|EUROPEAN COMMISSION |

Brussels, 6.11.2012

C(2012) 8106 final In the published version of this decision, some information has been omitted pursuant to Article 17(2) of Council Regulation (EC) No 139/2004 concerning non-disclosure of business secrets and other confidential information. The omissions are shown thus […]. Where possible the information omitted has been replaced by ranges of figures or a general description.

MERGER PROCEDURE ARTICLE 6(1)(b) IN CONJUNCTION WITH ARTICLE 6(2) DECISION PUBLIC VERSION

To the notifying parties:

Dear Sir/Madam,

Subject: Case No COMP/M.6564 – ARM/ GIESECKE & DEVRIENT/ GEMALTO/ JV

Commission decision pursuant to Article 6(1)(b) in conjunction with Article 6(2) of Council Regulation No 139/2004 [1]

1. On 15 June 2012, the European Commission received a notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 [2] by which the undertakings ARM Limited ("ARM", UK), Giesecke & Devrient GmbH ("G&D", Germany) and Gemalto N.V. ("Gemalto", Netherlands and, together with ARM and G&D, the "notifying parties") will create a new joint venture (the "JV").

2. This notification was, however, withdrawn by the notifying parties on 3 July 2012.

3. On 14 September 2012, the Commission received a re-notification of the proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004.

I. THE PARTIES AND THE JV

4. ARM. ARM is a semiconductor intellectual property (“IP”) supplier. In particular, ARM licenses IP for application processors (“APs”). ARM's IP for AP is licensed with an integrated security feature called "TrustZone". TrustZone consists of a hardware extension integrated into AP's core design that provides the means to implement a Trusted Execution Environment (“TEE”) by being able to create two separate spaces (one considered “non-secure” and the other “secure”) within a single AP and enforcing a strict separation between the two spaces. A TEE is a security solution that provides a separate execution environment for use by trusted applications (that is to say applications which offer enhanced security for more personalized and, therefore, more valued, services to users) [3] on consumer electronic ("CE") devices, which include an AP. [4] A TEE creates a secure operating system ("OS") running alongside the main OS, but isolated through hardware-enforced separation.

5. G&D. G&D is active in security solutions for the production and processing of banknotes and in the provision of secure elements (“SEs"). G&D has also developed a TEE software solution, MobiCore. MobiCore is designed to work with TrustZone-enabled APs. It is based on G&D’s proprietary Application Programming Interface (“API”) set and does not comply with the standards published so far by the independent industry standards organization GlobalPlatform. [5] MobiCore was commercially released in May 2012. However […]. [6]

6. Gemalto. Gemalto is a digital security company that provides secure personal devices, such as SEs and tokens, and Near Field Communication (“NFC”) solutions. [7] In 2009, Gemalto acquired the company Trusted Logic S.A. (“Trusted Logic”), which had developed a TEE software solution, Trusted Foundations. Gemalto's solution was the first TEE solution for TrustZone-enabled APs to become commercially available. Trusted Foundations complies with the industry standards so far adopted by GlobalPlatform. Gemalto’s revenues from Trusted Foundations have so far been limited (around EUR […] in 2011). [8]

7. JV. The JV will develop and market a TEE solution. The JV aims at responding to the increasing customer demand for security solutions for CE devices by combining Gemalto’s and G&D’s activity in the development and marketing of TEE solutions for use with APs embodying ARM’s TrustZone technology.

II. THE CONCENTRATION

8. Joint control. The agreement bringing about the JV (the "JV Agreement") attributes to each shareholder […] veto rights over strategic decisions […]. Further, the JV Agreement establishes that ARM will hold 40% of the JV’s equity and each of G&D and Gemalto will own 30% of the JV’s equity. Hence, each of the notifying parties to the JV will have veto rights over the JV’s strategic decisions.

9. For these reasons, it can be concluded that ARM, G&D, and Gemalto will exercise joint control over the JV.

10. Full function joint venture. The JV qualifies as a full-function joint venture as it will operate on the market autonomously from its parent companies, performing all the functions of undertakings normally active on the same market. In more detail:

a) The JV will sell TEE solutions primarily to third parties, such as Original Equipment Manufacturers ("OEMs") of CE devices and semiconductor manufacturers. It will also sell the cryptographic keys to its TEE solution primarily to third parties, including OEMs, Mobile Network Operators (“MNOs”) and Trusted Service Managers ("TSMs"). While Gemalto and G&D may become resellers of TEE solutions for the JV, the JV will likely not depend on sales to its parent companies.

b) The JV will have its own management. A board of directors will be appointed which will have all powers required to control and manage the JV’s business and the JV will have a management team, including a chief executive officer, which will be responsible for the implementation of the strategy and day-to-day management.

c) The JV will have a dedicated team of employees. ARM will provide […] employees, G&D will provide […] employees, and Gemalto will provide […] employees. The employees include research and development ("R&D") and software engineers, security architects, project managers, product managers, business developers, market engineers, and directors of marketing.

d) The JV will have adequate funding to perform its activities. It will be financed initially out of the proceeds of the share subscriptions until it starts generating its own revenues from commercialising its products.

e) The JV will have access to sufficient assets and infrastructure to allow it to operate on a lasting basis. G&D will transfer assets and rights relating to its TEE technology, including: (1) certain hardware and development software; (2) all know how, trade secrets, techniques, information expertise and proprietary knowledge; (3) business records; (4) claims; and (5) certain IP rights, including business trademarks, and patents. G&D will also transfer to the JV certain contracts related to its TEE business. Gemalto will sell to the JV all its shares in Trusted Logic, the Gemalto subsidiary active in the development and marketing of TEE solutions. Trusted Logic is also the owner of certain IP rights, including business trademarks and patents.

f) The JV will be formed for an indefinite period.

11. For the above reasons, the proposed transaction leads to the creation of a joint venture performing on a lasting basis all the functions of an autonomous economic entity within the meaning of Article 3(4) of the Merger Regulation.

12. The transaction constitutes a concentration within the meaning of Article 3(1)(b) of the Merger Regulation.

III. UNION DIMENSION

13. The undertakings concerned have a combined aggregate worldwide turnover for the year 2011 of more than EUR 2 500 million [9] (ARM: EUR 567 million, G&D: EUR 1 635 million, Gemalto: EUR 2 015 million). In the same year, the combined aggregate turnover of the parties was more than EUR 100 million in each of at least three Member States (France - ARM: EUR […], G&D: EUR […], Gemalto: EUR […]; Germany - ARM: EUR […], G&D: EUR […], Gemalto: EUR […]; the United Kingdom - ARM: EUR […], G&D: EUR […], Gemalto: EUR […]). In each of these three Member States, the aggregate turnover of at least two of the Parties (that is to say […]) was more than EUR 25 million (France – […]: EUR […]; Germany – […]; the United Kingdom – […]). The aggregate Union-wide turnover of each of at least two of the parties (that is to say […]) was more than EUR 100 million, and none of the parties achieve more than two-thirds of their aggregate Union-wide turnover within one and the same Member State.

14. The notified operation therefore has a Union dimension within the meaning of Article 1(3) of the Merger Regulation.

IV. RELEVANT MARKETS

1. Introduction

1.1. Industry value chain

15. The main stages of the value chain for a CE device can be summarised as follows. This description uses smartphones as an example.

(...PICT...)

16. Developers and suppliers of IP for semiconductors. Semiconductor manufacturers increasingly tend to outsource the IP from third-party IP developers instead of developing their own proprietary technology. Semiconductor IP suppliers, such as ARM, MIPS, and Rambus research and develop technology for semiconductors. The IP is generally licensed to semiconductor manufacturers or foundries that use it in the development and manufacture of their chipsets and processors.

17. Semiconductor manufacturers. Semiconductor manufacturers design and manufacture chipsets and their components, including APs. The AP is the device’s primary chipset. At the outset of the design process, semiconductor manufacturers choose the technology most suitable for the proposed final use of the product. In addition to the AP architecture, the design of a chipset requires the selection of other technologies or components to be embedded in the processor. At this stage, semiconductor manufacturers are free to adopt all or some of the functionalities (including security) that a given IP offers.

18. OEMs select the silicon, security solutions, and pre-issuance trusted applications. OEMs purchase from semiconductor manufacturers processors that correspond to their CE devices’ needs in terms of performance, functionality, and software requirements. Semiconductor manufacturers generally design their chipsets to support many different software products (mainly OSs), so OEMs are free to select which OS and software to install on the chipsets. At this stage, OEMs also select which security solution(s) to install on their CE devices. Which technology or combination of technologies is the most appropriate will depend on the level of security required. At this level of the value chain, OEMs may also decide to pre-install certain applications, including trusted applications, (developed by the OEM itself or licensed from a third party) on their CE devices ("pre-issuance" trusted applications). For technical reasons, pre-issuance applications cannot, in principle, be uninstalled.

19. MNOs select the CE device/ smartphone. MNOs stock CE devices according to their price, capabilities, and several other factors. During the negotiations with OEMs, MNOs may request OEMs to add software, services, and pre-issuance applications or to remove software (including security software, such as TEE) and/or pre-issuance applications previously installed by the OEM.

20. Service providers (for example, credit card companies) mandate application developers to develop post-issuance trusted applications (for example, payment applications), which are managed by TSMs. Trusted applications can be downloaded from online application stores (for example, Apple App Store, Google Play, BlackBerry App World, Windows Phone 7 Marketplace) by the end user after the device has been shipped ("post-issuance" trusted applications). Installing post-issuance trusted applications requires the intervention of a TSM provider who, on behalf of the service provider, installs, personalizes, and provides lifecycle management of the trusted side of a post-issuance application. End users are free to uninstall any post-issuance application.

