Court of Justice of the European Communities (including Court of First Instance Decisions)

ORDER OF THE PRESIDENT OF THE GENERAL COURT

29 October 2020 (*)

(Interim proceedings – Competition – Request for information – Article 18(3) of Regulation (EC) No 1/2003 – Application for interim measures – Urgency – Prima facie case – Weighing of competing interests)

In Case T‑451/20 R,

Facebook Ireland Ltd, established in Dublin (Ireland), represented by D. Jowell QC, D. Bailey, Barrister, J. Aitken, D. Das, S. Malhi, R. Haria, M. Quayle, Solicitors and T. Oeyen, lawyer,

applicant,

v

European Commission, represented by G. Conte, C. Urraca Caviedes and C. Sjödin, acting as Agents,

defendant,

APPLICATION under Articles 278 and 279 TFEU seeking the suspension of operation of Decision C(2020) 3011 final of the European Commission of 4 May 2020, relating to a proceeding pursuant to Article 18(3) and Article 24(1)(d) of Council Regulation (EC) No 1/2003 (Case AT.40628 – Facebook Data-related practices),

THE PRESIDENT OF THE GENERAL COURT

makes the following

Order

 Background to the dispute, procedure and forms of order sought

1        On 13 March 2019, the European Commission sent a request for information to the applicant, Facebook Ireland Ltd, by decision adopted pursuant to Article 18(3) of Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation of the rules on competition laid down in Articles [101] and [102 TFEU] (OJ 2003 L 1, p. 1). That request for information comprised more than 100 unique questions, concerning various aspects of the applicant’s business and product offering.

2        The applicant replied to that request for information in three stages, on 23 April, 21 May and 18 June 2019. The documents produced were identified based on an initial search conducted by way of keyword searching and a relevance review carried out by Facebook’s external EU-qualified lawyers.

3        On 30 August 2019, the Commission sent a request for information pursuant to Article 18(2) of Regulation No 1/2003. That request for information comprised 83 unique questions regarding Facebook Marketplace, social networking and online classified advertisement providers.

4        The applicant replied to that request for information in three stages, on 30 September, 10 October and 5 November 2019.

5        On 11 November 2019 the Commission adopted a further decision under Article 18(3) of Regulation No 1/2003. The Commission requested the applicant to provide, inter alia, a number of internal documents meeting certain cumulative criteria, namely documents that were prepared by or for, or received by, certain custodians; were dated from 1 January 2013 until the date of the decision of 11 November 2019 and contained certain search terms or search query syntaxes. In particular, two different sets of search terms were to be applied to two sets of custodians respectively. For one set of custodians, the search terms to be used were those which the applicant itself had selected and used on its own initiative in order to search for and identify internal documents to be submitted in response to the decision of 13 March 2019. For the second set of custodians, the search terms to be used had been formulated by the Commission on the basis of, first, the applicant’s own internal documents and responses submitted in reply to the decision of 13 March 2019 and, secondly, certain internal documents of the applicant published on 5 December 2018 by the Digital, Culture, Media and Sport Committee of the Parliament of the United Kingdom of Great Britain and Northern Ireland.

6        By letter of 20 November 2019, the applicant expressed its concerns regarding the necessity and proportionality of, and sufficiency of reasons for, several aspects of the request. A series of exchanges took place between the applicant and the Commission with the aim of refining the search terms and reducing the number of documents identified.

7        On 17 January 2020, the Commission sent the applicant a revised set of search terms.

8        On 22 January 2020, the Commission informed the applicant of its intention to adopt a new decision containing amended search terms.

9        On 4 May 2020, the Commission adopted two decisions under Article 18(3) of Regulation No 1/2003, a decision relating to Marketplace (Case AT.40684 – Facebook Marketplace) and Decision C(2020) 3011 final of 4 May 2020 relating to a proceeding pursuant to Article 18(3) and to Article 24(1)(d) of Council Regulation No 1/2003 (Case AT.40628 – Facebook Data-related practices) (‘the contested decision’). Under Article 1 of the contested decision, the applicant is to supply the Commission with the information specified in Annexes I.A, I.B and I.C to the decision by 15 June 2020. Article 2 provides for a potential penalty payment of EUR 8 million per day for non-compliance with the requests for information.

10      On the same day, the Director-General of the Commission’s Directorate-General (DG) for Competition sent the applicant a letter proposing a separate procedure for the production of sensitive documents which, according to the applicant, contained only personal information wholly unconnected with its commercial activities. Those documents would be placed on the file only after having been examined in a virtual data room.

11      In a series of exchanges, the applicant and the Commission discussed possible ways in which the virtual data room might be used.

12      By letter of 12 June 2020, the Commission agreed to extend until 27 July 2020 the period within which the applicant was required to reply to the request for information contained in the contested decision.

13      By application lodged at the Court Registry on 15 July 2020, the applicant brought an action for annulment of the contested decision.

14      By separate document lodged at the Court Registry on 15 July 2020, the applicant brought the present application for interim measures, in which it claims, in essence, that the President of the General Court should:

–        suspend the operation of the contested decision until the Court rules on the main action;

–        alternatively, suspend the operation of Article 1 of the contested decision in so far as it captures documents that contain information that is, in the assessment of the applicant’s EU-qualified external counsel, entirely unrelated and unnecessary for the Commission’s investigation;

–        in the further alternative, suspend the operation of Article 1 of the contested decision in so far as it captures irrelevant documents and permit the applicant to disclose such documents into a secure virtual data room, maintained by its independent, EU-qualified external counsel, which cannot be accessed by any person pending the resolution of the main action relating to data;

–        in the yet further alternative, suspend the operation of Article 1 of the contested decision in so far as it captures irrelevant documents and permit the applicant to disclose such irrelevant documents into a secure virtual data room, maintained by its independent, EU-qualified external counsel, with such appropriate controls on access by the Commission as the Court thinks fit;

–        order the Commission to pay the costs.

15      By order of 24 July 2020, Facebook Ireland v Commission (T‑451/20 R, not published), adopted on the basis of Article 157(2) of the Rules of Procedure of the General Court, the President of the General Court ordered that the operation of the contested decision be suspended until the date of the order terminating the present proceedings for interim relief.

