Information;Order — ECLI:EU:T:2020:515
Date: 2020-10-29
Language of the case: English
Court formation: President of the Chamber
Subject matter: Competition
Procedure: Action for annulment;Application for interim measures - unfounded;Application for interim measures - successful
Origin: Ireland

summary of a round table, in which some of its representatives participated, devoted to cooperation in combating the sexual exploitation of children. That email included an official press release from an organisation participating in those efforts and extracts from press releases by government bodies also involved in those efforts. The applicant has not established the existence, in that email, of data referred to in Article 9(1) of Regulation 2016/679 and Article 10(1) of Regulation 2018/1725. 238 Lastly, the applicant cannot infer from the mere adoption of the amending decision that the production of documents containing personal data which were not examined in the context of the virtual data room procedure infringed its right to privacy and that of the individuals concerned. 239 It follows that the applicant’s arguments must be rejected. – Disproportionate workload imposed by the virtual data room 240 The applicant maintains that the virtual data room procedure imposes on it, in view of the deadline for producing the documents in question, a workload which is disproportionate to the needs of the Commission’s investigation. The requirements of that procedure would result in it having to redact the personal data at issue contained therein from approximately [confidential] documents which are highly likely to be irrelevant. 241 The Commission disputes the applicant’s arguments. 242 It should be noted that point (9 p) of Annex I.A to the contested decision states that ‘Protected Documents may be transmitted to the Commission in a redacted form, by removing the names of the individuals concerned and any information allowing to identify them’. 243 It follows that redacting the names of the individuals concerned is an option available to the applicant, but it is not required of the applicant, with the result that it is entitled not to do so. Therefore, the applicant cannot reasonably assert that the contested decision imposes a disproportionate workload on it in that regard. 244 It follows from the foregoing that the applicant has not demonstrated any unlawfulness vitiating the virtual data room procedure set out in points (9 o) and (9 p) of Annex I.A to the contested decision. (iii) Failure to weigh the needs of the investigation against the protection of the applicant’s rights 245 The applicant complains that the Commission did not weigh the need to collect information necessary for its investigation against the need to protect its privacy and that of the individuals concerned. According to the applicant, such a weighing exercise ought to have resulted in the Commission not requiring production of all the documents captured by applying the search terms referred to in the contested decision, even though it had demonstrated to the Commission that numerous documents were irrelevant to its investigation. 246 The Commission disputes the applicant’s arguments. 247 In the present case, it is apparent from recitals 17 to 26 of the contested decision that, following the decision of 11 November 2019 requesting information and in response to the applicant’s request of 20 November 2019 for the Commission to revise the number of search terms and custodians covered by that request for information, the applicant and the Commission discussed, inter alia, the definition of the information requested. Accordingly, on 6 December 2019, the Commission invited the applicant to communicate to it the number of hits per search term applied and per custodian, so that it could verify whether it would be appropriate to amend the search terms or the list of custodians. As is apparent from recital 27 of the contested decision, the Commission considered it appropriate to amend the decision of 11 November 2019, in particular in order to reduce the number of search terms, the list of custodians and the number of resulting hits and to limit the production of internal documents. 248 It must be stated that, in the contested decision, the Commission reduced considerably the number of search terms which it sought to have applied as well as the number of custodians concerned, from 58 in the decision of 11 November 2019 to 3, a number which the applicant itself describes in the contested decision as ‘small’. That reduction, which is not disputed by the applicant, necessarily had the effect of reducing the number of documents having, as appropriate, to be communicated to the Commission. The fact that the number of custodians was reduced as well as the number of custodians ultimately concerned by the contested decision constitute evidence that the Commission weighed the needs of its investigation and the rights of the applicant and of the individuals whose personal data might appear in the information requested pursuant to the contested decision. 249 In addition, in the light of the Commission’s discretion, referred to in paragraphs 43 and 112 to 114 above, regarding the information which it may seek to be produced by means of a request, the fact that documents may ultimately prove to be irrelevant to the investigation is not sufficient to establish that a request for information is disproportionate or unjustified, or that the needs of the investigation have not been weighed against the rights of the applicant and the individuals whose personal data might appear in the information requested pursuant to the contested decision. 