1.2. The JV's and the notifying parties' activities

21. ARM is active in the development and supply of IP for APs for CE devices, including the design of the necessary hardware extension (TrustZone) to incorporate the JV's TEE into these APs.

22. The JV will be principally active at the level of the value chain where the marketing of security solutions takes place, that is, at the level of semiconductor manufacturers and OEMs who incorporate security solutions into their chipsets/ CE devices. The JV will develop and market a TEE designed to work on AP chipsets containing ARM’s TrustZone technology.

23. The JV’s business model will be two-fold. First, the JV will license TEEs to OEMs and, to a lesser extent, semiconductor manufacturers, for use on chips with TrustZone. The JV also plans to supply and market (mainly to OEMs and MNOs) pre-issuance trusted applications (the "pre-issuance" business model).

24. Second, the JV will sell cryptographic keys to its TEE solution so that trusted applications can be installed when demanded by consumers (the "post-issuance" business model). For a trusted application to execute in a device equipped with the JV’s TEE, the JV will need to create a secure space, or container, into which the trusted application can be installed within the TEE of a given CE device and where the trusted application will safely execute. The container is created through the JV generating a cryptographic key that is specific to the CE device.

25. With respect to the post-issuance business model, the notifying parties submit that OEMs/MNOs, which are the principal decision-makers in relation to the security options on CE devices, will insist to control the keys to access the JV's TEE. Therefore, they are likely to be the JV’s (direct) customers with respect to such keys. The OEMs/MNOs would then make the keys available to application providers (either directly or via TSMs mandated by these application providers) so that trusted applications can be installed on devices supporting the JV's TEE solutions. The notifying parties submit that application providers will pay the TSM to deploy and manage trusted applications on a per-application, per-device, or per-transaction basis, depending on the application and the CE device concerned. The TSM will request a security domain for applications from the OEM/MNO and pay the OEM/MNO an activation fee for each security domain that the TSM will manage. Application providers who perform the role of TSM themselves will simply pay the OEM/MNO an activation fee, as if they were third-party TSMs.

26. The JV does not plan to be active in the development of post-issuance trusted applications or TSM services.

27. Each of Gemalto and G&D will engage in the development of post-issuance trusted applications running on top of the JV's TEE solution, as well as in the provision of TSM services for, amongst others, the JV's TEE solution. In addition, each of Gemalto and G&D will continue to be active, among other things, in the provision of SEs, such as smart cards.

2. Product Market definitions

2.1. AP-based security solutions for CE devices

View of the notifying parties

28. The JV will be active in TEEs, which is a type of AP-based security solution for CE devices. The notifying parties submit that other AP-based security solutions include:

a) Virtualization software. This technology isolates two or more software environments from each other to enhance security and reliability of the overall system. Virtualization creates parallel “worlds” in which an OS, applications and data reside. These parallel “worlds” exist side-by-side on the AP. They are separated from each other by the hypervisor - a layer of software - which is the heart of virtualization technology. Virtualization software includes Type 1 virtualization solutions where the hypervisor runs directly on the hardware and Type 2 virtualization solutions where the hypervisor runs inside the main operating system.

b) Custom integrated hardware/software modules. They provide specialized functionality in hardware alongside the rest of the AP system.

c) OS-based security solutions. They consist of security features built into the OS installed on a given device, such as Android, iOS or Windows Phone, including process and file access controls, permission-based protections, data protection frameworks or isolation mechanisms and/or the removal of non-essential tools and applications that might provide potential back-door access to threats.

d) Application software security solutions. These solutions include software obfuscation, white box cryptography and application wrapping, as well as endpoint software security solutions such as anti-virus or anti-malware solutions.

29. The notifying parties submit that the relevant product market includes all the above listed AP-based security solutions for CE devices or, at least, TEE and virtualization solutions.

30. The notifying parties further submit that: (1) mobile media content delivery; (2) mobile banking, mobile payment and e-commerce solutions; and (3) enterprise data solutions are the type of (trusted) applications, which will likely require additional security in the CE devices. Based on the notifying parties’ submissions, [10] it appears that virtualization can be a full substitute for all three types of applications. While not allowing for post-issuance download, custom integrated hardware/software modules can be a substitute for mobile media content delivery applications and mobile banking/ payment solutions. Conversely, OS-based solutions as well as application software security solutions, do not appear to be a substitute for mobile media content delivery, and would require complementary solutions for mobile banking/ payment applications and enterprise data solutions.

31. In any event, the notifying parties submit that it is not necessary to take a view as to the exact scope of the relevant product market as the proposed transaction would not give rise to competition concerns even on the narrowest possible product market definition, that is, TEE solutions for AP for CE devices. Furthermore, in their presentation to the Commission of 4 October 2012, the notifying parties submitted that they "do not contest the Commission's analysis of the transaction (for Phase I purposes) on a narrow market for TEEs." [11] They submit, however, that the non-confidential versions of the key responses to the second market investigation made available to the notifying parties on 1 October 2012 confirm that TEEs compete - depending on application/use case - with other AP-based security solutions, that will "exert competitive constraints on TEE providers."

Commission's assessment

32. In light of the market investigation on the whole, the Commission has not been able to confirm the notifying parties' claim that TEE solutions are substitutable with other AP-based security solutions for CE devices, such as virtualization, custom integrated hardware/software modules, OS-based security, and application software security solutions. The investigation carried out by the Commission when the proposed transaction was first notified (the “first market investigation”) produced mixed results with respect to the question whether the relevant product market is wider than just TEE solutions. [12] The market investigation carried out by the Commission when the proposed transaction was re-notified (the “second market investigation”) contained more focused questions with respect to the definition of the relevant product market. Moreover, the number of respondents to the second market investigation was higher than the number of respondents to the first market investigation. The majority of the respondents to the second market investigation indicated that TEE solutions may not be, or may be only partially, substitutable with other AP-based security solutions. [13] In the words of one respondent: "[n]on-TEE solutions are not direct substitutes for TEE solutions of the type proposed by the planned Joint Venture." [14]

33. Several respondents to the second market investigation indicated that whether TEE solutions are substitutable with other AP-based security solutions depends on a number of factors, including their security level, cost, processing speed capability and accessible memory space required by different types of trusted applications. [15] . They indicated that, at least for some types of trusted applications, TEE solutions are likely to be (or to become in the near future) the only or, in any event, the most attractive, security solution on CE devices. [16]

34. The second market investigation was very clear in that OS-based security solutions, as well as application software security solutions, do not achieve the level of security necessary for any of the trusted applications expected to drive the market adoption of TEE solutions. As one respondent pointed out, these solutions "are not appropriate for [mobile banking/ payment, eCommerce, media content delivery, or enterprise data solutions applications] because SW [software] only solutions are relatively breakable compared to HW [hardware] assisted solutions, and therefore service providers do not prefer OS-based security solutions." [17]

35. While custom integrated, separate hardware/software modules may achieve comparable levels of security, they tend to be less flexible and typically run at lower speed than an AP, which results in these modules not having the same level of performance as TEE solutions. [18] Moreover, developers of TEE solutions pointed out that a TEE solution is considerably cheaper than such custom developments. [19]

36. As regards virtualization solutions, the second market investigation indicated that such solutions, in particular those using a Type I hypervisor, [20] are closer to TEE solutions than other AP-based security solutions, at least with respect to certain types of applications such as trusted enterprise applications. However, when asked to compare TEE solutions with Type I virtualization solutions, which are considered to be more secure than Type II virtualization solutions, the majority of the respondents to the market investigations indicated that they do not believe that these solutions can achieve the same level of security, which is the primary purpose for implementing an AP-based security solution: [21] "Google’s understanding is that type 1 [and type 2] virtualization solutions do not provide a security functionality comparable with TEE solutions, when they are used on their own without a TEE solution." [22] . Apple stated that: "[a]lthough hypervisor solutions are the closest substitutes for TEE solutions, any security solution that relies on a single execution environment that shares resources (such as physical memory) is susceptible to serious security breaches. A physically separate execution environment is ideal, which makes TEE solutions ideal from a security standpoint." [23] Semiconductor manufacturer Texas Instruments pointed out that "[v]irtualization provides an isolation solution between several OSs but does not bring anywhere near the same level of security as a TEE. Virtualization does not provide the level of security and does not provide hardware based security required by trusted applications […]." [24] Moreover, the majority of respondents, which expressed an opinion on this issue, do not believe that TEE and virtualisation solutions have a similar cost, with costs associated to virtualization likely to be higher than those associated with a TEE solution. [25]

37. In light of the above and on the basis of the facts available in the first phase of the investigation, the Commission considers that the existence of a narrow product market limited to TEE solutions cannot be excluded. At the same time, since the TEE business is at a nascent stage, it is likely that certain AP-based security solutions, including notably Type I virtualization solutions, may exercise, particularly in the short term during which TEE solutions need to gain market adoption, a competitive constraint upon TEE solutions, at least with respect to types of trusted applications currently using such AP-based security solution (an example being enterprise data solutions using Type I virtualization software).

38. For the purposes of this decision, it can therefore be concluded that the provision of TEE solutions may constitute a separate market from other AP-based security solutions. As a result, the Commission will conduct its competitive assessment also on a possible product market comprising the supply of TEE services only.