16      By letter of the same date, the Commission informed the Court that there was no longer any need to adopt an order on the basis of Article 157(2) of the Rules of Procedure, since it had agreed to extend the deadline of 27 July 2020 until five days after the decision ruling on the application for interim measures.

17      On 4 August 2020, the applicant submitted its observations on the Commission’s letter of 24 July 2020.

18      In its observations lodged at the Court Registry on 6 August 2020, the Commission contends that the President of the General Court should:

–        dismiss the application for interim relief; and

–        order the applicant to pay the costs.

19      By letter of 10 August 2020, the applicant informed the Court that 645 459 documents of the 729 417 documents requested under the contested decision would be provided to the Commission, with the result that the application for interim measures would concern only the remaining 83 958 documents.

20      An informal meeting took place on 2 September 2020.

21      By letter of 8 September 2020, the applicant informed the Court of the proposal for an alternative procedure for the production of the remaining documents which it had sent to the Commission.

22      The Commission lodged its observations on that proposal on 17 September 2020.

 Law

 General

23      It is apparent from Articles 278 and 279 TFEU, read in conjunction with Article 256(1) TFEU, that the judge hearing an application for interim measures may, if he considers that circumstances so require, order that the operation of an act contested before the General Court be suspended or prescribe any necessary interim measures, pursuant to Article 156 of the Rules of Procedure. Nevertheless, Article 278 TFEU establishes the principle that actions do not have suspensory effect, since acts adopted by the institutions of the European Union are presumed to be lawful. It is therefore only exceptionally that the judge hearing an application for interim measures may order the suspension of operation of an act challenged before the General Court or prescribe any interim measures (order of 19 July 2016, Belgium v Commission, T‑131/16 R, EU:T:2016:427, paragraph 12).

24      The judge hearing an application for interim measures may order suspension of operation of an act and other interim measures, if it is established that such an order is justified, prima facie, in fact and in law, and that it is urgent in so far as, in order to avoid serious and irreparable harm to the applicant’s interests, it must be made and produce its effects before a decision is reached in the main action. Those conditions are cumulative, and consequently an application for interim measures must be dismissed if any one of them is not satisfied. The judge hearing an application for interim measures is also to undertake, where necessary, a weighing of the competing interests (see order of 2 March 2016, Evonik Degussa v Commission, C‑162/15 P-R, EU:C:2016:142, paragraph 21 and the case-law cited).

 Preliminary remarks

25      In the circumstances of the present case, it is appropriate, as a preliminary point, to clarify the scope of the application for interim measures relating to the contested decision.

26      First, as was confirmed at the informal meeting of 2 September 2020, the documents which the applicant is required to produce pursuant to the contested decision have already been identified. Furthermore, their nature and content have been examined by the applicant’s external counsel.

27      Secondly, it is apparent from the applicant’s letter of 10 August 2020 that 645 459 documents of the 729 417 documents requested under the contested decision have been provided to the Commission, with the result that the application for interim measures concerns only the remaining 83 958 documents.

28      Third, it is apparent from the discussions which took place at the informal meeting of 2 September 2020 and from the information supplied by the applicant in its letter sent to the Commission on 8 September 2020 that, according to the applicant, the remaining 83 958 documents may be divided into the following categories:

–        documents containing purely personal information: the applicant cites, by way of example, exchanges between natural persons and their partners and children, documents containing personal security arrangements, documents relating to the guardianship of children, documents relating to personal wills, correspondence at a times of great personal distress, correspondence with doctors and other medical professionals and documents relating to human resources management, such as documents relating to personal time off, workplace complaints and compensation;

–        documents containing personal opinions and political engagement: the applicant cites, by way of example, documents which describe the personal political opinions of its employees and senior executives, documents relating to its role in supporting the integrity of democratic elections, personal correspondence of natural persons or correspondence with Heads of State, government officials, regulators, philanthropic organisations and public figures on matters such as combating terrorism, combating crime, law enforcement and cybersecurity;

–        documents engaging the applicant’s right to privacy: it cites, by way of example, documents relating to the security assessments of its premises and documents concerning disputes between its employees;

–        documents relating to the applicant’s business activities: it cites, by way of example, documents relating to its efforts as regards diversity issues, documents relating to its website content moderation activities, commercially sensitive documents regarding its tax affairs, stock market announcements, or the licensing of sports content.

29      It should be noted that the delimitation of the four categories and the classification of the documents is a difficult exercise, since certain documents may fall within several categories.

 The prima facie case requirement

30      The prima facie case requirement is satisfied where at least one of the pleas in law put forward by the party seeking interim measures in support of the main action appears, at first sight, not to be unfounded. That is the case where one of those pleas reveals the existence of a major legal or factual disagreement the solution to which is not immediately obvious and therefore calls for a detailed examination that cannot be carried out by the judge hearing the application for interim measures but must be the subject of the main proceedings (see, to that effect, orders of 3 December 2014, Greece v Commission, C‑431/14 P-R, EU:C:2014:2418, paragraph 20 and the case-law cited, and of 1 March 2017, EMA v MSD Animal Health Innovation and Intervet international, C‑512/16 P(R), not published, EU:C:2017:149, paragraph 59 and the case-law cited).

31      In the present case, in order to demonstrate that that requirement is satisfied, the applicant refers to four pleas in law.

32      By its first and fourth pleas, the applicant alleges that the subject matter of the Commission’s investigation is not defined in sufficiently clear or consistent terms and that, consequently, the contested decision is contrary to the principle of legal certainty and breaches both the obligation to state reasons and the applicant’s rights of defence.

33      By its second plea, the applicant submits that the contested decision infringes Article 18(3) of Regulation No 1/2003 on the ground that, by requiring the applicant to produce many documents that are irrelevant to the Commission’s investigation, that decision is contrary to the principle of necessity, infringes the applicant’s rights of defence and constitutes a misuse of the powers conferred on the Commission by Article 18(3) of Regulation No 1/2003 with the improper purpose of obtaining information that is not relevant to the potential infringements as described in the contested decision.