250 Lastly, in so far as the applicant relies on the judgment of the European Court of Human Rights of 2 April 2015, Vinci Construction and GTM Génie Civil et Services v. France (CE:ECHR:2015:0402JUD006362910), it is sufficient to state that that case dealt with the possibility of requesting an effective review of whether legal professional privilege had been observed during inspections. In the present case, the contested decision does not prescribe that the content of communications between the applicant, or any other person, and its lawyers are to be produced to the Commission. 251 It must therefore be held that the applicant has not demonstrated that the contested decision was based on a failure to weigh the needs of the Commission’s investigation against the protection of the applicant’s right to respect for its privacy and that of the individuals concerned. (5) Whether the obligation of professional secrecy is inadequate 252 The applicant maintains that the obligation of professional secrecy imposed on Commission staff under Article 339 TFEU and Article 28(1) of Regulation No 1/2003, first, does not confer on them an unfettered right of access to the personal data at issue and, second, does not, in itself, offer sufficient guarantees to protect effectively the privacy of the individuals concerned and their personal data. 253 The applicant also maintains that documents not relevant to the investigation could be used for illegitimate purposes, such as broadening the scope of the current investigation or initiating another investigation, or could even be disclosed beyond the restricted circle of Commission staff responsible for the investigation. The documents could be provided to third parties in response to possible requests for access to the file or they could become automatically disclosable in other jurisdictions. The applicant could also be obliged to provide those documents to persons bringing legal proceedings against it in the United States of America. The personal data at issue could thus be provided to numerous individuals outside the Commission, in breach of the right to privacy of the individuals concerned. 254 The Commission, supported by the Federal Republic of Germany, disputes the applicant’s arguments. 255 It should be recalled that Commission officials and servants are subject to strict obligations of professional secrecy under Article 339 TFEU and Article 28 of Regulation No 1/2003. Those provisions prohibit Commission officials from disclosing information covered by the obligation of professional secrecy obtained in response to a request for information or using it for purposes other than those for which it was obtained. In addition, Commission officials and servants are bound by Article 17 of the Staff Regulations of Officials of the European Union, which prohibits their making, including after leaving the service, ‘any unauthorised disclosure of information received in the line of duty, unless such information has already been made public or is accessible to the public’. 256 Neither Article 339 TFEU nor Article 28 of Regulation No 1/2003 explicitly indicates what information, apart from business secrets, is covered by the obligation of professional secrecy. It cannot be inferred from Article 28(2) of Regulation No 1/2003 that such would be the case as regards all information acquired under that regulation other than information whose publication is mandatory under Article 30 thereof. Like Article 339 TFEU, Article 28(2) of Regulation No 1/2003 – which supplements and applies that provision of the Treaty to the field of competition rules applicable to undertakings – prevents only the disclosure of information of the kind covered by the obligation of professional secrecy (see judgment of 28 January 2015, Akzo Nobel and Others v Commission, T‑345/12, EU:T:2015:50, paragraph 61 and the case-law cited). 257 The obligation of professional secrecy extends beyond business secrets to information which is known to only a limited number of persons and the disclosure of which is liable to cause serious harm to the person who has provided it or to third parties. Last, the interests liable to be harmed by disclosure of the information concerned must, objectively, be worthy of protection (see judgment of 15 July 2015, Pilkington Group v Commission, T‑462/12, EU:T:2015:508, paragraph 45 and the case-law cited). 258 As regards, in the first place, the applicant’s argument that the obligation of professional secrecy which is imposed on Commission staff does not confer on them an unfettered right of access to the personal data at issue, it is recalled in paragraph 192 above that, under Article 5(1)(a) of Regulation 2018/1725, the EU institutions may lawfully process personal data when that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the EU institution or body. 259 As regards, in the second place, the argument that the obligations relating to professional secrecy do not constitute sufficient guarantees of effective protection of the privacy of the individuals concerned and of their personal data, it must be stated that that argument is not substantiated and there is nothing to justify the assumption that the Commission will fail to ensure, when the time comes, that its obligations and those of its staff under Article 339 TFEU, Article 28 of Regulation No 1/2003 and Article 17 of the Staff Regulations of Officials are complied with (see, to that effect and by analogy, judgment of 12 December 1991, SEP v Commission, T‑39/90, EU:T:1991:71, paragraph 58). 