Handle with care: Sensitive personal data in antitrust investigations

“Documents which are not linked to Facebook Ireland Ltd’s business activities and which contain sensitive personal data shall be placed in a virtual data room which shall be accessible to as limited a number as possible of members of the team responsible for the investigation”. On 29 October 2020, in two identical orders, ¹  the President of the General Court ruled that, in the context of a request for information for the purposes of an antitrust investigation, sensitive personal information enjoys strong legal protection and justifies appropriate safeguards for its review by Commission officials in charge of the investigation.

In May 2020, the Commission sent Facebook two separate requests for information (“RFIs”) relating to its investigations into Facebook’s marketplace and data-related practices and requiring Facebook to produce documents identified by way of specific search terms. In July 2020, Facebook appealed to the General Court seeking annulment of the RFIs. It also applied for interim measures that would allow it to withhold some of the requested information until a decision was reached in the main proceedings.

Facebook claimed that the RFIs were unnecessarily broad and unreasonable because they covered a significant amount of sensitive personal employee data.

Considering the urgency of the claim for interim measures, in July 2020, the President of the General Court ordered the suspension of the RFIs on the basis of Article 157(2) of the Rules of Procedure until the date of the order in the interim measures proceedings. Approximately 120,000 documents were still to be provided by Facebook to the Commission pursuant to the RFIs at the time.

Interim measures in EU Court proceedings

Appeals before the General Court do not have a suspensory effect, i.e. the contested decision remains in full force and effect unless and until it is quashed by the General Court. Appeals can take considerable time before the Court issues its final judgment. In cases where there is a risk of serious and irreparable harm being caused to the applicant while the appeal is pending, the applicant may seek interim measures to suspend the operation of the contested decision pending adjudication of the case in the main proceedings.

In order to establish that interim measures should be granted by the President of the General Court, the application has to meet two requirements: it needs to demonstrate both the existence of a prima facie case, and the urgency of the matter. The President of the General Court may also balance the various interests at stake.

As regards the condition of the existence of a prima facie case, the applicant has to demonstrate that there is a factual or legal disagreement the solution to which is not immediately obvious and which requires a detailed examination by the Court in the main proceedings. In other words, the applicant has to demonstrate that the claim is, at first sight, not unfounded.

As regards the condition of urgency, this is a much stricter test. The applicant has to demonstrate that interim relief is truly necessary to prevent serious and irreparable damage from being caused to the applicant itself. Financial damage is in principle not considered as irreparable as it is possible to assess it, quantify it and seek damages for it following a win in the main appeal. To show irreparable harm there must be irreversible damage e.g. to the market position or to fundamental rights of the applicant.

The orders of the President of the General Court in the Facebook cases

• Prima facie case

Facebook argued that the RFIs infringed both Article 18(3) of Regulation No 1/2003 by requiring it to produce documents which were irrelevant to the investigation, and the fundamental right to privacy guaranteed by Article 7 of the Charter of Fundamental Rights and Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms given that the documents in question contained sensitive personal information of Facebook employees. This included for example very sensitive information such as medical data, personal opinions and political engagement, correspondence at times of great personal distress and personal security arrangements.

The President of the General Court held that “given the wide-ranging nature of the search terms and given the likelihood that they will capture a significant number of documents which are not necessarily relevant to the Commission’s investigation, it cannot be ruled out, at this stage, that the Court adjudicating on the substance might consider that the contested decision does not comply with Article 18(3) of Regulation No 1/2003 in the absence of a method of verifying the relevance of documents accompanied by appropriate and specific guarantees for safeguarding the rights of the persons concerned” (para.67). He therefore concluded that the pleas raised by Facebook were not prima facie unfounded.

Interestingly, the President of the General Court compared the contested RFIs to a dawn raid, since Facebook had to provide a large amount of documents collected on the basis of broad search terms and he noted that, in the course of antitrust dawn raids, the raided undertaking enjoys certain procedural guarantees and that documents unrelated to the market activities of the raided undertaking fall outside the scope of the Commission’s investigatory powers.

• Urgency

To substantiate its claim that providing the requested documents to the Commission would result in serious and irreparable harm, Facebook argued that itself, its employees and other individuals could suffer from four categories of harm whose impact would be impossible to assess, namely: (i) harm from a breach of the fundamental right to privacy, (ii) harm as a result of the documents being disclosed outside of the Commission with irreversible consequences, (iii) harm as a result of the possible use of the documents by the Commission to initiate new proceedings, and (iv) harm from the deprivation of effective judicial protection.