34      By its third plea, the applicant submits that, by requiring the production of many private and irrelevant documents, the contested decision infringes the fundamental right to privacy enshrined in Article 7 of the Charter of Fundamental Rights of the European Union (‘the Charter’) and Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’), the principle of proportionality and the fundamental right to good administration.

 The second plea in law, alleging infringement of Article 18(3) of Regulation No 1/2003

35      Article 18(1) of Regulation No 1/2003 allows the Commission to request undertakings and associations of undertakings, by simple request or by decision, to provide ‘all necessary information’ for the performance of the duties assigned to it by Articles 101 to 103 TFEU and Regulation No 1/2003.

36      According to settled case-law, the Commission is entitled to require the disclosure only of information which may enable it to investigate the presumed infringements which justify the conduct of the investigation and are set out in the request for information (judgments of 12 December 1991, SEP v Commission, T‑39/90, EU:T:1991:71, paragraph 25, and of 8 March 1995, Société générale v Commission, T‑34/93, EU:T:1995:46, paragraph 40).

37      Since the necessity of the information must be judged in relation to the purpose stated in the request for information, that purpose must be indicated with sufficient precision, otherwise it will be impossible to determine whether the information is necessary and the EU judicature will be prevented from exercising judicial review (see judgment of 10 March 2016, Schwenk Zement v Commission, C‑248/14 P, not published, EU:C:2016:150, paragraph 28 and the case-law cited).

38      Given the Commission’s broad powers of investigation and assessment, it falls to it to assess whether the information which it requests from the undertakings concerned is necessary. As regards the Court’s power of review over that assessment by the Commission, it should be noted that, according to the case-law, the concept of ‘necessary information’ must be interpreted by reference to the objectives for the achievement of which the powers of investigation in question have been conferred upon the Commission. Thus, the requirement that a correlation must exist between the request for information and the presumed infringement will be satisfied as long as, at that stage in the procedure, the request may legitimately be regarded as having a connection with the presumed infringement, in the sense that the Commission may reasonably suppose that the information will help it to determine whether the alleged infringement has taken place (judgment of 14 March 2014, Holcim (Deutschland) and Holcim v Commission, T‑293/11, not published, EU:T:2014:127, paragraph 110).

39      In the present case, in the first place, it should be noted that the documents requested under the contested decision were identified on the basis of wide-ranging search terms, some of which consist of frequently used or very common words, such as ‘big question’, ‘for free’, ‘shut
down’ and ‘not good for us’. It is therefore hardly surprising that the application of those search terms would lead to the obligation to produce documents unrelated to the subject matter of the request for information. The Commission itself admits that certain documents requested are not relevant and necessary for its investigation.

40      However, according to the Commission, even if the search terms are well selected and targeted in order to produce documents potentially relevant to the investigation, it is inevitable that they may capture some documents that actually prove not to be directly relevant to the investigation. According to the Commission, the requirement that there must be a correlation between the request for information and the alleged infringement should be assessed on the basis of the search terms and not on the basis of the documents that must be produced in response to those terms. The Commission asserts that the fact that some of those documents may turn out to be irrelevant to the investigation is in no way an indication that the search terms on which the request for information is based are disproportionate or unlawful.

41      In that regard, first, it should be borne in mind that the applicant submits that the contested decision is disproportionate on the ground, inter alia, that the search terms set out in that decision are not accompanied by a method which allows irrelevant documents to be excluded.

42      Thus, the dispute between the parties seems to relate in particular to the appropriate method and the modalities of verifying the relevance of the documents requested and therefore to the question whether, in the absence of such a method, the request for information would be contrary to the principles of necessity and proportionality.

43      Secondly, it is apparent from the nature of the request for information at issue that its scope materialises only after the search terms are applied to the applicant’s electronic files in order to identify the documents corresponding to those terms. As pointed out in paragraph 26 above, all the documents requested under the contested decision have been identified, which will enable the Court adjudicating on the substance to assess the necessity of that information in the light of the presumed infringements. The Commission’s argument that the nature and content of the requested documents cannot be taken into account when assessing the necessity of the request is therefore unconvincing at first sight.

44      In the second place, it must be borne in mind that Article 18 of Regulation No 1/2003 is not the only way for the Commission to gather the information necessary for its investigations. It may also order inspections at the premises of the undertaking on the basis of Article 20 of that regulation. In the course of inspections, the Commission may make copies of potentially relevant electronic documents for the purposes of the investigation in order to examine them subsequently with a view to their actual relevance for the investigation. The Commission submits, relying on the reasoning followed in the judgment of 16 July 2020, Nexans France and Nexans v Commission (C‑606/18 P, EU:C:2020:571), that the rules applicable to inspections should necessarily be at least as strict as those applicable to responses to requests for information and that those rules do not preclude its officials from taking a cursory look at documents potentially containing private data.

45      In the course of those inspections, which are considered by their very nature to be more invasive, the undertakings concerned enjoy certain procedural guarantees (see, to that effect, judgment of 26 November 2014, Energetický a průmyslový and EP Investment Advisors v Commission, T‑272/12, EU:T:2014:995, paragraph 68). Those guarantees provide, inter alia, that documents of a non-business nature, that is to say, documents not relating to the market activities of the undertaking are excluded from the scope of the Commission’s investigatory powers (judgments of 18 May 1982, AM & S Europe v Commission, 155/79, EU:C:1982:157, paragraph 16, and of 22 October 2002, Roquette Frères, C‑94/00, EU:C:2002:603, paragraph 45). In addition, undertakings which are the subject of an inspection ordered by an inspection decision may receive legal assistance (see, to that effect, judgment of 14 September 2010, Akzo Nobel Chemicals and Akcros Chemicals v Commission, C‑550/07 P, EU:C:2010:512, paragraphs 40 to 44).

46      According to paragraph 64 of the judgment of 16 July 2020, Nexans France and Nexans v Commission (C‑606/18 P, EU:C:2020:571), to which the Commission refers, the Commission must respect the rights of defence of the undertaking concerned when it assesses whether the data is relevant to the subject matter of the inspection, before placing the documents found to be relevant in the file and deleting the remainder of the copied data.