260 As regards, in the third place, the argument alleging a risk that the documents obtained would be used for allegedly illegitimate purposes, such as broadening the scope of the current investigation or initiating another investigation, the following two principles should be recalled. First, the obligations on Commission staff under Article 339 TFEU and Article 28 of Regulation No 1/2003 preclude the use of information obtained in response to a request for information for purposes other than those for which it was acquired. Second, the purpose of a request for information is to enable the Commission to obtain the information and documentation necessary to check the actual existence and scope of a given factual and legal situation (see, to that effect, judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 37), without prejudice to the possibility for the Commission to develop the scope of its investigation following the information gathered. 261 The Court has confirmed, in relation to a decision requesting information adopted after a statement of objections, that in the administrative procedure applying the competition rules of the Treaty the Commission must logically be able to send supplementary requests for information after issuing the statement of objections in order to be able, if necessary, to withdraw complaints or add new ones (judgments of 30 September 2003, Atlantic Container Line and Others v Commission, T‑191/98 and T‑212/98 to T‑214/98, EU:T:2003:245, paragraph 121, and of 9 April 2019, Qualcomm and Qualcomm Europe v Commission, T‑371/17, not published, EU:T:2019:232, paragraph 76). 262 In the light of the subdivision into two distinct and successive stages of the administrative procedure under Regulation No 1/2003, referred to in paragraph 159 above, the foregoing considerations apply all the more to the adoption, as in the present case, of a decision requesting information during the preliminary investigation stage, before the adoption of a statement of objections. In that regard, it should be recalled that the preliminary stage is intended to enable the Commission to gather all the relevant evidence confirming that there has or has not been an infringement of the competition rules and to adopt an initial position on the course which the procedure is to follow. 263 Therefore, the applicant cannot reasonably rely on an alleged risk that certain documents produced in response to the contested decision will be used by the Commission in order to broaden the scope of the current investigation or to initiate another investigation. 264 As regards, in the fourth place, the applicant’s arguments that documents not relevant to the investigation or containing data such as the personal data at issue could be disseminated more widely outside the Commission, it must be stated that those arguments concern hypothetical situations, such as possible requests for access to the file by third parties and the disclosure, on an allegedly automatic basis, of documents to courts, and that they are not substantiated. 265 It follows from the considerations set out in paragraphs 200 to 264 above that the applicant has not established that the contested decision constituted an unjustified interference with its privacy or that of members of its staff or of other persons. In those circumstances, the first part of the third plea must be rejected. (b) The second part of the third plea, alleging failure to observe the principle of proportionality 266 The applicant complains that the Commission failed to observe the principle of proportionality. It maintains that the failure to observe that principle is apparent from, first, the obligation on it to produce, in the context of the virtual data room, documents containing sensitive personal data, second, the obligation to produce, in the same context, documents containing both commercial and personal data, third, the existence of methods better protecting the privacy of individuals than the virtual data room in order to assess the relevance of the Protected Documents and, fourth, the inadequacy and ineffectiveness of the possibility of anonymising the documents at issue. 267 The Commission disputes the applicant’s arguments. 268 It must be observed that the principle of proportionality, which is one of the general principles of EU law, requires that measures adopted by EU institutions should not exceed the limits of what is appropriate and necessary in order to attain the objective pursued, and where there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued (see, to that effect, judgments of 13 November 1990, Fedesa and Others, C‑331/88, EU:C:1990:391, paragraph 13, and of 14 July 2005, Netherlands v Commission, C‑180/00, EU:C:2005:451, paragraph 103). 269 It is settled case-law that requests for information made by the Commission to an undertaking must comply with the principle of proportionality and that the obligation imposed on an undertaking to supply information should not be a burden on that undertaking which is disproportionate to the needs of the inquiry (judgments of 12 December 1991, SEP v Commission, T‑39/90, EU:T:1991:71, paragraph 51; of 14 March 2014, Cementos Portland Valderrivas v Commission, T‑296/11, EU:T:2014:121, paragraph 86; and of 9 April 2019, Qualcomm and Qualcomm Europe v Commission, T‑371/17, not published, EU:T:2019:232, paragraphs 120 and 121). 270 In the present case, first, the applicant relied on the workload entailed by a response to the contested decision being manifestly disproportionate only in relation to the redaction of the documents to which the virtual data room procedure applied. As has been pointed out in paragraph 243 above, redacting the names of the individuals concerned is an option available to the applicant, but it is not required of the applicant, with the result that it is entitled not to do so and that it is not justified in relying on a failure to observe the principle of proportionality in that regard. As regards anonymisation allegedly being inadequate, due to the low number of custodians concerned, which would make it simple to identify them in a given document, it should be recalled that the small number of custodians concerned constitutes evidence of observance of the principle of necessity of the information requested, in accordance with Article 18(1) of Regulation No 1/2003, and evidence of the needs of the investigation having been weighed against the protection of the applicant’s rights. 