2.2. SEs

View of the notifying parties

39. The notifying parties submit that, consistent with the Commission's findings in the Axalto/Gemplus decision, [26] AP-based security solutions for CE devices should be distinguished from SEs where the Commission identified a separate product segment for secure smart cards, which may be further sub-divided based on the technology used in the chip (memory or microprocessor) and the application of the card.

40. An SE can be defined as a secure processing element running sensitive code on a chip different from the main AP. Unlike AP-based security solutions, SEs therefore have very limited interaction with the AP and the OS of the device, as they normally have their own microprocessor and OS. SEs can be built into small removable memory cards, so-called “smart cards” (i.e., removable SEs), or embedded into CE devices (i.e., embedded SEs). The most common types of smart cards found in mobile devices include removable UICC/SIM cards and removable secure Micro SD cards.

41. The notifying parties submit that while there is some degree of supply-side substitutability, there is no demand-side substitutability between SEs and AP-based security solutions such as TEEs. SEs and AP-based security solutions are more complementary security solutions than substitutes.

Commission's assessment

42. The Commission broadly confirms, on the basis of the market investigation, the notifying parties' view, in particular that SEs are not a substitute, but rather a complement, to TEE solutions. A clear majority of respondents to the first market investigation considered that TEEs and SEs do not share sufficiently similar characteristics, functionalities and performance, as well as that the cost of the solutions is significantly different (with SEs being significantly more expensive than TEE solutions). [27] A majority of the respondents confirmed this view also in the second market investigation. [28]

43. Moreover, several respondents pointed out the complementarity of both solutions for a number of trusted applications: Telefonica stated that the "Secure Element is an optional complementary asset to the TEE solution - it cannot run the applications that the TEE can run due to extreme CPU/memory/API constraints." [29] Google stated that "[i]n practice, SE and TEE solutions will often be combined." [30] Sierraware, which provides an open-source TEE solution, pointed out that "SEs and TEE work in conjunction to provide unique identification and security. SEs by itself is not enough to provide comprehensive security […]." [31]

44. In the Commission's decision in the case Axalto/Gemplus, the Commission distinguished, within the provision of secure plastic cards, at least between a relevant product market for SIM cards and payment cards. [32] Moreover, it considered that the provision of Over-The-Air (“OTA”) SIM card administration and services platforms was a distinct product market. [33]

45. In addition, the market investigation supports the notifying parties' views that SEs are separate from AP-based security solutions for CE devices.

46. For the purposes of this decision, it can therefore be concluded that SEs are not part of the same relevant product market as TEE solutions.

2.3. Other relevant product markets

47. There are a number of other possible relevant markets for the purposes of the assessment of the proposed transaction, which are either vertically related, or closely neighbouring, to the market for TEE solutions where the JV will operate.

IP licensing for semiconductors

48. ARM develops IP solutions for chipsets and APs used in CE devices. ARM does not supply processors itself, but only designs the architecture, which is used by semiconductor manufacturers in the development and manufacture of their products.

49. The notifying parties submit that the relevant market should include all AP architectures used in CE devices and that no distinction should be made based on the type of CE device (including smartphones, tablets, digital TV/STB, game consoles, netbooks, notebooks, and desktops), in which the AP is ultimately incorporated. [34] This is because smartphones and other CE devices use the same or similar APs or families of APs (and therefore the same or similar IP). In any event, the notifying parties consider that the Commission may leave open the question whether there is a narrower product market limited to the licensing of IP for AP for specific types of CE devices/ platforms, since the proposed transaction raises no competition concerns regardless of how the market is defined.

50. In a prior decision concerning the licensing of microprocessor core architectures, [35] the Commission considered that a distinction may exist between various core architectures but left open the precise definition of the relevant product market. In its decision in Intel/McAfee, [36] the Commission concluded that the relevant product market was based on the architecture – in that case the market for x86 Central Processing Units ("CPUs" – also called microprocessors when incorporated into personal computers). The decision further stated that this market could potentially be segmented according to the type of platform (such as servers, desktops and notebooks).

51. In light of these precedents, the Commission will consider in its competitive assessment a possible segmentation of the relevant market for the licensing of IP for APs for CE devices based on the type of architecture (namely ARM, x86, MIPS and Power PC) and/or based on the type of platform including, in particular, smartphones and tablets. In any event, for the purposes of this decision, the exact product market definition can be left open as the result of the competitive assessment would not be materially different.

Trusted applications

52. As explained in more detail in paragraph 7 above, trusted applications are applications which offer enhanced security for more personalized and, therefore, more valued, services to users on CE devices. As further described in paragraph 18 above, the JV will have the ability to develop pre-issuance trusted applications. Further, it is anticipated that each of G&D and Gemalto may develop post-issuance trusted applications in the future.

53. In the view of the notifying parties, all applications for CE devices (regardless of whether they are "trusted" or not) belong to the same market as any application, regardless of its final use, can be categorized as “trusted” if it requires a certain level of security. The notifying parties also submit that pre-issuance and post-issuance applications do not belong to separate product markets.

54. The Commission considers that for the purposes of the present decision, the exact product market definition can be left open, as the proposed transaction raises no competition concerns regardless of how the market is defined.

TSM services

55. Each of Gemalto and G&D will be active in the provision of TSM services. TSM providers install, personalize, and provide lifecycle management of the trusted side of an application. The notifying parties submit that TSM services is a nascent business and most of today’s TSM activity derives from secure management and OTA application download and personalization to NFC-enabled SEs, such as SIM cards. In the future, they expect that TSMs will also manage the post-issuance implementation of applications for other security solutions, including AP-based security solutions such as TEEs. However, such offering does not currently exist for TEEs or other AP-based security solutions and is unlikely to develop before 2013-2014.

56. The notifying parties submit that all TSM services belong to the same relevant product market due to a considerable degree of supply side substitutability among TSM services for NFC-enabled SEs and other security solutions, including TEEs and other AP-based security solutions, should such services successfully develop. In any case, the exact product market definition can be left open, since the proposed transaction raises no competition concerns regardless of how the market is defined.

57. TSM or service providers responding to the first market investigation mostly confirmed that TSM services for CE devices containing TEE solutions are likely to be substitutable to TSM services for NFC-enabled SEs. [37]

58. The Commission considers that for the purposes of the present decision, the exact product market definition can be left open, as the proposed transaction raises no competition concerns regardless of how the market is defined.

3. Geographic market definitions

View of the notifying parties

59. The notifying parties submit that the relevant geographic market for AP-based security solutions and its segments, as well as for SEs, IP licensing for semiconductors, trusted applications and TSM services are worldwide or, at least, EEA-wide since all relevant products are generally offered globally, in standard versions, purchased by customers who are active worldwide, and not affected by transportation and similar costs. The notifying parties submit that in any event, the geographic market definition can be left open for the purposes of the assessment of the proposed transaction.

Commission's assessment

60. The vast majority of respondents to the first market investigation considered that the relevant geographic markets for AP-based security solutions and its possible sub-markets are global. [38]

61. In light of the above and on the basis of the facts available at the first phase of the investigation, the Commission considers that the geographic market for the supply of TEEs and more generally of AP-based security solutions for CE devices are likely to be at least EEA-wide, if not global. In light of the notifying parties' arguments, the relevant geographic market for SEs, IP licensing for semiconductors, trusted applications and TSM services also appear to be global or at least EEA-wide. For the purposes of the present decision, the precise definition can be left open as the result of the competitive assessment would not be materially different.

V. COMPETITIVE ASSESSMENT

1. Introduction

62. The notifying parties submit that the security solutions' industry is at a critical point. In their view, unless a standard-based solution achieves widespread acceptance during this early stage of market growth, security solutions promoted or owned by large IT firms such as Apple, Google, Microsoft and Intel, are likely to dominate the landscape in the near future.

63. According to the notifying parties, the JV would be a specific attempt to help the industry move away from the fragmented proprietary solutions that are in use today and to counter the threats posed by vertically integrated firms. The JV’s offer - an open standard TEE solution - would, if it is developed, be state-of-the-art and create a catalyst for the development of an open ecosystem of trusted applications.

2. Horizontal assessment

2.1. Elimination of competition in the provision of TEE services

Introduction

64. If the relevant market were to be defined more broadly than the provision of TEE solutions for APs for CE devices, the proposed transaction would likely not give rise to horizontal competition concerns. This reflects the fact that if virtualisation solutions alone were to be considered part of the same market as TEE solutions, the JV's market share would be below [0-5]%. [39]

65. However, if the relevant market were to be defined as limited to the provision of TEE solutions for APs for CE devices (whether or not based on ARM's TrustZone technology), [40] the JV would combine the two most advanced TEE technologies currently available on the (merchant) market. Based on the notifying parties' own estimates, under this product market definition, Gemalto alone would today account for a share of around [70-80]% (in volume), with G&D controlling the second most developed TEE technology.

66. By way of background, it should also nonetheless be noted that, as of today, the market for TEE solutions would be a very small market with a total size of around EUR […] in 2011 and a similar size in 2012. This market is, however, poised to grow significantly in the coming years, particularly due to the increased uptake of CE devices, including smartphones and tablets. As a result, absent high barriers to entry, such growing market is likely to attract entry from different players, including in particular, both companies active at different level of the CE value chain and companies active in neighbouring markets (for instance software companies). The market investigation confirmed the likelihood of such entry (see paragraphs 78 to 93 below).

Views of the notifying parties

67. The notifying parties put forward several arguments supporting the view that, even on a market defined as the provision of TEE solutions for APs for CE devices, the proposed transaction would not give rise to competition concerns.