47      In the present case, the request for information at issue is very similar to such an inspection, since the applicant must produce a large number of documents collected on its servers on the basis of search terms, the relevance of which will be assessed by the Commission only at a later stage. No additional specific measures are provided for to ensure respect for the rights of the undertaking concerned in view of the number of documents requested and the strong likelihood that many of those documents will not be necessary for the purposes of the Commission’s investigation.

48      Accordingly, it is not unreasonable to consider that, in the light of the format and scope of the request for information, a level of protection similar to that guaranteed by Article 20 of Regulation No 1/2003 should apply.

49      The other arguments put forward by the Commission do not appear to be such as to undermine that conclusion.

50      The Commission contends that, according to the case-law on requests for information, its officials must be able to review a large number of potentially relevant documents in order to identify those actually relevant to the investigation. It follows from that case-law that the Commission is entitled to request ‘information which may enable it to investigate the presumed infringements which justify the conduct of the investigation’ provided that there is a correlation between the request for information and the presumed infringement.

51      It should be pointed out in that regard, first, that that case-law does not mean that the principles of necessity and proportionality cease to apply to requests for information. As the Commission itself notes, it follows from that case-law that the Commission must reasonably suppose that the requested information will help it to determine whether the presumed infringement has taken place.

52      Secondly, the fact that Commission officials must respect certain procedural guarantees does not mean that they are no longer able to identify, among the large number of documents which correspond to the search terms, the documents which are relevant for the purposes of the Commission’s investigation.

53      It follows from all the foregoing that, in view of the wide-ranging nature of the search terms and taking into account the likelihood that those terms will capture a large number of documents which are not necessarily relevant to the Commission’s investigation, it cannot be ruled out at this stage that, in the absence of a method of verification accompanied by appropriate and specific guarantees designed to safeguard the rights of the persons concerned, the Court ruling on the main action will find that the contested decision does not comply with Article 18(3) of Regulation No 1/2003.

 The third plea in law, alleging infringement of the fundamental right to privacy enshrined in Article 7 of the Charter and Article 8 ECHR

54      It should be noted that, under Article 7 of the Charter, everyone has the right to respect for his or her private and family life, home and communications.

55      In that connection, Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and must respect the essence of those rights and freedoms. In addition, subject to the principle of proportionality, limitations may be imposed only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.

56      As regards Article 8 ECHR, Article 52(3) of the Charter states that ‘in so far as this Charter contains rights which correspond to rights guaranteed by the [ECHR], the meaning and scope of those rights shall be the same as those laid down by the said Convention’.

57      With respect to the present case, the Court of Justice has already held that the exercise of the powers of inspection under Article 20(4) of Regulation No 1/2003 vis-à-vis an undertaking constitutes a clear interference with the latter’s right to respect for its privacy, private premises and correspondence (judgment of 6 September 2013, Deutsche Bahn and Others v Commission, T‑289/11, T‑290/11 and T‑521/11, EU:T:2013:404, paragraph 65). That reasoning appears to be transposable to the present case in the context of the powers exercised under Article 18(3) of Regulation No 1/2003. It is therefore necessary to examine whether the contested decision satisfies the conditions laid down in Article 52(1) of the Charter and Article 8(2) ECHR.

58      According to those conditions, the limitation must first be provided for by law. The measure in question must therefore have a legal basis (see judgment of 28 May 2013, Trabelsi and Others v Council, T‑187/11, EU:T:2013:273, paragraph 79 and the case-law cited).

59      That is so in the present case since the contested decision was adopted on the basis of Article 18(3) of Regulation No 1/2003, a provision which confers on the Commission the power to require, by decision, undertakings and associations of undertakings to supply information.

60      Next, as regards the condition that, subject to the principle of proportionality, limitations may be imposed only if they genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others, it should be noted that the exercise of the powers conferred on the Commission by Regulation No 1/2003 contributes to the maintenance of the system of competition intended by the Treaties, with which undertakings are absolutely bound to comply. The contested decision, which was adopted on the basis of Regulation No 1/2003, therefore meets objectives of general interest recognised by the European Union.

61      Lastly, as regards the question whether the contested decision goes beyond what is necessary in order to attain those objectives of general interest, it is apparent from the analysis of compliance with the principle of necessity under Article 18(3) of Regulation No 1/2003 carried out in paragraphs 39 to 53 above that the applicant’s argument that it is required to provide documents which cannot be regarded as necessary to the Commission for the purpose of establishing the presumed infringements does not appear, prima facie, to be unfounded.

62      That conclusion is all the more compelling in respect of documents containing personal data, in particular those containing data which may be characterised as sensitive, the processing of which is a particularly delicate matter as regards the protection of privacy (‘sensitive personal data’). The applicant cites, for example, documents containing private correspondence of employees concerning medical and autopsy reports and correspondence of employees at times of great personal distress.

63      In that regard, it should be noted that, in view of the extremely personal and sensitive nature of medical data, the treatment of that data requires a particularly rigorous examination (judgment of 12 September 2019, XI v Commission, T‑528/18, not published, EU:T:2019:594, paragraph 67).

64      It should also be borne in mind that both Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39), and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, ‘the GDPR’), provide for a higher level of protection for data in special categories, namely personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

65      In that context, the Commission submits that Article 5(1)(a) of Regulation 2018/1725 provides that the EU institutions may lawfully process personal data where it ‘is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body’. The Commission also refers to the letter from the European Data Protection Supervisor (EDPS) of 22 October 2018 (WW/OL/sn/D (2018) 2422 C 2018-0632), in which it is stated that, although ‘Commission investigations and enforcement activities in the competition field target undertakings or Member States which are subject to the competition rules of the Treaty, and not natural persons as such’, ‘during competition investigations inevitably also personal data are being processed’. That document adds that ‘processing such personal data is necessary to fulfil the tasks assigned to the Commission as public authority enforcing EU competition rules’. The Commission also submits that, according to the EDPS ‘the GDPR does not prevent the submission of information containing personal data to EU institutions, either in response to a legal obligation to do so or on a voluntary basis’.

