How to Defeat a RFI – The Privacy Argument

The twin interim proceedings in the Vivendi/Lagardère gun-jumping investigation raise interesting legal issues in the wake of the ongoing case Meta Platforms v Commission (C-497/23 P), and in the wider context of ever more detailed requests for information from the European Commission in competition inquiries: what are the boundaries of the Commission’s powers to request production of documents? What limitation to these powers (if any) could stem from either national law provision and/or fundamental rights?

As the case law currently stands, pending decisions on the merits, the privacy argument is deemed sufficiently robust to justify the imposition of interim measures. Upon analysis, it appears that the objectives of general interests pursued by EU competition law would in principle hardly suffer any limitation in the Commission’s powers to request the production of documents, and only specific requirements on the Commission as to safeguarding fundamental rights might be imposed. However, questions remain as to the addressee of an RFI Decision and competence of the required undertaking to produce documents that are not in their possession nor control.

On 24 October 2022, Vivendi notified the Commission of a concentration which consisted in the acquisition of sole control of Lagardère. On 9 June 2023, that concentration was authorised by the Commission subject to compliance with commitments made by Vivendi (Case COMP/M.11184).

Not longer afterwards, on 25 July 2023, the Commission opened a gun jumping investigation in relation to Lagardère and Vivendi’s concentration (see press release). As part of that procedure, by two decisions of 19 September 2023, the Commission sent the parties two RFIs (hereinafter “RFI Decisions”).

Both Lagardère and Vivendi lodged actions for annulment against the RFI Decisions (see T-1119/23 for Lagardère; and T-1097/23 for Vivendi), and also applied for a suspension of those RFIs by way of interim measures.

 

The Commission’s RFIs and proposed procedural safeguards

The RFI Decisions required Lagardère and Vivendi, inter alia, to collect and transmit to the Commission documents exchanged by various means of communications, received or sent or held by several natural persons containing certain search terms defined in its annex. These search terms were described as “keywords of a somewhat general nature, including inter alia the surname or the first name of a number of public figures from the worlds of politics or the media” (C-90/24 P(R), ¶84). This obligation extended in particular, in particular in the case of the Vivendi Decision, as set out in paragraph 2(c)(i) of the Annex to this Decision, to exchanges carried out by means of private or personal electronic mailboxes and private or personal mobile devices of the natural persons concerned, provided that these electronic mailboxes and devices have been used at least once for professional communications (T-1119/23 R-RENV, ¶6; T-1097/23 R-RENV ¶6; C-89/24P(R), ¶¶69-71; C-90/24 P(R), ¶¶83-86). Thus, the European Commission required undertakings to provide documents that were not in their possession nor control, but under private realm of certain undertakings’ employees.

The RFI Decisions contain specific procedures intended to restrict the access of European Commission’s officials to the documents containing sensitive personal data with the meaning of GDPR (C-90/24 P(R), ¶96). Following concerns expressed by both Vivendi and Lagardère, DG COMP’s director-general sent a letter on 6 December 2023 to reassure the parties that (i) documents containing sensitive personal data, and that have no nexus with the applicants’ commercial activities, will be handled in a virtual data-room, as per case Meta Platforms v Commission; while (ii) documents containing journalistic sources will be treated as for LPP protected documents (T-1119/23 R, ¶¶27-28; T-1097/23 R, ¶¶27-28; see also T-1097/23 R-RENV, ¶51).

 

On the condition relating to urgency

Lagardère

The Vice-President of the Court of Justice found that the appellant had established to the requisite legal standard that without interim measures it would suffer serious and irreparable harm. In order to comply with the contested decision, it would be compelled to adopt conduct which could, with a sufficient degree of probability, justify its criminal liability under French law, and therefore make it subject to criminal sanctions (C-89/24 P(R), ¶¶72-75). The harm was deemed to be serious, having regard to “the stigma attached to a criminal conviction and the breach of the bond of trust with its company officers and its employees which could arise from the commission of criminal offences against them” (¶77).

Interestingly, it is noted that “no information has been provided by the parties to the court” (¶73) on whether Lagardère could avoid criminal liability, entirely or partially, by relying on the obligations or the compulsion on it resulting from the contested decision. This highlights the difficulties faced by the EU courts when dealing with national law. Indeed, regarding that very question, it is an essential principle of French criminal law that liability is excluded when ordered by lawful authority, unless that act is manifestly unlawful (Article 122-4 of French Criminal Code). It would be somewhat risky to argue in French law that an RFI from the European Commission does not constitute an order from a lawful authority. Thus, it appears that, in practice, Lagardère could avoid criminal liability, entirely or partially, by relying on the obligations or the compulsion on it resulting from the contested decision.

Would that have been enough to change the final decision on the urgency condition? The main point of the reasoning was that “the claim that the conduct which Lagardère would have to adopt in order to comply with the contested decision could constitute a criminal offence in French law has the degree of probability required by the case-law set out in paragraph 65 of the present order” (¶72). However, as per Article 122-4 of French criminal code, it is more likely than not that the conduct which Lagardère would have to adopt in order to comply with the contested decision will not constitute a criminal offence of which Lagardère will be held liable. That provision is not specific to French criminal law, and not even to criminal law: in EU competition law, it is settled case-law that Articles 101 and 102 TFEU do not apply to a conduct that is required of undertakings by national legislation (C-280/08 P, ¶¶80 and ff.). Therefore, if that point was held by the Vice-President of the Court, he might, according to his own reasoning, have concluded that the condition of urgency was not met on that very ground. That being said, this very question was de facto not explored in detail, as the judge did not have all the information at his fingertips. The case on the merits will provide an opportunity to explore this issue further.