68. First, the notifying parties claim that G&D […]. Therefore, according to them, G&D should be considered as a potential, and not an actual, competitor on this market. Moreover, the JV would create a product with new features (including, in particular, being based on open standards and supporting the download of post-issuance applications) compared to those currently offered by each of Gemalto and G&D.

69. Second, the notifying parties submit that there are a number of competitors, which either already provide TEE solutions for APs for CE devices for the merchant market (for example Sierraware, Solacia) or for their captive use (for example Qualcomm, ST-Ericsson and Intel), or which are likely to start developing similar solutions in the short term (for example GHS, which already provides virtualisation solutions). Furthermore, they submit that barriers to entry are very low, particularly for companies which are already active in the IT sector, and that the market is growing very fast.

70. Third, the notifying parties explain that, immediately after its launch, the JV would have every incentive to license its TEE solution as cheaply and as widely as possible to ensure its adoption by OEMs and MNOs (against competing non-TEE security solutions or any proprietary TEE solution developed by integrated players, such as Intel and Apple, or by silicon vendors) and incentivise the creation of an ecosystem of trusted applications based on the JV's TEE solution. Moreover, they submit that the JV's direct and indirect customers would be large and sophisticated market players, which will exercise significant countervailing buyer power.

71. Fourth, the notifying parties claim that, even if the JV were to develop the most successful TEE solution available on the market and create an ecosystem of trusted applications running on top of its TEE, since both such solution and the trusted applications would be based on open industry standards defined by GlobalPlatform, competitors would have the ability to develop alternative TEE solutions which, provided they are GlobalPlatform compliant, will interoperate with such ecosystem of trusted applications. Moreover, the JV would not have any incentive to depart from open industry standards since the whole ecosystem, including trusted applications, would be based on the standards defined by GlobalPlatform. As a result, the JV's customers would not be "locked-in" the JV's TEE solutions and, if the JV were to raise prices, they could easily switch to another TEE solution provider or develop in-house their own GlobalPlatform-compliant TEE solution, [41] without losing the benefit of a TEE solution that is compatible with the existing ecosystem of trusted applications.

Commission's assessment

72. The market investigation conducted by the Commission for the purpose of the assessment of the proposed transaction primarily aimed at testing the validity of the arguments put forward by the notifying parties in support of the contention that, even if the relevant product market were to be limited to TEE solutions, the proposed concentration would not give rise to horizontal competition concerns.

Competition between Gemalto and G&D

73. The Commission could not fully confirm, in light of the market investigation, the claim of the notifying parties that G&D is a potential rather than actual competitor of Gemalto on the provision of TEE solutions. While a respondent explained that "[…] bringing G&D to the level of completeness, readiness and maturity of Gemalto would be a significant effort" [42] , a number of respondents to the market investigation indicated that, as of today, Gemalto's Trusted Foundations and G&D's MobiCore are the most advanced and mature TEE technologies and the only two TEE solutions which, as of today, have been implemented to a meaningful extent in the CE space. [43]

74. A number of respondents, however, also confirmed that Gemalto's and G&D's products currently have different features, including, in particular, the fact that Gemalto's Trusted Foundations solution is GlobalPlatform compliant and G&D's MobiCore solution is able to support the download of post-issuance applications. Therefore these products are not necessarily particularly close substitutes. Indeed, one of the stated aims of the creation of the JV, also confirmed by the market investigation, is to develop a product that would combine into one the key features of Gemalto's and of G&D's TEE solutions. [44]

75. Moreover, for all practical purposes, G&D's TEE solution has not yet been commercially deployed. […]. By the same token, as explained, Gemalto's TEE solution, which is the most advanced TEE solution to date, only generated around EUR […] in revenues in 2011 and is expected to generate a similar level of revenues in 2012. Gemalto only has licensing agreements in place with […] semiconductor manufacturers (namely […]) for the licensing of its TEE solution.

76. It therefore does not appear to be the case that Gemalto and G&D currently enjoy a huge installed base of smartphones including their respective TEE solutions. To the contrary, in the Commission's view, the above elements confirm the limited uptake of each of Gemalto's and G&D's TEE solutions as of today and, more generally, nascent nature of the TEE market.

77. The Commission therefore concludes that, while Gemalto's Trusted Foundations and G&D's MobiCore appear to be the most advanced and mature TEE technologies and are therefore actual, more than potential, competitors, the TEE solutions that are currently offered by each of Gemalto and G&D also have different characteristics, which will be combined into the TEE solution that will be offered by the JV. Moreover, as of today, the size of the TEE market where these companies operate and the commercial uptake of TEE solutions (including those offered by Gemalto and G&D) is very limited.

Actual and/or potential TEE competitors

78. On the basis of its market investigation, the Commission broadly confirms the notifying parties' claim that there are a number of competitors, which either are already providing competing TEE solutions for the merchant market or for their captive use, or which are likely to start developing similar solutions in the short term.

79. The Commission, however, also notes from the outset that most of the actual and/or potential competitors identified in this section are likely to develop a TEE solution, which will be based on ARM’s TrustZone. As explained in more detail in Section 3.3 below, in order to be able to develop any such solution and compete with the JV’s TEE solution, these competitors will likely require not only to have access to the relevant technical specifications concerning ARM’s TrustZone, but also to be granted access to such information at the same time as the JV. Furthermore, ARM should not seek to degrade the interoperability of alternative TEEs with the TrustZone technology.

80. Subject to the above, and on the basis of the market investigation, the Commission confirmed that, by the time that the JV expects to commercially release the first version of its TEE (namely the first quarter of 2014 at the earliest) [45] other TEE solutions will likely have already been launched or will likely be about to be launched on the market.

81. First, there are a number of large IT companies, which are already active in vertically-related or neighbouring markets, which plan to enter the TEE space in the near future.

82. […] In other words, the Commission understands that Apple and its silicon providers will likely be self-sufficient in terms of TEE solutions and will not use the JV's or any other TEE solution. [46] Furthermore, the Commission considers that, given the current importance of its App Store in the provision of applications, Apple could persuade application developers/service providers to develop trusted applications for its TEE solution regardless of the JV.

83. Microsoft explained that it has a "TEE-like" solution for some of its operating systems and plans to build TEE solutions for other offerings. [47] Microsoft stated that it "might develop a competing TEE solution in the near future. Microsoft's strategy is generally not to rely on software development by third companies. Hence, it is unlikely that Microsoft will rely on the JV's TEE". Furthermore, if "Microsoft decides to enter the TEE market, the company should be able to surpass entry barriers and notably catch up with the development of trusted applications depending on the successful development of its TEE". [48]

84. Intel confirmed that it has "a portfolio of technologies that offer AP-based security solutions and include trusted executive environments". [49] While Intel's presence today in the CE space, where the JV will operate, is rather limited, Intel itself explained that it's "goal is to gain a significant presence in such devices [smartphones and tablets] by the end of that period [2-3 years]". [50]

85. Second, other companies confirmed that they are likely to develop TEE solutions or solutions, including in the relatively short term. One of them confirmed that "it is in the process of developing a TEE solution, which will likely compete with products developed by the JV. […]. The developer of the solution is currently planning to enter into partnerships for the use of its TEE solution. Moreover, the developer of the solution considers that trusted applications running on top its TEE solution are likely to be developed after the commercial release of the solution". [51]

86. In addition, two market participants indicated that they believed that Oracle is in the process of developing a TEE solution, which would likely compete directly with that of the JV. One of these two market participant explained that because its solution would likely be a Java-based TEE, it would be "very limited in scope and capabilities" [52] . The Commission nonetheless notes that Oracle, which claims that its Java Card is "the World’s Leading Open Platform for Embedded Secure Elements, SIMs, and Smart Cards" [53] may be able to use its experience / expertise in Secure Elements to attract certain Application developers (notably for mobile payments) which may want to have a security solution based on Secure Element, plus a TEE (a combination that a number of market participants have suggested may be the way forward for future mobile payment security solutions). [54]

87. The likelihood that there is potential entry of significant competitors such as […] and […] is also supported by […] internal documents, according to which "[…]". [55]

88. Moreover, there is a number of software companies, which are also likely future entrants in the TEE space.

89. Oberthur – a leading competitor in the smart card space - confirmed that it is "working today on TEE solutions at operating system level and for TSM services" [56] .

90. Solacia confirmed that, although its TEE solution is not yet commercially deployed, it has already been trialled with some silicon vendors and prototypes are being tested with silicon vendors and OEMs, [57] which indicates that the company is likely close to deploy commercially its TEE solution. A number of respondents to the market investigation identified Solacia as an actual competitor with its "SecuriTEE" solution”. [58] One respondent, however, noted that Solacia is a new entrant which “would require a good deal of investment and time to get a commercial TEE implementation up and running”. [59]

91. Sierraware confirmed that its software competes "with the Trusted Logic TEE part of the joint venture" and is currently available under commercial as well as open source licenses [60] . One market participant, however, explained that "although SierraWare's "Open TrustZone" stack aims to compete with that of the JV, […] this stack is in its infancy […] so we wouldn't consider it a main competitor of the JV's stack" [61] .

92. Third, certain semiconductor manufacturers, such as Qualcomm and ST-Ericsson, have also developed their own TEE solution for captive use only. While these solutions today may not necessarily have the same functionalities as the JV’s TEE solution, these market players would likely be able to develop competing solutions to the JV’s TEE in the future if they were to find it profitable.