66      In that regard, while it is true that, according to the EDPS’s letter, the GDPR does not prevent the transmission of information containing personal data to the EU institutions, the fact remains that the Commission must respect the limits to its powers imposed on it by both Regulation No 1/2003 and Regulation 2018/1725. It is apparent from the EDPS’s letter that, in order for the collection and subsequent processing of personal data to be lawful under Article 5(a) of Regulation 2018/1725, that collection and processing must be necessary and proportionate to the exercise of the Commission’s powers.

67      As pointed out in paragraph 53 above, given the wide-ranging nature of the search terms and given the likelihood that they will capture a significant number of documents which are not necessarily relevant to the Commission’s investigation, it cannot be ruled out, at this stage, that the Court adjudicating on the substance might consider that the contested decision does not comply with Article 18(3) of Regulation No 1/2003 in the absence of a method of verifying the relevance of documents accompanied by appropriate and specific guarantees for safeguarding the rights of the persons concerned. Moreover, the fact that the Commission uses, for the purposes of its investigations, search methods which inevitably require the processing of personal data does not mean that it is not required to take account of the sensitivity of some of that data.

68      In those circumstances, the plea alleging infringement of Article 7 of the Charter and Article 8 ECHR does not appear, prima facie, to be unfounded.

69      It must therefore be held that there is a prima facie case in so far as, at first sight, the second and third pleas in law do not appear to be unfounded.

 The urgency requirement

70      In order to determine whether the interim measures sought are urgent, it should be borne in mind that the purpose of the procedure for interim relief is to guarantee the full effectiveness of the future final decision, in order to prevent a lacuna in the legal protection afforded by the EU judicature. To attain that objective, urgency must, generally, be assessed in the light of the need for an interlocutory order to avoid serious and irreparable damage to the party requesting the interim measure. That party must demonstrate that it cannot await the outcome of the main proceedings without suffering serious and irreparable damage (see order of 14 January 2016, AGC Glass Europe and Others v Commission, C‑517/15 P-R, EU:C:2016:21, paragraph 27 and the case-law cited).

71      Although in order to establish the existence of serious and irreparable damage it is not necessary for the occurrence of the damage to be demonstrated with absolute certainty, it being sufficient to show that damage is foreseeable with a sufficient degree of probability, the party seeking an interim measure is nevertheless required to prove the facts forming the basis of its claim that serious and irreparable damage is likely (order of 14 December 1999, HFB and Others v Commission, C‑335/99 P(R), EU:C:1999:608, paragraph 67).

72      In order to demonstrate the serious and irreparable nature of the damage, the applicant alleges, in essence, the following four categories of harm whose impact is, in the applicant’s view, impossible to assess: the harm resulting from the breach of the fundamental right to privacy of the applicant, its employees and other individuals, contrary to Article 7 of the Charter and Article 8(1) ECHR; the harm suffered as a result of disclosure of the documents in question outside the Commission; the harm suffered as a result of the possible use by the Commission of irrelevant documents for the purpose of initiating new investigations into infringements which it has not yet articulated or of which it has not yet notified to the applicant or in order to make proposals for sector-specific regulation; and the harm resulting from the fact that it would be deprived of the effective judicial protection enshrined in Article 47 of the Charter.

 The alleged harm resulting from the breach of the right to privacy

73      The applicant submits that the disclosure of the documents at issue would give rise to an imminent risk of serious harm arising from the breach of the fundamental right to privacy of the applicant, its employees and other individuals, contrary to Article 7 of the Charter and Article 8(1) ECHR.

74      It must be noted that, according to the settled case-law of the Court of Justice, the argument that harm is, by definition, serious and irreparable because it comes within the scope of fundamental freedoms cannot be accepted since it is not sufficient to allege infringement of fundamental rights in the abstract for the purpose of establishing that the harm which could result would necessarily be serious and irreparable. It remains for the party seeking the adoption of interim measures to set out and establish the likelihood of such harm occurring in his or her particular case (see, to that effect, order of 10 September 2013, Commission v Pilkington Group, C‑278/13 P(R), EU:C:2013:558, paragraphs 40 and 41).

75      Consequently, it is necessary to examine whether, in the present case, the applicant has demonstrated to the requisite legal standard the likelihood of serious and irreparable harm occurring in its particular case.

76      For the purposes of that examination, it is necessary to analyse, first, whether serious and irreparable harm results from the breach of the applicant’s right to privacy and, secondly, whether such harm results from the breach of individuals’ right to privacy.

–       The alleged harm resulting from the breach of the applicant’s right to privacy

77      In order to demonstrate the existence of serious harm resulting from the infringement of its right to privacy, the applicant submits, referring to the judgment of 14 February 2008, Varec (C‑450/06, EU:C:2008:91), that the Court of Justice has held that an undertaking could suffer ‘extremely serious damage’ if internal documents of a confidential nature were improperly communicated.

78      First, it should be noted that the applicant’s argument based on the judgment of 14 February 2008, Varec (C‑450/06, EU:C:2008:91), that an undertaking could suffer extremely serious harm in the event of improper communication of confidential information, is not convincing in the present case. In the case which gave rise to that judgment, the risk of serious harm resulted from the improper communication of certain information to a competitor of the undertaking concerned. That is not the case here, since the documents in question would be disclosed only to the Commission’s services.

79      Similarly, the conclusion reached by the judge hearing the application for interim measures in the order of 16 November 2012, Akzo Nobel and Others v Commission (T‑345/12 R, EU:T:2012:605), cannot be transposed to the present case, since the considerations taken into account by the judge hearing the application for interim measures in order to conclude that the urgency requirement was satisfied in that case were based on the premiss that, if the application for interim measures were dismissed, the Commission could immediately publish the information at issue. It must be pointed out that, as the Commission submits, the documents at issue in the present case will not be communicated to the public.

80      Secondly, officials and other servants of the Commission are subject to strict obligations of professional secrecy under Article 339 TFEU and Article 28 of Regulation No 1/2003. Those provisions prohibit Commission officials from disclosing or using information obtained in response to a request for information for purposes other than those for which it was acquired. Furthermore, officials and other servants of the Commission are bound by Article 17 of the Staff Regulations of Officials of the European Union to refrain, even after they have ceased to hold office, from ‘any unauthorised disclosure of information received in the line of duty, unless that information has already been made public or is accessible to the public’.

