certain. There are simply too may lacunae in the UPCA and the UPC Rules.
All of the above points are questions that really ought to have occurred to those drafting the UPC’s Rules. This therefore poses another question: are those lacunae there by accident or by design? A possible answer to this point can be gleaned from a May 2022 presentation from Kevin Mooney, who really ought to know a thing or two about the UPC’s rules:
https://aippi.org/wp-content/uploads/2022/05/01_2022-05-The-UPC-Opt-Out100135780v1_Kevin-Mooney.pdf
To quote from slide 20 of Kevin’s presentation:
“If an ‘opted-out’ EP is attacked in a revocation action, claimant is informed of opt-out (Rule 16.1) BUT not struck out
– The claimant can continue the action and the proprietor would need to bring a Preliminary Objection (Rule 19)
– Onus then on the proprietor – and the defence deadline continues to run”.
This is the view of someone who has had a lot to do with the drafting of the UPC’s rules. Thus, whilst it may just be an opinion on how it was envisaged things would work, it arguably provides an insight into “legislative intent”.
By the way, Kevin’s comment about the onus being on the patent proprietor appears to suggest a reversal of the burden of proof, ie with the third party not needing to substantiate their original allegation (that the opt-out is invalid) but the patentee needing to prove their defence (that their opt-out was valid). If this were to happen in practice, it would represent a shocking departure from the basic principle of “he who asserts must prove” … and would raise yet further questions about whether the UPC is operating according to the rule of law.
Thanks for the link to that presentation, Concerned. This does suggest intention rather than oversight – which is extraordinarily underhand, and shocking indeed.
Providing a route by which even opted-out cases can give rise to proceedings at the UPC is certainly one way in which the UPC’s case load can be boosted in the short term … if a somewhat underhand / unlawful way.
I am beginning to think that there is a pattern here. This is because other “tricks” employed to ensure that the UPC gets off to a flying start include:
– no need to designate a EPUE upon filing a new application (instead just designate after grant, regardless of the unfairness to third parties regarding a possible last-minute change to the law of infringement);
– default opt-in (as opposed to the more logical position of a default opt-out of a court whose existence / nature had either not been contemplated or not been finalised when many of the affected patents were filed);
– plenty of hurdles for meeting the legal requirements for filing a valid opt-out (which hurdles were made even higher by a last-minute expansion of the proprietors that will need to authorise the opt-out, by inclusion, inter alia, of proprietors for (non-EEA) states for which the UPC will represent nothing more than a “foreign” court);
– by way of contrast, a (legally questionable?) lowering of the hurdles for requesting unitary effect, by way of the EPO providing an option for the filing an “early” (ie pre-grant) request;
– a last-minute (announcement of a) change to the requirements for accessing the CMS, which all representatives will need to access in order to file opt-outs;
– inadequate / incomplete information provided by the UPC on the new requirements to access the CMS, with the burden placed upon representatives to work out what is required and then to find out which companies (if any!) in the EU can provide them with a working secure device;
– a complete failure of the UPC to respond to the flood of queries regarding the eIDAS certificates required;
– at the present time, the apparent absence of ANY providers of suitable secure devices; and
– despite the fact that there is currently no evidence that the chaos surrounding the CMS will be resolved in the near future, the announcement of an intention to start the sunrise period less than two months time.
Of course, it would be the ultimate “trick” to make opt-opts possible in theory but (virtually) impossible in practice. We shall have to wait and see what transpires.
Whether by accident or design, all of the above factors will tend to “push” patentees (even unwillingly!) into the arms of the UPC. The fact that there are so many of these factors makes me wonder: why the need for such overkill? If patentees want to use the UPC, then fair enough. If they do not, why should they be tricked / forced into it?
I think that I know the answer to this question. It is not pretty.
@ Attentive Observer
While the real problems (like pronouncing “London” as “mi-LAHN” or “MYOO-NIK”) shouldn’t be ignored seeing as the PowersThatBe seem to be pressing on regardless, the CMS issues will soon be a very real practical issue.
They might only rate as an administrative/IT issue but they are going to have huge impacts on the patent attorney profession as soon as the sunrise period starts and, depending how well or badly the entire process goes, further into the future (if clients start to get unhappy, or worse, with failed opt-outs)
Basically, what I’m saying is there are plenty of problems to go around…
Failed opt-outs due wholly (or largely) to failings of the UPC might present an interesting conundrum for the insurers to sort out!
I fully agree with the worries brought forward by the various commenters about the (mis)functioning of the CMS system.
The problem mentioned by Concerned Observer of an opted-out patent nevertheless being subject to the UPC is real and is one of the many problems which will have to be faced.
It was simply Simona’s comment which brought me to remember that there are basic legal problems which come on top of the practical problems generated by the CMS.
The opt-out itself has been made much more complicated by a recent amendment to R 5(1,b) UPCA, relating to the opt-out.
Under the previous R 5(1,b) UPCA (18th draft), the opt-out was limited to the UPC member states. Under the new R 5(1,b) UPCA, opt-out has to be declared for all states designated in the granted EP.
In principle a granted EP designates at grant all EPC member states. The opt-out includes now not only the UPC member states, which is understandable, but also all the EPC member states, even if the proprietor only wants to validate in a little number of contracting states of the EPC. The average number of validations lies between 3 and 5.
It is clear that without a functioning CMS nothing less than havoc will be created.
The problem is compounded by the fact that a validation can occur as a rule within 3 months of the grant, but opt-out has to be decided within a month!
By making the opt-out so complicated, the number of not properly opted-out patents will automatically increase. All those patents not-properly opted-out patents should end up in the fangs of the UPC.
If the UPC promoters wanted to trap proprietors, they appear to have found a very easy way. All this under the pretext of the “long arm jurisdiction of the UPC”. I take this expression from the reasons given for the change in R 5(1,b) UPCA.
I still do not understand how the UPC can have such a “long arm jurisdiction” as Art 82(1) UPCA first sentence says expressis verbis: “Decisions and orders of the Court shall be enforceable in any Contracting Member State”. Under “any Contracting Member State” I understand any UPC Member state, not any EPC contracting state and certainly not any non-EU member state of the EPC. .
The problems raised by the new wording of R 5(1,b) have been discussed in another blog.
Attentive Observer:
I agree with much of what you say, but I am confused by your statement that “validation can occur as a rule within 3 months of the grant, but opt-out has to be decided within a month”.
Can you explain what you mean by this? I thought that an opt-out could be filed at any time, even while the application is pending and at any time after grant, as long as the opt-out is notified to the Registry no later than one month before the end of the (7 year) transitional period – see Article 83(3) UPCA.
The timescale of one month from grant is the deadline for requesting unitary effect – see Article 9.1(g) of Regulation 1257/2012. This is not to be confused with the opt-out procedure for patents which are not subject to unitary effect.
My reading is therefore that a decision to opt out can be taken at any time before, during or after the normal three-month validation period following grant of the patent, unless of course the proprietor has taken an active decision to seek unitary effect (in which case any discussion of opt-outs is moot).
Have I misunderstood your point? If so I would welcome clarification.