93. Based on the above, including the level of investment required to develop a TEE solution, the Commission concludes that, by the time the JV will commercialise its TEE solution (namely the first quarter of 2014), there will likely be a number of market participants other than Gemalto and G&D, which already have a commercial presence or will likely enter the TEE market. In the interim period, that is to say between the closing of the proposed transaction and the launch of the JV's TEE solution, the notifying parties expressly confirmed that legacy products (Trusted Foundations and MobiCore) will no longer be developed and/or marketed to new customers, although some customers may continue to use these products during a transitional period before migrating to the JV TEE (or to a competitor’s TEE or alternative solution). The latter point was confirmed by the assumptions underlying the revenues projections in the business plan of the JV, as explained by the notifying parties. [62]

94. Furthermore, as outlined in paragraph 37, the Commission notes that a number of existing or future market participants may also develop security solutions such as for instance virtualisation solutions which are not TEEs, but which may have similar features and characteristics as the TEE developed by the JV, and as such may exert a competitive constraint on the JV's TEE offering at least in the short term with respect to certain trusted applications.

95. Given the above, the Commission also considers that the argument put forward by one of the respondents to the market investigation, according to which, since, post transaction, the JV will be dominant in the provision of TEE solutions and will be vertically integrated with ARM, which will be dominant in the upstream supply of IP for AP for CE devices, any new entrant would need to enter at both levels of the value chain in order to meaningfully compete with the JV, is not founded. Indeed, the JV will likely face competition from a number of strong players in the provision of TEE solutions. Therefore the premise on which the above argument is based, that is to say, the JV being dominant in the provision of TEE solutions, is not founded.

96. The Commission, however, also notes that the above outlined conclusions concerning the likelihood of entry of competitors in the provision of TEE solutions is premised on these competitors' ability to develop solutions, which would run on ARM's TrustZone technology. In particular, as explained in more detail in paragraphs 139 and forward, in order to compete with the JV's TEE, these competitors would need to be provided with the necessary information to be able to develop a TEE solution based on ARM's hardware architecture.

JV’s incentives post transaction

97. The market investigation provided mixed results as regards the notifying parties' claims that the JV would have every incentive to license its TEE solution as cheaply and as widely as possible and to comply with GlobalPlatform’s open standards to ensure its adoption by OEMs and MNOs and incentivise the creation of an ecosystem of trusted applications based on the JV's TEE solution.

98. On one hand, according to some respondents, the proposed transaction could potentially lead to the creation of a monopolistic situation, with the JV's TEE solution becoming the de facto industry standard.

99. If this was the case and the JV's TEE solution was to become the de facto proprietary industry standard, future TEE competitors may have to depend on the JV to receive the necessary information to develop TEE solutions which are fully interoperable with the ecosystem of trusted applications which may develop around the JV's TEE. In this scenario, the JV would therefore be able to prevent the development of competing TEE solutions. [63]

100. As a result, a number of market participants indicated that the JV's compliance with GlobalPlatform current and future open standards [64] would be a necessary pre-condition for these competitors to be able to develop alternative TEE solutions.

101. On the other hand, a number of respondents confirmed the notifying parties' claims that the JV's open standard TEE solution may help the industry move away from the fragmented proprietary solutions that are in use today and create a catalyst for the development of an open ecosystem of trusted applications.

102. Notably, one respondent explained that the JV may help "to create a more standard and more open ecosystem for secure applications using the TrustZone TEE, and hence to attract more developers and applications users" [65] , while another considered that "the formation of the JV, if handled properly, helps control the fragmentation and therefore a broader adoption of the TEE technology" [66] and a third considered that "if the JV does not intentionally raise barriers to entry or to interrupt other parties, it may provide better solutions to silicon vendors and OEMs". [67]

103. Furthermore, a majority of respondents to the market investigation conducted for the purpose of assessing the remedies proposed by the notifying parties also stated that the notifying parties have an incentive to comply with GlobalPlatform's open industry standards to achieve the widest market adoption of its TEE solution by customers. For instance, Ericsson underlines that "today, the hurdle to gain market adoption is to be endorsed by either Apple or Google. An open industry standard is maybe more likely to be adopted by those two (at least Google) as they do not seem to have any proprietary work in this field". [68]

104. In addition, a majority of respondents to the market investigation conducted for the purpose of assessing the remedies proposed by the notifying parties submitted that the JV is likely to have the incentive to comply with GlobalPlatform’s open industry standards if credible competing TEE solutions are likely to enter market for TEE solutions in a timely fashion. This reflects the fact that the JV TEE's compliance with open industry standards could be a competitive advantage over future competing TEE solutions and thereby would help the JV to achieve market adoption. [69]

105. Also, according to the respondents to the market test, it would probably take the JV 18 to 24 months, and in any event 1 to 3 years, to develop a significant and attractive eco-system of trusted applications around its TEE solution. [70]

106. Based on the above, the Commission concludes that, since the JV will likely face competition from alternative providers of TEE solutions, its TEE solution is unlikely to become the de facto industry standard. For the same reasons, the Commission takes the view that the JV will likely have the incentive to comply with open standards (including, in particular, GlobalPlatform's open standards). Similarly, the Commission considers it unlikely that the JV would be able to develop an ecosystem of trusted applications, which would not comply with open standards and which would result in the exclusion of competing TEE providers from the TEE market.

Switching costs

107. The results of the market investigation were mixed as regards switching costs for TEE's customers. On one hand, a number of respondents to the market investigation highlighted the high costs for customers in switching between different TEE solutions.

108. On the other hand, a majority of market participants also replied that standardisation should make the switch easier between different TEE solutions. [71]

Conclusion

109. All in all the Commission considers, in light of the investigation that the proposed concentration would not give rise to horizontal competition concerns. In particular, the Commission confirms that, post transaction, the JV will likely face competition from a number of strong market players, which will develop and launch TEE or TEE-like solutions even prior to the launch of the JV's TEE solution. Moreover, even if the JV's TEE solution were to be first-to-market and able to start developing an ecosystem of trusted applications running on top of its TEE solution, these new entrants will likely enter the market prior to the development of any such ecosystem (which would likely take 1 to 3 years). In addition, even if the JV were able to develop this ecosystem, these new entrants would likely be able to counter any possible network effects and persuade service providers / application developers to develop trusted applications, which would also run on their TEE solutions.

110. The Commission therefore considers that, faced with the actual and/or potential competition by these market players, the JV will likely have the incentive to comply with open industry standards defined by Global Platform to attract as many application developers/service providers as possible and to license its TEE solution as widely and as cheaply as possible to gain market acceptance.

Overall conclusion

111. Based on the results of the investigation and the analysis above, the Commission considers that the proposed transaction would not give rise to serious doubts as to its compatibility with the internal market as a result of horizontal effects in the market for the provision of TEE services.

3. Non-horizontal assessment

112. According to the Non-Horizontal Merger Guidelines, a merger is likely to result in foreclosure where actual or potential rivals’ access to supplies or markets is hampered or eliminated as a result of the merger, thereby reducing these companies' ability and incentive to compete. [72] Such foreclosure is regarded as anticompetitive where, as a result of the merger, the merged entity, and possibly also some of its competitors, are able to profitably increase the price charged to consumers.

113. When assessing the likelihood of such an anticompetitive foreclosure scenario, it needs to be examined "first, whether the merged entity would have, post-merger, the ability to substantially foreclose access to inputs, second, whether it would have the incentive to do so, and third, whether a foreclosure strategy would have a significant detrimental effect in the competition downstream". [73]

114. In this case, also based on the results of the market investigation, the non-horizontal assessment focuses on the following possible foreclosure concerns: (1) the JV's ability and incentive to favour Gemalto and G&D and to foreclose third party developers of trusted applications and of TSM services; and (2) ARM's ability and incentive to foreclose the JV's competitors in the provision of TEE solutions.

3.1. Possible foreclosure of third party providers of trusted applications

115. As explained in paragraph 4, a TEE solution provides a secure environment for trusted applications. As also explained in paragraph 4, trusted applications are applications which process sensitive information and offer an enhanced, more personalized and therefore more valued service to end users.

116. The JV aims at developing a TEE that supports both pre-issuance and post-issuance trusted applications. The JV will also be active in the development of pre-issuance applications.

117. Post transaction, G&D and Gemalto will be active in the development of post-issuance applications. [74]

118. Post transaction, there will therefore be a vertical relationship between the activities of the JV in the provision of TEE solutions and the activities of the JV in the provision of pre-issuance applications and of each of Gemalto and G&D in the provision of post-issuance applications, which will run on top of the JV's TEE solution.

Views of the notifying parties

119. The notifying parties submit that, post transaction, every application developer or service provider could develop applications for the JV's open standard TEE solutions.

120. The notifying parties also submit that the applications sector is highly competitive and fragmented. The JV, as well as each of G&D and Gemalto, would compete with hundreds of service providers / application developers, many of which are well-established software companies. In any event, according to the notifying parties, the JV and, in particular, ARM, which would not be active in the provision of trusted applications, would have every incentive to have as many applications as possible developed for its TEE solutions to gain wide market acceptance. [75]

Commission's assessment

121. In light of the market investigation, the Commission confirmed the notifying parties' claim that the proposed transaction will likely not give rise to competition concerns as a result of the non-horizontal relationship between the JV's activities in the provision of TEE solutions and the JV's and each of Gemalto's and G&D's activities in the provision of trusted applications.

122. First, provided the JV's TEE solution will be compliant with GlobalPlatform standards, the JV (and/or the notifying parties) will likely not have the ability to foreclose third party application developers / service providers. Indeed, these third parties will likely have the ability to develop trusted applications, which will run on top of the JV's TEE solution.