81      It follows from the foregoing that, in the light of those obligations, the applicant has not shown that it would suffer serious and irreparable harm as a result of the disclosure to the Commission of the documents referred to in paragraph 72 above.

–       The alleged harm resulting from the breach of individuals’ right to privacy

82      The applicant invokes serious and irreparable harm as a result of the fact that personal data will be placed on the file and examined by any person having access to it. According to the applicant, that damage would in turn cause serious and irreparable damage to its reputation, which could not be adequately quantified or compensated by any award of damages.

83      As noted in paragraph 80 above, Commission officials are bound by confidentiality obligations which prevent them from using information obtained in response to a request for information for purposes other than those for which it was obtained and from disclosing information received in the course of their duties, unless that information has already been made public or is accessible to the public.

84      In the light of those obligations, the mere fact that the Commission’s officials verify the relevance of documents containing personal data cannot, in principle, in itself cause serious and irreparable harm. However, the applicant argues that the documents requested under the contested decision include documents which contain sensitive personal data. Since that data is shared only in the most private sphere, any undue extension of the circle of third parties who have knowledge of it may cause serious and irreparable harm to the persons concerned. As stated in paragraph 64 above, both Regulation 2018/1725 and the GDPR provide for increased protection for data falling within certain specific categories, in particular data revealing political opinions or data concerning an individual’s health.

85      It should also be noted that the Court found, in the context of an action for damages, that harm could result from the fact that certain Commission officials had, during the administrative procedure, acquainted themselves with medical data and had revealed them in the contested decision, even though such an interference with the applicant’s fundamental rights, enshrined in Articles 7 and 8 of the Charter, was not necessary in order to adopt and state reasons for that decision (see, to that effect, judgment of 12 September 2019, XI v Commission, T‑528/18, not published, EU:T:2019:594, paragraph 75). It stated in particular that, regardless of the confidentiality rules under which those data had been processed, taking into account the extremely intimate and sensitive nature of the medical data, the applicant could legitimately have felt injured.

86      It follows from the foregoing that enlargement of the circle of persons with knowledge of sensitive personal data risks causing serious harm to the persons concerned by that data.

87      As regards the irreversible nature of the harm, it should be noted that the annulment of the contested decision could not reverse the effects of the disclosure of the data, since awareness of that information by the persons who read it is immediate and irreversible.

88      The Commission submits that the applicant cannot rely on an alleged serious and irreparable harm suffered by its employees and other persons without showing the serious and irreparable harm that the applicant itself would be likely to suffer in the event of an alleged breach of the privacy of its employees and other persons.

89      It is true that, according to settled case-law, the applicant must show that the suspension of operation sought is necessary for the protection of its own interests and it cannot, for the purpose of establishing urgency, plead damage which is not personal to it, such as, for example, damage to the rights of third parties. Accordingly, an applicant cannot validly rely on the damage which its employees alone would suffer to substantiate the urgency of the suspension of operation sought; rather the applicant must show that such damage is likely to entail – for itself – serious and irreparable personal harm (see, to that effect, order of 11 March 2013, Pilkington Group v Commission, T‑462/12 R, EU:T:2013:119, paragraphs 41 and 42 and the case-law cited).

90      However, the reasoning followed in the order of 11 March 2013, Pilkington Group v Commission (T‑462/12 R, EU:T:2013:119), cannot be transposed to the circumstances of the present case.

91      First, the present case is particular in that the contested decision imposes on the applicant a positive obligation to search for all of its electronic files on the basis of broad search terms and to communicate to the Commission the documents responding to those search terms, even if those documents contain sensitive personal data. Moreover, this is an obligation addressed by name to the applicant and not to the natural persons concerned, an obligation which the applicant must discharge within a strict time period and on pain of a periodic penalty payment.

92      Secondly, the applicant correctly claims that that obligation requires it to process sensitive personal data.

93      Admittedly, it is apparent from the EDPS’s letter to which the Commission refers that the GDPR does not prevent the transmission of information containing personal data to the EU institutions, whether in compliance with a legal obligation or on a voluntary basis, provided that the Commission acts within the framework of its powers. However, that letter does not address the problem in the present case. First, it states that the EDPS has no supervisory powers over economic operators which are supervised by the national data protection authorities in the Member States as regards data protection compliance. Secondly, the documents at issue in the present case may be characterised as special categories of personal data within the meaning of Article 9 of the GDPR to which increased protection is granted. However, the processing of those special categories of data was not addressed in the EDPS’s letter.

94      It follows from the foregoing that the urgency requirement is satisfied as regards the disclosure of documents containing sensitive personal data.

 The alleged harm resulting from the disclosure of information to third parties

95      The applicant claims that the harm suffered would be even more serious in the event of wider disclosure of the documents at issue outside the Commission, in particular if third parties, such as its competitors, were to request access to the file to which those documents might be added. The applicant also states that once the documents are sent to the Commission they could automatically become disclosable in other jurisdictions, in particular to individuals who have instituted proceedings in the United States.

–       The alleged harm resulting from disclosure following a request for access made by third parties

96      In the first place, as regards the requests for access to the file by third parties, it should be noted that the Commission would return or destroy the documents which were clearly irrelevant after verifying whether they were necessary for the purposes of the investigation, so that it is very probable that those documents would no longer be in the Commission’s file at the time such a request were made.

97      In the second place, it is apparent from the Commission Notice on the rules for access to the Commission file in cases pursuant to Articles [101] and [102 TFEU], Articles 53, 54 and 57 of the EEA Agreement and Council Regulation (EC) No 139/2004 (OJ 2005 C 325, p. 7) that the applicant is the only party which could have full access to the file if the Commission were to open a formal investigation and issue a statement of objections. In the event that complainants were to make a request for access, it should be noted that they could request access only to the non-confidential version of the documents. Where the Commission intends to disclose information, the applicant must be able to provide a non-confidential version of the documents. Moreover, the contested decision expressly invites the applicant to provide non-confidential versions of its responses to the contested decision.