• • No harm resulting from the breach of Facebook’s right to privacy

The President of the General Court found that Facebook failed to prove that it would suffer serious and irreparable harm from a breach of its right to privacy if it complied with the contested RFIs.

He concluded that serious harm to Facebook from a breach of its right to privacy was unlikely because the documents at issue were not meant to be communicated to the public and Commission officials are subject to strict obligations of professional secrecy which prevent them from using information obtained through a request for information for purposes other than those for which it was acquired.

• • Harm resulting from the breach of Facebook employees’ right to privacy

Facebook argued that the damage caused by the breach of the right to privacy of its employees if the requested information was disclosed to the Commission would in turn cause serious and irreparable damage to its own reputation.

The President of the General Court agreed with this argument and found that disclosure could cause serious and irreparable harm to the employees’ right to privacy. The requested documents contained sensitive personal data usually shared only under the most private conditions. If such information were to be disclosed to a broader circle of third parties it could seriously harm the individuals’ right to privacy, and such harm would be irreversible. Most of this data fell within the scope of Regulation 2018/1725 (the General Data Protection Regulation (GDPR)) which provides for increased protection for this type of information, in particular data revealing political opinions and data concerning an individual’s health.

The President of the General Court found that such serious and irreparable harm caused to Facebook’s employees would, in turn, result in serious and irreparable harm to Facebook itself on the basis that it would be required to transmit sensitive personal data in breach of the right to privacy of the individuals concerned. Indeed, the President held “that the contested decision imposes on the applicant a positive obligation to search for all of its electronic files on the basis of broad search terms and to communicate to the Commission the documents responding to those search terms, even if those documents contain sensitive personal data. Moreover, this is an obligation addressed by name to the applicant and not to the natural persons concerned, an obligation which the applicant must discharge within a strict time period and on pain of a periodic penalty payment” (paras 91-92).

The President of the General Court therefore found that the urgency condition was satisfied as regards the disclosure of documents containing sensitive personal data.

• • No other harm

The President of the General Court then rejected the other three categories of harm that Facebook had put forward. He found that neither a request for access to the file by a third party nor potential disclosure of the requested documents to authorities in other jurisdictions could be considered a risk that would cause serious and irreparable harm to Facebook. The alleged harm resulting from the Commission’s use of the requested documents to initiate new proceedings was also considered to be purely speculative and hypothetical and the potential breach of the right to judicial protection was not established.

• Balancing of interests

The President of the General Court then weighed the interests at stake, namely (i) the interest in preventing serious and irreparable harm being caused by the enlargement of the circle of persons with knowledge of sensitive personal data, and (ii) the public interest in preserving the effectiveness of EU competition rules.

In doing so, he held that “it is appropriate to provide for an ad hoc procedure for the examination of documents likely to contain sensitive personal data” (para. 119).

Consequently, he set up a strict procedure for the examination of documents unrelated to Facebook’s business activities and which contain sensitive personal data by Commission officials in charge of the investigation, and ordered the suspension of the operation of the RFIs in relation to such documents until the procedure is in place.

The procedure is the following:

• Facebook is required to identify documents unrelated to Facebook’s business activities and which contain sensitive personal information and send these to the Commission on a separate electronic medium.
• These documents will be placed in a virtual data room, accessible only to a limited number of Commission officials responsible for the investigation, in the presence of an equivalent number of Facebook’s lawyers.
• Members of the Commission’s investigating team can only examine the documents while giving Facebook’s lawyers the opportunity to comment before placing them on the file.
• In the event of a disagreement between the Commission officials and Facebook’s lawyers, the contested documents will not be added to the file and Facebook’s lawyers will have the right to explain their reasoning for the exclusion of the documents in question.
• In the event of continuing disagreement, the Director for Information, Communications and Media at DG Competition will resolve the dispute.

Interim measures and the protection of confidentiality: a long-standing relationship

The Facebook interim orders are the latest ones in a series of interim orders in which the President of the General Court and Vice-President of the Court of Justice have acted as guardians of confidentiality pending adjudication of cases in the main proceedings. For example:

In November 2012, the President of the General Court granted interim measures in Akzo Nobel v Commission prohibiting the Commission from publishing an extended version of its decision in the hydrogen peroxide cartel case pending adjudication of the case in the main proceedings in which the General Court had to decide whether the additional information that the Commission intended to publish was indeed confidential.²  The President of the General Court considered that serious and irreparable harm would be caused to Akzo Nobel if the information in question was published before adjudication of the case in the main proceedings because there was a risk that the applicants’ fundamental right to the protection of professional secrecy would irreversibly lose any meaning in relation to that information and that its fundamental right to an effective remedy would be jeopardised. The President of the General Court also considered that there was a prima facie case given that the information at stake had been provided by Akzo Nobel pursuant to the leniency procedure and that the confidential nature of such information required thorough examination.