123. Second, the JV will likely have the incentive to have as many service providers and trusted application developers as possible, and not only itself and/or two of its parent companies, to write applications running on top of the JV's TEE solution. [76]

124. Indeed, the Commission considers that the attractiveness of any TEE solution and its future market acceptance is conditional upon the availability of a wide range of diverse and attractive trusted applications. Hence, the development of an eco-system open to third parties trusted application developers is essential to the notifying parties and to the JV. The Commission considers that the notifying parties and/or the JV will likely have no incentive to foreclose third parties application developers in order to favour its parent companies.

125. Third, even if (which the Commission considers highly unlikely) the JV, as well as each of Gemalto and G&D, were to be able to prevent third party service providers / application developers from developing applications running on top of the JV's TEE solution, since there will likely be other TEE solution providers competing with the JV's TEE, no customer foreclosure would arise since third party service providers / application developers would likely develop applications for the JV's competitors.

126. Accordingly, the Commission considers that the proposed transaction will not give rise to serious doubts as to its compatibility with the internal market as a result to the vertical relationship between the activities of the JV in the provision of TEE solutions and of the JV and of each of Gemalto and G&D in the provision of trusted applications.

3.2. TSMs

127. As explained in paragraph 20, the installation of post-issuance trusted applications requires the intervention of a Trusted Service Managers ("TSM"), which installs, personalizes, and provides lifecycle management of the trusted side of a post-issuance application.

128. The role of a TSM is already well defined in the framework of NFC technology. The TSM acts as a neutral broker, which sets up business agreements and technical connections with mobile network operators, phone manufacturers or other entities controlling the secure element (or the TEE in the present case). A TSM enables service providers to distribute and manage their trusted applications remotely by allowing access to the secure element (or the TEE).

129. Post transaction, each of G&D and Gemalto will be active as TSMs.

Views of the notifying parties

130. The notifying parties submit that, since the JV will be based on GlobalPlatform open standards, post transaction, competitors of each of Gemalto and G&D would be able to develop TSMs, which will interoperate with the JV's TEE solutions.

131. The notifying parties also submit that the information needed by TSM providers to interoperate with the JV’s TEE solutions would be defined in the “TEE Administration framework”, currently being discussed within GlobalPlatform and expected to be publicly released at the end of 2012.

132. The notifying parties further submit that G&D and Gemalto would face competition from other TSMs, including those TSMs, which currently provide TSM services for NFC. [77] The notifying parties expect that G&D and Gemalto's share of TSM for AP-based security solutions would not exceed [10-20]% in the medium term.

Commission's assessment

133. In light of the market investigation, the Commission confirmed that the proposed transaction would not give rise to non-horizontal competition concerns as a result of the non-horizontal relationship between the JV's activities in the provision of TEE solutions and Gemalto's and G&D's activities in the provision of TSM services.

134. The Commission reached this conclusion despite the fact that certain respondents to the market investigation indicated that, if the JV's solution were to emerge as the dominant TEE solution and if the necessary interfaces allowing for interoperability between the JV's TEE solution and the TSM were not to be open, the JV would have the ability and likely the incentive to reserve to its parent companies the growing TSM market/segment. Indeed, according to these respondents, only G&D and Gemalto would have access to the necessary information to develop TSMs which would be compatible with the JV's TEE solution.

135. The Commission, however, takes the view that the above outlined concerns arising from the market investigation are not founded. This reflects, in particular, the fact that the JV will likely not have the incentive to favour Gemalto and G&D over third party TSM providers. In particular, ARM, will likely have the incentive to make sure that the JV's TEE solution works with as many TSM providers as possible, including, but not limited to, Gemalto's and G&D's TSMs, as this would likely increase the attractiveness of the JV's TEE solution to its customers.

136. In any event, and even if (which the Commission considers it highly unlikely to happen) the JV were to have the ability and incentive to prevent third party TSM providers from being able to interoperate with its TEE solution, the Commission considers that this conduct would likely not give rise to the foreclosure of competing TSM providers. Indeed, since, as explained in paragraph 93, the JV will likely face competition from several strong market players, even if TSM providers other than Gemalto and G&D were unable to interoperate with the JV's TEE solution, they could still continue to successfully provide TSM services to competing providers of TEE solutions, to the customers of these TEE solutions and/or to service providers / application developers for these TEE solutions.

137. Accordingly, the Commission considers that the proposed transaction will not give rise to serious doubts as to its compatibility with the internal market as a result to the non-horizontal relationship between the activities of the JV in the provision of TEE solutions and of each of Gemalto and G&D in the provision of TSM services.

138. For the sake of completeness, the Commission also notes that few respondents to the market investigation raised the concern that, following the proposed transaction, the JV could potentially leverage its dominant position in the market for TEE solutions to enter in the neighbouring market for SEs and foreclose Gemalto's and G&D's competitors in this space. However, as explained in paragraphs 78, the JV will likely face competition in the provision of TEE solutions from several strong market players. Hence, the Commission concludes the factual premise on which the above outlined concern is based is flawed and the concern should be dismissed.

3.3. IP licensing for APs for CE devices

139. As explained in paragraph 4, ARM's IP architectures for APs for CE devices are licensed with an integrated security feature called TrustZone. TrustZone consists of a hardware extension integrated into the microprocessor core design that provides the means to implement a TEE.

140. TrustZone allows the AP system to run in two states, one supporting the main OS and the other one supporting a secure execution environment.

141. With respect to the possible effects of the proposed transaction resulting from the vertical relationship between the activities of ARM in the licensing of IP for APs for CE devices, including TrustZone, and the activities of the JV in the provision of TEE solutions, several respondents to the market investigation indicated that the proposed concentration would give rise to competition concerns. These respondents indicated that, post transaction, ARM would have the ability and incentive to eliminate and/or degrade the interoperability between TrustZone and the TEE solutions developed by the JV's competitors. This, in turn, would lead to the foreclosure or, at least, the marginalisation of these competitors from the market for the provision of TEE solutions.

142. ARM currently commercialises two families of IP architectures for AP for CE devices (the so-called V6 and V7 families) and is to commercially release its V8 family of IP architectures in the coming months. Any foreclosure would, according to the Commission's understanding, be related to future shipments of CE devices, which would use APs based on the V6, V7, or V8 architectures of ARM (and/or possible evolutions thereof) [78] . The installed base of already commercialised CE devices whose APs run on ARM's architecture IP would presumably not be affected by any such foreclosure. However, CE device penetration rates, including based on current and future ARM architectures, are predicted by industry analysts, such as Gartner, to grow significantly in the short to medium term. Smartphone penetration rates, for example, are forecast to increase by a factor of four by 2015 and the demand for tablets is predicted to grow by a factor of 15 over the same period [79] .

143. According to the Non-Horizontal Merger Guidelines, the Commission analysed: (1) ARM's ability to foreclose the JV's competitors, (2) ARM's incentive to do so and (3) the overall likely impact of this practice on competition and consumers.

ARM's ability to foreclose the JV's competitors

Views of the notifying parties

144. The notifying parties submit that, post transaction, ARM would not have the ability to foreclose the JV's competitors from access to TrustZone for the following reasons:

a) Many of ARM’s customers are large semiconductor manufacturers, which are sophisticated buyers with a significant degree of bargaining power and expert knowledge. While these companies have in effect decided to outsource a portion of their R&D by licensing ARM IP, they could to readily switch to in-house production at low cost and within a short time frame. They can also switch to numerous other licensors;

b) The TrustZone IP is provided to all of ARM's customers as a standard feature of its AP architecture. Technically removing TrustZone from the IP design of ARM's AP (so that the technology would only be available to the JV) would very impractical. Moreover, customers could choose to support another TEE solution (also GlobalPlatform compliant) without relying on TrustZone; and

c) Granting to the JV better licensing terms and conditions for TrustZone than to the JV's competitors is unlikely as ARM has always licensed this technology as part of its AP architecture at no extra cost. Moreover, ARM does not plan to release a new architecture requiring a new license before five years.

Commission's assessment

145. As regards ARM's position upstream, that is to say in the provision of IP for APs for CE devices, the majority of the respondents to the market investigation clearly indicates that ARM currently holds a very strong market position, which is particularly strong with respect to certain CE devices, such as smartphones and tablets, where ARM holds a share of close to [90-100]%. [80]

146. Several respondents to the market investigation do not consider that Intel will have the ability to significantly challenge ARM’s market position within the next few years, particularly as regards smartphones, but also in relation to other CE devices [81] . The market investigation indicated that Intel’s APs do not currently reach the same level of performance and low consumption as ARM-based APs.

147. Accordingly, Texas Instruments states that: "TI believes that in this time frame [one or two years] Intel’s Atom may get a small market share on smartphones and a more considerable market share on tablets. ARM’s chip would make up the remainder of those markets.”". [82] Similarly, Sierraware notes that "[t]oday, ARM is the leader in the CE device market. While Intel is formidable, we believe ARM has a market advantage over Intel in this space and will continue to dominate". [83]

148. A majority of respondents to the market investigation also indicate that, following the transaction, ARM would be in a position to unilaterally standardize the hardware interface with TrustZone. For instance, Oberthur underlines that "ARM has a very dominant position in the market and could de facto standardise the hardware interface". [84] Deutsche Telekom adds that "the planned Joint Venture would be positioned as dominant player from the start creating a de facto standard available on any mobile device. ARM has already created a de-facto standard (supplier) regarding CPUs for mobile devices. The market share is almost 100%". [85]

149. Based on that ability to define the hardware interface, a majority of respondents to the market investigation indicate that ARM would likely have the ability to modify the TrustZone technology and/or interface in order to degrade the interoperability between TrustZone and the TEE solutions that may be developed by the JV’s competitors. In particular, these respondents claim that ARM could easily deny these competitors (full and timely) access to current and future versions of TrustZone.