98      In the third place, in the event that the Commission receives a request – on the basis of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43) – for disclosure of documents collected pursuant to the contested decision, it should be noted, first, that it is unlikely that the documents and information gathered by the Commission pursuant to the contested decision would be communicated to third parties immediately, or even before the Court rules on the application for annulment of the contested decision in the main action. In the absence of a Commission decision bringing the investigation to an end, if a request for access were submitted within a short period on the basis of Regulation No 1049/2001, it would have to be examined by the Commission in the light of the third indent of Article 4(2) of that regulation. In that regard, it should be noted that the documents relating to an investigation carried out under Regulation No 1/2003 are presumed to enjoy the protection provided for in that provision (see, to that effect, judgment of 27 February 2014, Commission v EnBW, C‑365/12 P, EU:C:2014:112, paragraph 93, and order of 29 January 2020, Silgan International and Silgan Closures v Commission, T‑808/19 R, not published, EU:T:2020:16, paragraph 26).

99      Secondly, it should be pointed out that, even if the documents and information gathered by the Commission pursuant to the contested decision could be disclosed to third parties or to other undertakings which are the subject of the Commission’s investigation, such disclosure would relate only to the non-confidential parts of those documents, since the business secrets and commercial interests of the applicant would remain protected by the provisions of Regulation No 1049/2001 and Regulation No 1/2003 (see, to that effect, order of 29 January 2020, Silgan International and Silgan Closures v Commission, T‑808/19 R, not published, EU:T:2020:16, paragraph 27).

100    Thirdly, the Commission is required to inform the applicant of a request based on Regulation No 1049/2001, in accordance with Article 4(4) of that regulation. In such a situation, if the applicant were to consider that disclosure of those documents was likely to cause it serious and irreparable harm, it could apply for an interim measure suspending the operation of the Commission’s decision to disclose the documents in question (see to that effect, order of 29 January 2020, Silgan International and Silgan Closures v Commission, T‑808/19 R, not published, EU:T:2020:16, paragraph 29).

–       The alleged harm resulting from the fact that the documents sent to the Commission could automatically become disclosable in other jurisdictions and to litigants who have instituted proceedings against the applicant in the United States

101    As regards the harm linked to the disclosability of the documents, it must be found that the applicant’s allegation is in no way substantiated such as to demonstrate with a sufficient degree of probability the occurrence of imminent serious and irreparable harm.

102    It is apparent from a letter sent by the applicant to DG Competition on 2 August 2019, which the Commission submitted to the Court as an annex to its observations on the application for interim measures, that the applicant has not communicated certain internal documents in response to the Commission’s decision of 13 March 2019 on the ground that such communication could be regarded as a waiver of the privileged nature of those documents in the United States.

103    It should be noted in that regard that the applicant itself indicates, referring to the case-law of the United States courts (United States v. American Tel. and Tel. Co., 642 F.2d 1285, 1299 (D. C. Cir. 1980)), that such disclosure could only be characterised as a waiver in the case of a ‘voluntary disclosure’ of the documents at issue.

104    As the Commission has rightly pointed out, the applicant is obliged to provide the documents in question under a legally binding decision imposing periodic penalty payments adopted on the basis of Article 18(3) of Regulation No 1/2003. Furthermore, the fact that the applicant brought an action for annulment against that decision together with an application for interim measures also shows that such disclosure would not be voluntary.

105    Finally, and in any event, as regards the possible disclosure of the documents in question to individuals who have instituted proceedings against the applicant in the United States, it should be borne in mind that the obligation to redress the harm caused by an undertaking resulting from its infringement of the European Union competition rules falls within the scope of the civil liability of that undertaking. Consequently, the decisive cause of the harm allegedly connected to the actions for damages lies, not in the disclosure of the information in question by the Commission, but in the infringement of competition law committed by the appellants (see, to that effect, order of 14 January 2016, AGC Glass Europe and Others v Commission, C‑517/15 P-R, EU:C:2016:21, paragraph 46).

106    It follows from the foregoing that the applicant has not shown that it would suffer serious and irreparable harm in that regard.

 The alleged harm resulting from the Commission’s use of the documents at issue in the context of investigations into potential infringements of competition law which have not yet been identified by the Commission or notified to the applicant

107    The applicant submits that the documents at issue could be used for a different, illegitimate purpose such as to initiate a new or broader investigation or to make proposals for wider sector-specific regulation.

108    It should be noted that, if the contested decision were annulled by the EU judicature, the Commission would in that event be prevented from using, for the purposes of infringement proceedings under Articles 101 and 102 TFEU, any documents or evidence which it might have obtained on the basis of the requests for information at issue, as otherwise the decision on the infringement might, in so far as it was based on such evidence, be annulled by the EU judicature. If the contested decision were subsequently held to be unlawful, the Commission would be required to remove from its file the documents affected by that unlawfulness and would therefore be unable to use them as evidence (see, to that effect, order of 27 September 2004, Commission v Akzo and Akros, C‑7/04 P(R), EU:C:2004:566, paragraphs 37 and 39 and the case-law cited).

109    In those circumstances, it must be found that the possibility that the Commission would unlawfully use information obtained on the basis of the contested decision in infringement proceedings under Articles 101 and 102 TFEU is purely theoretical, and in any event improbable (see, to that effect, order of 27 September 2004, Commission v Akzo and Akros, C‑7/04 P(R), EU:C:2004:566, paragraph 40). That possibility cannot justify the adoption of the interim measures required by the applicant (see, to that effect, order of 29 July 2011, Cemex and Others v Commission, T‑292/11 R, not published, EU:T:2011:402, paragraph 32).

110    It follows from the foregoing that the applicant has not shown that it would suffer serious and irreparable harm in that regard.

111    As regards the alleged harm resulting from the adoption of sectoral rules, it should be noted that the argument is purely speculative and hypothetical, given that it is based on a number of uncertain events. In any event, such harm could not be regarded as the direct consequence of the disclosure of the documents in response to the Commission’s request for information.

 The alleged harm resulting from the breach of the right to judicial protection

112    The applicant claims that the documents in question inherently deserve protection, since any subsequent annulment of the contested decision would not remedy the effects of their disclosure to the Commission. Referring to the order of 10 September 2013, Commission v Pilkington Group (C‑278/13 P(R), EU:C:2013:558), the applicant claims that it would be deprived of the effective judicial protection enshrined in Article 47 of the Charter if the documents at issue had to be disclosed before the resolution of the main action.