Similarly, in March 2013, the President of the General Court granted interim measures in Pilkington v Commission prohibiting the Commission from publishing an extended version of its decision in the car glass cartel case pending adjudication of the case in the main proceedings in which the General Court had to decide whether the additional information that the Commission intended to publish was indeed confidential.³  (HSF represented Pilkington in this case and in the underlying main proceedings, as well as in the appeal of the car glass decision itself.) Interestingly, the President of the General Court granted interim relief in relation to two categories of information: names or product descriptions, and details of Pilkington’s pricing calculations, but rejected interim relief in relation to information likely to identify Pilkington’s employees on the ground that such disclosure would not cause harm to Pilkington itself. The President of the General Court adopted the same ruling as in the Akzo Nobel v Commission case in relation to urgency and held that there was a prima facie case given that the case raised “complex and delicate questions” which necessitated a thorough examination. In September 2013, the Vice-President of the Court of Justice confirmed the order of the President of the General Court noting, however, that the fact that fundamental rights may be infringed was not in itself sufficient to characterise the existence of serious and irreparable harm and that, in that case, irreparable harm stemmed from the fact that, should damage arise, it would not be quantifiable and would therefore be irreparable.⁴

By contrast, in January 2016, in AGC Glass v Commission, the President of the General Court rejected AGC Glass’ application for the suspension of the publication of the judgment of the General Court having ruled that the additional information relating to AGC Glass, which the Commission intended to publish in the revised non-confidential version of the car glass cartel decision, did not constitute business secrets pending adjudication of the appeal against that judgment by the Court of Justice.⁵  The President of the General Court considered that the condition of urgency was not met in this case given that the applicant had not demonstrated why serious and irreparable harm would arise from the publication of information found not to be subject to the protection of professional secrecy (the applicant had not appealed the General Court’s finding that the information was not confidential). The difference therefore with the ruling in the Pilkington case lies in the fact that the analysis of urgency was “based on the premise, unlike that adopted by the court in [Commission v Pilkington], that the information in question is not covered by the obligation of professional secrecy”.⁶

There are however notable differences between these earlier orders and the Facebook orders. First, the information at stake in the Facebook orders consists of sensitive personal information whereas in these previous cases it consisted of business secrets. Second, while the earlier orders related to publication of the disputed information in revised non-confidential versions of Commission cartel decisions available on the Commission’s website to the public at large, the Facebook orders relate to disclosure to Commission officials only. Third, while the interim measures ordered in these earlier cases resulted in the information at stake being completely withheld pending adjudication of the case in the main proceedings, the procedure designed by the President of the General Court in the Facebook orders still allows examination of the documents in question by certain Commission officials.

Despite these notable differences, the Facebook interim orders fall squarely within the line of case law where the EU Courts have acted as guardians of information deemed (even if only prima facie) confidential by granting it protection from publication or disclosure (without adequate safeguards) pending adjudication in the main proceedings. Indeed, even if the protection of sensitive personal information is not absolute in the Facebook orders, the President of the General Court was nonetheless cautious to limit disclosure to the narrowest extent possible due to the particularly sensitive nature of the information at stake.

___________________________________________

1. Order of the President of the General Court in Case T-451/20 R Facebook Ireland v Commission, EU:T:2020:515 and Order of the President of the General Court in Case T-452/20 R Facebook Ireland v Commission, EU:T:2020:516.
2. Order of the President of the General Court in Case T-345/12 R Akzo Nobel NV and Others v Commission, EU:T:2012:605.
3. Order of the President of the General Court in Case T-462/12R Pilkington Group Ltd v Commission, EU:T:2013:119.
4. Order of the Vice-President of the Court of Justice in Case C-278/13P(R) Commission v Pilkington Group Ltd, EU:C:2013:558, para. 44.
5. Order of the Vice-President of the Court of Justice in Case C-517/15P(R) AGC Glass Europe SA and Others v Commission, EU:C:2016:21.
6. Ibid., para. 33.

Contacts