150. For instance, Solacia underlines that "[h]aving ARM also incorporated in the proposed JV causes more complexity as it goes beyond a horizontal joint venture to a horizontal JV in which Gemalto and G&D would be given a great advantage in the TEE industry. It would be inevitable that they would have first insight to new architecture and updates in a market where time-to-market is critical". [86]

151. Sierraware underlines that "ARM has the ability to raise barriers that would prevent alternative TSM providers to develop TEE and TSM solutions for ARM processors. […]" [87] Sierraware adds that "If ARM changes the TrustZone hardware extensions in future versions of its architectures, ARM should document all changes and make this information public to other TEE vendors". [88] As regards the impact on competitors, Sierraware notes that they "have seen in one sales opportunity that the customer was concerned that ARM may only support the JV in the future and prevent other TEE solutions from working with future generations of ARM architectures". [89]

152. Similarly, Apple explains that "[t]here are two ways this proposed JV could raise barriers […]: 1) If the proposed TEE solution resulting from the JV becomes a part of the ARM specification such that it MUST be implemented in order to boot ARM […]" [90] .

153. In the same vein, France Télécom-Orange submits that: "device OEM Suppliers should be free to use ARM based chipset without being forced to implement the JV Licence. In other term, it could be possible for a Devices supplier to implement the TEE of its choice over ARM based chipset". [91]

154. Another respondent to the market investigation underlines that the vertical integration of the parties’ dominant positions will enable ARM to degrade the interoperability with alternative TEEs to the one developed by the JV. Software developers need access to specific tools and information to develop and optimize their software for a given processor. This is particularly true for security solutions, which operate closer to the processor than other software and interacts closely with hardware components. ARM would likely utilise its control of the TrustZone hardware architecture to positively discriminate in favour of the JV's products and thus degrade interoperability of other TEEs, or at the very least delay disclosure of significant interface and functionality information to the JV's competitors.

155. As a starting point, the Commission considers that ARM currently holds a significant degree of market power in the licensing for IP for AP devices as whole, as well as, at least, in its possible segments based on the type of platform such as smartphones and tablets.

156. The above conclusion is supported not only by the results of the market investigation, but also from the information provided by the notifying parties in the Form CO, [92] according to which ARM currently holds a very high share of any possible market definition. [93]

a) [50-60]% of all CE devices, including personal computers, and [70-80]%, excluding personal computers, shipped in 2011 worldwide; and

b) [90-100]% of all smartphones and tablets shipped in 2011 worldwide;

157. The Commission also considers, based on the results of the market investigation, that, at least for the next few years, Intel is unlikely to make sufficient inroads in the CE device space, including, in particular, in the smartphone and tablet segments, to challenge ARM’s current pre-eminent position and significant degree of market power.

158. The Commission further considers that, at least today, ARM’s TrustZone hardware extension constitutes an essential input for any provider of TEE solutions willing to develop any such solution for one or more categories of CE devices. This reflects the fact that, as explained, the vast majority of the APs included in CE devices are based on ARM’s architecture and include TrustZone as the only hardware extension, which is able to support security software, such as a TEE. Due to the lack of likely entrants able to challenge ARM’s market position, the Commission is also of the view that this situation is likely to remain the same in the near future.

159. Accordingly, a foreclosure strategy could be implemented by ARM by degrading the interoperability between TrustZone and the TEE solutions that may be developed by the JV’s competitors.

160. As of today, ARM has provided TrustZone’s API to GlobalPlatform and this API is therefore available to any TEE provider. Moreover, ARM makes available on its website or otherwise certain additional information that is required or, in any event, important to ensure interoperability between TrustZone and TrustZone-based TEE solutions. This information includes, for example, (i) processor architecture specific information, (ii) ARM’s implementation of the ARM architectures, (iii) system-wide hardware IP, (iv) training courses and (v) non-essential guidance on how to implement secure systems using the TrustZone security extensions as a component of an overall solution.

161. Post transaction, however, since ARM controls TrustZone, including its API and source codes, there is a risk that ARM could modify TrustZone's API and/or other technical aspects and stop providing the relevant information to the JV’s TEE competitors. Similarly, ARM could also stop providing to the JV’s TEE competitors the above outlined information and/or similar information which these competitors would likely need to develop their solutions (which it is under no obligation to provide to third parties).

162. Short of not providing the above outlined APIs and/or additional information to the JV’s competitors, ARM would equally have the ability to provide these elements selectively (i.e., not in full) and/or at a different point in time compared to when they are provided to the JV, which would place these competitors at a disadvantage in terms of development work and time to market for their TEE solutions.

163. Alternatively, the market investigation indicates that ARM would also have the technical ability to degrade TrustZone's interoperability with alternative TEE solutions, for instance by modifying certain technical aspects of TrustZone in order to discriminate TEEs developed by competitors of the JV. The Commission considers that a technical degrade of interoperability would have a similar effect as blocking / limiting / delaying the access of competitors to the relevant APIs, codes and/or other information. It would constitute just an alternative means to implement a foreclosure strategy of the JV's competitors.

ARM's incentive to foreclose the JV's competitors

Views of the notifying parties

164. The notifying parties submit that, post transaction, ARM would not have any incentive to create any technical, legal or other barrier to the development of TrustZone, as its primary business is and will remain the licensing of its IP. ARM will therefore have an economic interest in favouring the adoption of as many TEE solutions based on its AP design as possible.

Commission's assessment

165. Contrary to the notifying parties' claim, the evidence collected through the market investigation indicates that the risk of monopoly on the TEE market/segment resulting from the transaction is high because of the presence of ARM in the JV and that ARM is likely to have an incentive to favour the JV over competing TEE providers.

166. Accordingly, for instance, ZTE notes that "the transaction may cause monopoly, especially if ARM is in". [94]

167. NVIDIA adds that "the fact that JV's participating entities (that is to say. ARM, G&D, and Gemalto) have significant market power and leverage within the ecosystem, could pose a potential risk to the rest of ecosystem as they would be capable of monopolizing this technology and business". [95] .

168. For Solacia, "[h]aving ARM also incorporated in the proposed JV causes more complexity as it goes beyond a horizontal joint venture to a horizontal JV in which Gemalto and G&D would be given a great advantage in the TEE industry. It would be inevitable that they would have first insight to new architecture and updates in a market where time-to-market is critical" [96] .

169. Sierraware also explained that it "is concerned about the impact of the transaction. We have seen in one sales opportunity that the customer was concerned that ARM may only support the JV in the future and prevent other TEE solutions from working with future generations of ARM architectures." [97] .

170. Based on the information available to it (including the results of the market investigation), the Commission considers that there is a serious risk that ARM would have an incentive to favour the JV over competing TEE providers with a view to leveraging its market power in the provision of IP for APs for CE devices in the nascent market for the provision of TEE solutions for a number of reasons.

a) First, as explained, the likely competitors of the JV in the provision of TEE solutions will be different from ARM’s direct customers for the licensing of IP for APs for CE devices (which are silicon vendors), which is, and will likely continue to be post transaction, ARM’s core business. In other words, there will likely be no direct customer relationship between ARM and the market players, which would be impacted by the relevant foreclosure strategy. As a result, the cost that ARM could potentially face in terms of possible disruption of customer relationships and revenue loss may be limited and could be offset by the gain stemming from (ARM’s share of) the increased JV’s revenues in the TEE market following the foreclosure / marginalisation of the JV’s competitors. Moreover, given the limited uptake of TEE solutions, at least as of today, the availability of the TrustZone feature and/or of TEE solution is not a determining factor in ARM’ customer choice of a given hardware architecture.

b) Second, with specific respect to the cost for ARM of any such foreclosure strategy in terms of foregone revenues, the Commission notes that today ARM derives no revenues from the licensing of TrustZone to its customers. TrustZone is a feature of ARM AP architectures that silicon vendors that license ARM's IP can freely chose to use or ignore. As ARM provides the TrustZone feature at no additional cost, ARM does not generate revenue from the licensing of TrustZone. More than […] semiconductor vendors have licensed TrustZone-enabled APs from ARM but only a few of them have implemented chipsets that contain a system able to support a software TEE running on top of the TrustZone architecture. In other words, the vast majority of ARM customers who could use TrustZone-based security solutions have chosen not to do so even though there is no extra charge. ARM even donated the TrustZone APIs to GlobalPlatform and thus, these APIs are available to all third parties free of charge. Moreover, at least as far as the existing licenses for ARM’s v6 and v7 architecture, ARM will likely not be able to amend the existing license terms and conditions and start charging for TrustZone. As a result, since ARM does not make any profit (and is not likely to make any profit) from the licensing of TrustZone in the near future, a foreclosure strategy aimed at favouring the JV’s TEE solution over competing TEE solutions may be profitable for ARM, at least in the short-run. Whilst the cost of foreclosure could increase over time (as TEE solutions gain broader market acceptance, and ARM can start charging its customers for TrustZone), the transaction may still induce ARM to favour the JV's TEE solution in order to increase its downstream revenues, at least in the short-run.

