Centripetal Limited v. Palo Alto Networks, Inc.

This case arose from a dispute between Centripetal Limited (Applicant) and Palo Alto Networks, Inc. (Defendant) concerning European Patent EP 3 281 580. Centripetal had previously obtained a saisie order from the Local Division Mannheim seeking seizure and real-time monitoring of Palo Alto's network security solution. The initial application was rejected on 3 March 2025, but on appeal, the Court of Appeal modified and accepted the application in a limited form (order of 28 May 2025, APL_13242/2025, UPC_CoA_239/2025), allowing Centripetal to carry out monitoring of Palo Alto's system at the specified Munich premises. The CFI then issued the respective order upon referral back (order of 3 June 2025, amended on 9 July 2025).

On 11 July 2025, Centripetal attempted to execute the order at the Munich premises (Rosenheimer Straße 143c). However, the premises turned out to be a co-working space where only one sales person was present, who had no access to the technical layers of the system Centripetal wished to monitor. Palo Alto's counsel, who had been called to attend, refused to have the US headquarters set up access rights for the Munich staff member. Centripetal's counsel searched the office but found no Next Generation Firewall, cloud computing servers, or technical documentation. Neither the present staff member nor Palo Alto's counsel could create proprietary access to allegedly existing technical documentation stored outside the address named in the order.

Centripetal then requested penalty orders, arguing that Palo Alto had blatantly rejected complying with the obligation to provide the court expert with requested access to their systems and documentation. Palo Alto argued that the Applicant had chosen the wrong premises (a sales office belonging to an affiliate), that there had been no act of non-compliance, and that the Munich office was not a branch of Palo Alto Networks, Inc. (Santa Clara, USA) but rather the seat of Palo Alto Networks (Germany) GmbH, which was only involved in sales and marketing activities. Palo Alto further argued that increasing access rights could only be carried out from the US headquarters, outside the UPC contracting member states, and that it would have been practically impossible to reach competent personnel at 5:20 a.m. local time in the US.

The Judge-rapporteur rejected the request for penalty orders, reasoning that under Art. 60(3) UPCA, R. 199 RoP, and the rationale of R. 192.2(b) RoP, the scope of an inspection must be described as concretely as possible to balance proportionality with effective enforcement. The premises to be inspected must be defined precisely, and fundamental rights under Art. 8 ECHR and Art. 7 of the EU Charter must be respected. The inspection may not be extended to locations not included in the order, and the defendant only has a passive obligation to tolerate inspection rather than an active obligation to make contributions. Typical examples of required cooperation include unlocking closed doors or entering passwords, but the inspection of digital systems is limited to the digital system as present at the place of inspection. If the IT system is not accessible during ordinary business activities and no staff member has access rights, the inspection does not require the defendant to increase access rights beyond ordinary daily business activities or bring hardware components that are not present.

The court found that Palo Alto was under no obligation to increase the access rights of a mere sales person to allow access to the encrypted network security solution. Furthermore, the CoA's order, by which the CFI was bound, could only be construed to limit the inspection to the system actually present at the premises. Centripetal's request would amount to actively setting up a system not present at the premises, which both instances of the UPC had clearly denied. The conduct of Palo Alto therefore could not constitute a breach of the order, and no penalties were to be imposed. Centripetal's further request for reporting any deletions and changes was also rejected.

The panel confirmed the Judge-rapporteur's order of 25 July 2025, rejecting the request for panel review. Additionally, the court noted that since the saisie order had been reviewed and the application dismissed and revoked (except for its confidentiality part) as of the date of this order, it could no longer serve as a basis for enforcement measures. Leave to appeal was not granted, as the facts related to the present case alone and the panel did not deviate from case law of other divisions of the CFI or the CoA.