271 Second, the applicant relies on the possibility, which may constitute an alternative to the virtual data room provided for in the contested decision, that the documents containing sensitive personal data be identified and described in a document to be provided to the Commission, but without providing those documents themselves. According to the applicant, that practice makes it possible to avoid, first, Commission staff having access to the personal data in question by consulting documents in the virtual data room and, second, those documents having to undergo redaction of sensitive personal data contained in them before they are provided to the Commission. 272 As has been stated in paragraph 219 above, the virtual data room procedure established in the present case does not go beyond what is necessary in order to achieve the objectives of general interest which it pursues, in the light of the right to privacy of the applicant and the individuals concerned, as protected by Article 7 of the Charter. 273 Moreover, as is apparent from paragraph 238 above, the production of documents containing personal data which were not examined in the virtual data room procedure does not constitute an infringement of the right to privacy of the applicant and the individuals concerned. 274 It follows that the applicant has not established a failure to observe the principle of proportionality, with the result that the second part of the third plea must be rejected. (c) The third part of the third plea, alleging infringement of the right to good administration 275 The applicant maintains that the failure to review the relevance of the documents requested pursuant to the contested decision constitutes a manifest infringement of its right to good administration. In that regard, it recalls that the contested decision requires it to provide the Commission with many documents which are irrelevant to the investigation or contain personal data, including sensitive data. 276 The Commission disputes those arguments. 277 It should be pointed out that recital 37 of Regulation No 1/2003 states that the regulation ‘respects the fundamental rights and observes the principles recognised in particular by the Charter’ and that it ‘should be interpreted and applied with respect to those rights and principles’. 278 Article 41 of the Charter – which, under the first subparagraph of Article 6(1) TEU, has the same legal value as the Treaties – is entitled ‘Right to good administration’ and states, in paragraph 1, that ‘every person has the right to have his or her affairs handled impartially, fairly and within a reasonable time by the institutions, bodies, offices and agencies of the Union’. 279 According to the case-law on the principle of good administration, the guarantees afforded by the EU legal order in administrative procedures include, in particular, the duty of the competent institution to examine carefully and impartially all the relevant aspects of the individual case (judgments of 21 November 1991, Technische Universität München, C‑269/90, EU:C:1991:438, paragraph 14, and of 30 September 2003, Atlantic Container Line and Others v Commission, T‑191/98, T‑212/98 to T‑214/98, EU:T:2003:245, paragraph 404). 280 It must be held that, contrary to the applicant’s assertions in its reply to a question put by the Court, the arguments put forward in support of that part of the plea overlap in substance with those put forward in support of the second part of that plea, which themselves partly overlap with the arguments relied on in support of the second plea, alleging failure to observe the principle of necessity, and in support of the first part of the present plea. 281 Since all those arguments have already been rejected, it must be held that the applicant has not demonstrated that the Commission failed to carry out a diligent and impartial examination of the present case. Therefore, the applicant has failed to establish that the contested decision was vitiated by a failure to observe the principle of good administration. 282 Accordingly, the third part of the third plea must be rejected, as must, consequently, the third plea in its entirety. 283 It follows from all of the foregoing that the action must be dismissed in its entirety. V. Costs 284 Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. As the applicant has been unsuccessful, it must be ordered to bear its own costs and to pay those incurred by the Commission, including those incurred in the proceedings for interim relief. 285 Under Article 138(1) of the Rules of Procedure, the Member States which intervened in the proceedings are to bear their own costs. The Federal Republic of Germany must therefore bear its own costs. On those grounds, THE GENERAL COURT (Fifth Chamber, Extended Composition) hereby: 1. Dismisses the action; 2. Orders Meta Platforms Ireland Ltd to bear its own costs and to pay those incurred by the European Commission, including those incurred in the proceedings for interim relief; 3. Orders the Federal Republic of Germany to bear its own costs. Papasavvas Spielmann Mastroianni Brkan Gâlea Delivered in open court in Luxembourg on 24 May 2023. T. Henze S. Papasavvas Acting Registrar President * Language of the case: English. 1 Confidential data omitted.