In the space of a few weeks, the General Court of the European Union has had the opportunity to rule twice on the issue of privacy within the framework of competition investigations.

In the Les Mousquetaires/ITM, the General Court accepted that during an inspection, the undertaking could , in the same way as members of its staff, make a request for the protection of documents relating to their private lives to oppose their seizure by the Commission’s agents. The court specified that, in order to produce its effects, the application had to be presented before the seizure and that a decision to reject it could, where appropriate, constitute an act open to challenge (GC, Case T-255/17 Judgment of 5 October 2020, not available in English).

On 29 October 2020, the President of the General Court issued two new orders on appeal by Facebook against the Commission’s requests for information under Article 18(3) of Regulation No 1/2003 as part of its investigations into its marketplace (Case AT.40684) and its data collection practices (Case AT.40628).

Facebook criticized the disproportionate nature of the Commission’s requests for information, which required it to provide the documents identified on the basis of search terms defined by the authority and which were particularly broad, since some of them consisted of frequent or very common words such as:

  • big question
  • for free
  • shut down
  • not good for us
  • advertising
  • grow
  • insight
  • advantage
  • looked at
  • quality

Facebook argued that the use of such keywords would necessarily reveal documents that are irrelevant or not necessary for the purposes of the investigation, which the Commission itself acknowledged, and would infringe on the fundamental right to privacy of the undertaking and its employees.

Facebook therefore brought an action for annulment against the information request decisions, along with an application for a stay of enforcement. As the Court points out in this case, such an application can only succeed if the granting of the stay is justified, prima facie, in fact and in law (fumus boni juris) and if it is urgent, insofar as the stay is necessary to avoid serious and irreparable harm to the applicant’s interests. Finally, a weighing up of the interests involved must be undertaken.

The granting of a stay of enforcement by the Union judicature has proved to be very rare in practice. In this case, however, the General Court granted Facebook’s application but only partially because, although the Court (I) confirmed the right to privacy of the staff of the undertaking, (III) and granted interim measures, (II) it rejected the existence of such a right in relation to the undertaking itself.

1. Enshrining the right to privacy of the undertaking’s employees

In granting the stay of enforcement, the Court was mindful of the fact that:

  • the applications, based on particularly broad search terms, would require undertakings to produce a large number of documents collected on its servers, without any additional specific measures being provided for to ensure respect for the right to privacy: they would therefore amount to measures as stringent as an inspection and justify a level of protection similar to that guaranteed by Article 20 of Regulation No 1/2003 on inspections; a finding of an infringement of Article 18(3) cannot therefore be ruled out;
  • The requests would require Facebook to provide documents which cannot be regarded as necessary to the Commission for the purpose of establishing the presumed infringements, including documents containing sensitive personal data (such as private correspondence exchanged by employees about medical and autopsy reports and correspondence exchanged between employees at times of great personal distress), which could be covered by Regulation No 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the institutions, bodies, offices and agencies of the Union and on the free movement of such data, and Regulation No 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR – General Data Protection Regulation); the plea alleging infringement of Article 7 of the Charter of Fundamental Rights of the European Union does not appear, prima facie, to be unfounded;
  • enlargement of the circle of persons with knowledge of sensitive personal data risks causing serious harm to the persons concerned by that data; it is irrelevant in this respect whether Commission officials are bound by an obligation of confidentiality; there is therefore an urgent need to suspend the disclosure of such data.

2. Rejection of the protection of the undertaking’s right to respect for its privacy

However, the Court dismissed Facebook’s claim to privacy. Facebook argued that the Commission’s requests would expose it to an obligation to provide private documents such as:

  • documents relating to the security assessments of its premises and documents concerning disputes between its employees;
  • documents relating to its efforts as regards diversity issues, documents relating to its website content moderation activities, commercially sensitive documents regarding its tax affairs, stock market announcements, or the licensing of sports content.

The General Court ruled out the risk of extremely serious damage in the event of improper communication of confidential information by emphasizing that the documents were not intended to be disclosed to the undertaking’s competitors or to be published by the Commission, it being specified that officials and agents are subject to an obligation of confidentiality. Furthermore, as regards requests for access to the Commission’s file by third parties, the Court stresses that the Commission could not grant such access without having removed documents from the file which were not relevant to the investigation after verifying their necessity. Furthermore,complainants only have access to a non-confidential version of the documents. Finally, a request for access on the basis of Regulation No 1049/2001 could be refused on the grounds of the protection afforded to documents relating to an investigation.

3. Measures taken to ensure respect for the right to privacy of the undertaking’s employees

It is striking that the General Court did not call into question the method of selection of the documents requested by the Commission, characterized by the use of extremely broad search terms. In its orders, it merely confirmed the ad hoc procedure for the verification of documents likely to contain  sensitive personal data, agreed between the Commission and Facebook prior to the procedure.

The procedure is carried out in three stages:

– in the first stage, Facebook identifies documents containing sensitive personal data and communicates them on a separate electronic medium to the Commission;

– secondly, the documents are placed in a virtual data room which is accessible to as limited a number as possible of members of the team responsible for the investigation, in the presence (virtual or physical) of an equivalent number of the applicant’s lawyers;

– thirdly, the members of the team responsible for the investigation examine and select the documents in question, while giving the applicant’s lawyers the opportunity to comment on them before adding the documents considered relevant to the file.

In the event of disagreement as to the classification of a document, the contested document is not be added to the investigation file and the applicant’s lawyers have the right to explain the reasons for their disagreement.

In the event of continuing disagreement, the applicant’s lawyers may ask the Director for Information, Communication and Media at DG Competition to resolve the disagreement.

It is regrettable that such a procedure is limited to documents relating to the private lives of the undertaking’s employees. It also could be used to good effect to protect undertakings against the inevitable abuses of the document selection procedure defined by the Commission, which itself has acknowledged that it can lead to the extraction of documents which are entirely unrelated to the investigation.