171. In other words, in the Commission’s view, as of today, there appears to be limited correlation between ARM's sales of IP and the offer of TEE solutions. Hence, a foreclosure strategy by ARM is not likely to have any negative effect on ARM's core IP revenues at least in the short run. Accordingly, the Commission considers that there is a serious concern that ARM may face an incentive to foreclose the JV's competitors.

Overall likely impact on competition and consumers

Views of the notifying parties

172. The notifying parties submit that the proposed transaction will not have any foreclosure effect on the JV's TEE competitors, which will continue to be able to operate on the market by providing Trustzone and non-Trustzone-based TEE solutions.

Commission's assessment

173. The Commission observes that a significant number of respondents to the market investigation, including large MNOs and OEMs, consider that the foreclosure of competing TEE providers would negatively affect them by imposing on them a unique TEE solution and a de facto standard. This unique solution would not necessarily be adapted to their specific needs and this could in turn impact the retail market of trusted applications and restrict end customers' choice.

174. With respect of the impact on OEMs, Sony underlines that "If TEE solutions of the proposed JV, G&D and/or Gemalto, which are designed to work with ARM's TrustZone, hold a monopoly position in the field of the TEE solutions in the future, user/customer of a TEE solution would not be able to have any other alternatives of the TEE solutions other than the TEE solution offered by the proposed JV, G&D and/or Gemalto". [98]

175. As regards the effect on end customers, FT-Orange added that: "Pour Orange-FT il est primordial à ce stade du développement des technologies et des usages, que le consommateur puisse librement choisir les services sans que ce choix ne soit entravé artificiellement par des solutions techniques liées aux couches basses des composants/logiciels présents dans le terminal qu’il utilise : ne connaissant pas ces solutions techniques, le client ne peut pas choisir son terminal en ayant connaissance des implications que cela entrainera quant à l’usage des services et applications qui lui seront proposés par des acteurs autres que les équipementiers ou fournisseurs de solutions de sécurité. […] Un fournisseur de service non « choisi » par la JV ne pourra pas bénéficier de la sécurisation native de cette TEE, qui est une solution fermée. Ce fournisseur n’aura aucun choix : s’il veut accéder à des services de sécurisation d’interfaces, il devra passer par la JV, sans possibilité pour lui de bénéficier de solutions alternatives". [99]

176. Another respondent to the market investigation adds that the removal of third party TEE providers would not only remove consumer choice but also affect innovation on the TEE market.

177. The Commission considers that the foreclosure strategy described above is likely to effectively hamper third party developers from launching competing TEEs that are interoperable with the TrustZone technology. As a result customers of the JV, that is to say OEMs, are likely to be adversely affected by it, to the extent that it would restrict their choice and possibly lead to less innovation and higher prices.

178. In turn, less innovation on the TEE market/segment is likely to have a negative impact on the downstream development of pre-issuance and post-issuance of trusted applications. Trusted applications take advantage of the possibilities offered by the secure operating system, that is to say the TEE, in order to provide a value added service to end-customers. Hence, less choice on the TEE market/segment could lead to hamper the development of certain innovative trusted applications. This would in turn restrict consumer choice for MNOs (in the case of pre-issuance trusted applications) and for end-customers (in the case of post-issuance trusted applications).

Overall conclusion

179. In light of the above, the Commission considers that, post transaction, ARM would likely have the ability and the incentive, due to its strong position upstream in the supply of IP for AP for CE devices, to foreclose and/or marginalise the JV’s competitors in the market for the provision of TEE services and that therefore the proposed transaction raises serious doubts as to its compatibility with the internal market.

Contractual tying between ARM's IP and the JV's TEE

180. A few respondents to the market investigation also indicated that, following the proposed transaction, ARM could potentially leverage its position in IP for APs for CE devices by contractually tying its IP offering with the JV's TEE solution.

181. The Commission considers that this concern is unlikely to materialize for a number of reasons, including the fact that ARM's customers are mainly silicon vendors, while the customers of the JV's TEE solutions will likely also be OEMs. It would therefore be very difficult for ARM to engage in any contractual tying vis-à-vis these OEM customers, which will not have a direct contractual relationship with ARM.

182. Moreover, with specific respect to ARM's direct customers, the Commission considers that ARM would likely not have the incentive in engaging in any such conduct. Indeed, contrary to the type of foreclosure strategy outlined in paragraphs 145 to 163 above which would not affect ARM's relationship with its direct customers, a contractual tying strategy would likely harm ARM's sales of its core IP architecture, which would likely be negatively impacted if customers were to be forced to also license the JV's TEE solution and were not to like this conduct.

183. Based on the above, the Commission therefore concludes that the concern according to which, following the proposed transaction, ARM could potentially leverage its position in IP for APs for CE devices by contractually tying its IP offering with the JV's TEE solution should be dismissed.

4. Cooperative effects of the JV

184. Both Gemalto and G&D have a significant presence in the provision of SEs, including, in particular, smart cards (see footnote 39). As explained, each of Gemalto and G&D will also be active in the provision of (post-issuance) trusted applications and TSMs. The Commission takes the view that the creation of the JV will not give rise to the coordination of the behaviour of Gemalto and G&D in each of these markets / segments for the following reasons:

a) Concerning the smart card activity, any coordination in this sector is not likely to be related to the present Transaction. First, the supply of smart cards is not vertically related to the JV’s activity. Second, the difference in customers also excludes any conglomerate links between them. AP-based security solutions are purchased by OEMs and semiconductor manufacturers. Smart cards are instead purchased by MNOs (UICC/SIM cards) and service providers (Micro SD cards). Third, smart cards and TEEs are technically different and have different end uses. While the primary end use of smart cards is the identification and authentication of users in the network, TEEs aim at protecting services and applications against various threats and software attacks. Hence, there is no risk of meaningful anti-competitive coordination, related to the present Transaction, between G&D and Gemalto in the smart cards industry.

b) With respect of the development of post-issuance trusted applications, it is a highly fragmented sector; G&D and Gemalto will compete with hundreds of thousands of application developers, many of which are well-established software companies. In contrast, software development is not G&D’s and Gemalto’s core business. Their combined market share in the medium term is expected to be lower than [10-20]%. Accordingly, there is no risk of meaningful anti-competitive coordination between G&D and Gemalto regarding post-issuance applications.

c) As regards TSM activities, current NFC-enabled TSM customers include issuing banks, public transportation operators, and MNOs. The customer base for TEE TSMs is expected to be comparable, with potentially new players such as vendors of enterprise security, e-commerce loyalty programs, and video-on-demand services. Given the dynamic and structure of the TSM business, the shares of G&D and Gemalto is not likely to exceed [10-20]% in the medium term. Accordingly, there is no risk of meaningful coordination between G&D and Gemalto.

Overall conclusion of the competitive assessment

185. Given the above, the Commission has serious doubts as to the compatibility of the transaction with the internal market. In particular, the Commission considers that, due to its very strong position in the upstream market for the licensing of IPs for APs for CE devices, post transaction, ARM would likely have the ability and incentive to favour the JV over competing providers of TEE solutions in the provision of the necessary information for the JV's competitors to be able to develop a TEE solution based on ARM's hardware architecture. This, in turn, would likely lead to a reduction of competition in the market for the provision of TEE solutions since these competitors will likely be unable to develop TEE solutions which interoperate with ARM's hardware architecture, which is almost omnipresent in smartphones and tablets, and which is included in the vast majority of CE devices currently existing on the market.

VI. COMMITMENTS

186. At the State of Play meeting of 4 October 2012, the Commission related to the notifying parties the following concerns based on the preliminary results of the market investigation:

a) The proposed transaction raises serious doubts as to its compatibility with the internal market as a result of ARM's ability and incentive to foreclose the JV's competitors in the provision of TEE solutions , by refusing to (fully and timely) disclose to these competitors the necessary information for competing TEE solutions to work on ARM's TrustZone hardware ("foreclosure concern").

b) Some respondents to the market investigation consider that ARM may seek to tie the grant of licence to use ARM IP to a requirement for the customer also to licence the JV's TEE solution ("tying concern", together with the foreclosure concern referred to in the following as "non-horizontal concerns").

c) A number of respondents to the market investigation consider that the proposed transaction would bring together the two most advanced TEE solutions, which could result in the creation or strengthening of a dominant position of the JV's TEE absent the timely and credible entry of competitors in the growing market/ segment of TEE solutions, and that the development of a "closed" ecosystem of trusted applications (which could not be interoperable with alternative TEEs) could raise barriers to entry for actual or potential competitors ("horizontal concern").

187. In order to address these concerns, the notifying parties submitted, on 12 October 2012, commitments (the "First Commitments"). The Commission launched a market test of the First Commitments on the same day in order to gather the views of relevant market participants on their effectiveness and their ability to restore effective competition in the markets where competition concerns were identified (the "market test").

188. Following the launch of the market test, the Commission continued its market investigation, notably by conducting a number of interviews with actual or potential competitors of the JV. In light of the responses to the market test, as well as the results of the supplementary market investigation, the Commission was able to exclude the horizontal concern and the tying concern for the reasons fully developed in sections V.2.1 and V.3.3.5 above, respectively.

189. On 22 October 2012, the Commission communicated the results of the supplementary market investigation and of the market test to the notifying parties. In accordance with the Remedies Notice, [100] the Commission informed them that its final assessment shows that there are no competition concerns with respect to the horizontal and tying concerns and that the notifying parties may withdraw the unnecessary commitments that had purported to address these issues. The Commission, however, also