113    It should be noted that the applicant has not put forward any arguments to establish that the harm resulting from the alleged infringement of the right to judicial protection is distinct from the harm resulting from the infringement of the right to privacy, the disclosure of the documents in question outside the Commission or the possible use by the Commission of irrelevant documents to initiate new investigations into infringements which it has not yet identified or notified to the applicant or in order to prepare a proposal for sectoral rules. It is apparent from paragraphs 70 to 109 above that, with the exception of the harm resulting from the disclosure of documents containing sensitive personal data, the applicant has not established the serious and irreparable nature of the harm which it alleges.

114    In the light of all the foregoing, it must be concluded that the applicant has established urgency only as regards the purely personal documents containing sensitive personal data.

 Balancing of interests

115    According to the case-law, the risks associated with each of the possible disposals of the case must be weighed in the proceedings for interim measures. In practical terms, that means examining whether or not the interest of the party seeking interim measures in obtaining suspension of the operation of the contested act outweighs the interest in its immediate implementation. In that examination, it must be determined whether the possible annulment of that act by the judgment on the substance would make it possible to reverse the situation that would have been brought about by its immediate implementation and, conversely, whether suspension of its operation would be such as to impede the objectives pursued by the contested act in the event of the main action being dismissed (order of 1 March 2017, EMA v MSD Animal Health Innovation and Intervet international, C‑512/16 P(R), not published, EU:C:2017:149, paragraph 127).

116    In the present case, it is necessary to weigh, on the one hand, the interest in preventing serious and irreparable harm being caused by the enlargement of the circle of persons with knowledge of sensitive personal data and, on the other hand, the public interest in preserving the effectiveness of EU competition rules.

117    On the one hand, it is settled case-law that it is for the Commission to decide whether a particular item of information is necessary in order to enable it to bring to light an infringement of the competition rules (see judgment of 14 March 2014, Holcim (Deutschland) and Holcim v Commission, T‑293/11, not published, EU:T:2014:127, paragraph 110 and the case-law cited). As the Commission rightly points out, if the undertaking under investigation or its lawyers could themselves establish which documents were, in their view, relevant for the purposes of its investigation, that would seriously undermine its powers of investigation, with the risk that documents that it might regard as relevant for the purposes of its investigation would be omitted and never presented to it, in the absence of any possibility of verification.

118    On the other hand, the harm caused to the applicant because it is obliged to communicate documents containing sensitive personal data in breach of the right to privacy of individuals established in paragraphs 82 to 94 above would entail the undue extension of the circle of persons with knowledge of that data in the absence of specific measures to protect the persons concerned.

119    In those circumstances, and taking into account the state of play of the discussions between the parties concerning the means of verifying the documents at issue, as reflected in the applicant’s letter of 8 September 2020 and in the Commission’s observations lodged on 17 September 2020, it is appropriate to provide for an ad hoc procedure for the examination of documents likely to contain sensitive personal data.

120    Under that procedure, first, it is for the applicant to identify the documents containing sensitive personal data and to communicate them to the Commission on a separate electronic medium. Secondly, those documents will be placed in a virtual data room which will be accessible to as limited a number as possible of members of the team responsible for the investigation, in the presence (virtual or physical) of an equivalent number of the applicant’s lawyers. Thirdly, the members of the team responsible for the investigation will examine and select the documents in question, while giving the applicant’s lawyers the opportunity to comment on them before placing the documents considered relevant on the file. In the event of disagreement as to the classification of a document, the contested document will not be added to the investigation file and the applicant’s lawyers will have the right to explain the reasons for their disagreement. In the event of continuing disagreement, the applicant’s lawyers may ask the Director for Information, Communication and Media at DG Competition to resolve the disagreement.

121    It follows from all the foregoing that the application for interim measures must be upheld in part and that the operation of Article 1 of the contested decision must be suspended in so far as that provision relates to documents containing sensitive personal data and for as long as the procedure referred to in paragraph 118 above has not been put in place.

122    Since the present order brings the proceedings for interim measures to an end, it is appropriate to set aside the order of 24 July 2020, Facebook Ireland v Commission (T‑451/20 R, not published), adopted on the basis of Article 157(2) of the Rules of Procedure, by which the Commission was ordered to suspend the operation of the contested decision until the date of the order terminating the present interim proceedings.

123    Under Article 158(5) of the Rules of Procedure, the costs must be reserved.

On those grounds,

THE PRESIDENT OF THE GENERAL COURT

hereby orders:

1.      The operation of Article 1 of Decision C(2020) 3011 final of the European Commission of 4 May 2020 relating to a proceeding pursuant to Article 18(3) and Article 24(1)(d) of Council Regulation (EC) No 1/2003 (Case AT.40628 – Facebook Data-related practices) is suspended, in so far as the obligation set out therein relates to documents which are not linked to Facebook Ireland Ltd’s business activities and which contain sensitive personal data, and for as long as the procedure referred to in point 2 has not been put in place.

2.      Facebook Ireland shall identify the documents containing the data referred to in point 1 and transmit them to the Commission on a separate electronic medium. Those documents shall then be placed in a virtual data room which shall be accessible to as limited a number as possible of members of the team responsible for the investigation, in the presence (virtual or physical) of an equivalent number of Facebook Ireland’s lawyers. The members of the team responsible for the investigation shall examine and select the documents in question, while giving Facebook Ireland’s lawyers the opportunity to comment on them before the documents considered relevant are placed on the file. In the event of disagreement as to the classification of a document, Facebook Ireland’s lawyers shall have the right to explain the reasons for their disagreement. In the event of continuing disagreement, Facebook Ireland may ask the Director for Information, Communication and Media at the Commission’s Directorate-General for Competition to resolve the disagreement.

3.      The application for interim relief is dismissed as to the remainder.

4.      The order of 24 July 2020, Facebook Ireland v Commission (T‑451/20 R), is set aside.

5.      The costs are reserved.

Luxembourg, 29 October 2020.

*      Language of the case: English.

© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.