This raises a broader question of interaction between EU competition law and national law provisions: according to the Vice-President of the Court of Justice, a conflict between a request for information from the European Commission and national criminal law is seen as serious enough to constitute a risk of serious and irreparable harm leading to the imposition of interim measures. The specific development on the “stigma attached to criminal conviction” (¶77, op. cit.) suggests that such conflict with a non-criminal national law provision might not be analysed the same way. By way of comparison, for dawn raids, the principle of EU Member States’ procedural autonomy prevails. But here, it is not about national procedure but substantial provisions. This question would require further development than this blogpost allows.

 

Vivendi

The Vice-President of the Court of Justice found that the appellant has established to the requisite legal standard that without interim measures it would suffer serious and irreparable harm. First, the RFI Decision entails a serious breach of the right to privacy, as personal data to be collected and communicated to the Commission are liable to allow precise conclusions to be drawn concerning the private life of the persons concerned (C-90/24 P(R), ¶90). Second, the protection offered by the European Commission was deemed unable to prevent “specific conclusions being drawn regarding the private life of the persons concerned” (¶98) while statutory obligations of Commission’s officials as regards professional secrecy do not limit access to the data at issue “access which constitutes as such serious interference” in right to privacy of the persons concerned (¶100).

The Vice-President of the Court of Justice made a distinction between privacy and other protections, namely legal professional privilege (¶¶92-94). However, it is not clear whether that distinction is made relative to the very case at issue or should lessons be drawn from an emerging trend of case-law specific to privacy. Indeed, it was found that the question in the current proceedings was not similar to that in the Akzo case (C-7/04 P(R), this case was related to privileged documents seized by the Commission in a dawn raid, and it was found that the alleged harm would only occur if the Commission were to take a decision on the basis of the documents at stake, and not by the mere fact it has consulted those documents nor placed them in a sealed envelope), for two reasons: (i) the number of documents was limited in Akzo (¶97), while in Vivendi “a significant number of documents” which do not fall within the professional sphere ought to be communicated to the Commission on the basis of the RFI Decision (¶88); and (ii) the harm alleged in Akzo was relating solely to a more detailed reading, by Commission officials, of documents which they had already examined. The Vivendi order does not explicitly expand on why the situation is different from the Akzo case. However, paragraph 100 of the order is insightful: “having access to the personal data relating to the private life of the persons concerned, […] constitutes as such serious interference in those persons’ right to privacy.” Therefore, mere access to personal data relating to private life of individuals ought to be considered as such a harm that it should lead to the imposition of interim measures (if the other conditions are met), while a ‘more detailed reading’ of documents protected by legal professional privilege ought to be not problematic. It follows from this that a (preliminary) difference in nature has to be made between personal data and privileged documents.

 

On fumus boni juris

The condition of fumus boni juris requires the applicant to show that its claim is prima facie well-founded. It is now settled case-law that the requirement is to prove that at least one plea in the main action would not be, prima facie, seen as unfounded (T-184/01 R, ¶¶56-75).

As for Lagardère, the applicant was alleging, inter alia, a violation of legal certainty in that (i) compliance with the RFI Decision would lead it to be commit a criminal offence, and (ii) it has no control nor means of coercion over the requested documents, either legally or materially (T-1119/23 R-RENV, ¶45). The Vice-President of the General Court found that this plea does not appear, prima facie, unfounded, and therefore calls for a detailed examination that cannot be carried out by the Judge hearing an application for interim measures, and must be examined in the context of the proceedings on the merits. This finding follows from the fact that (a) the personal communication tools of the persons concerned were not in Lagardère’s possession nor control (¶51); and (b) unless it receives free and informed consent, Lagardère would commit a criminal offence under national law if it were to collect the requested documents, while the RFI Decision does not contain any provision with regards to consent of the persons concerned (¶¶52-55).

As it has been commented above, point (b) seems at least debatable as a matter of national law, although it would be hard to argue that there is no prima facie case. But point (a) seems self-evident, as the RFI Decision places Lagardère under somewhat contradictory legal injunctions, hence opening the room for further debate on the interaction between the European Commission’s investigative powers and national law provisions. However, it is worth noting that Article 11(3) EUMR, the Commission may require “a person, an undertaking or an association of undertakings to supply information”. Thus, it may have directly required, by way of separate decisions, the natural persons targeted in the RFI Decisions, to provide the requested documents stored in their personal devices. Indeed, contrary to Lagardère and Vivendi, those natural persons have those documents under their possession and control. That will be one of the points of debate on the proceedings on the merits.

As for Vivendi, the applicant was alleging, inter alia, a violation of the right to privacy in that the RFI Decision required it to violation Article 7 of the Charter and Article 8(1) ECHR without any safeguards. The Vice-President of the General Court found that this plea does not appear, prima facie, unfounded, and therefore calls for a detailed examination that cannot be carried out by the Judge hearing an application for interim measures and must be examined in the context of the proceedings on the merits. This finding follows from the fact that it cannot be ruled out that the RFI Decision goes beyond what is necessary to achieve the general interest objective it pursues. In detail, the question at issue was whether the RFI Decision fulfils the conditions set out in Article 52(1) of the Charter and Article 8(2) of the ECHR, ie that any limitation on the exercise of rights and freedoms must (i) be provided for by law and respect the essential content of those rights and freedoms; and (ii) in compliance with the principle of proportionality, that limitation is necessary and effectively meets objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others (T-1097/23 R-RENV; ¶39).

The Vice-President of the General Court found that Article 11(3) EUMR provided for such a limitation, citing by analogy the order in Meta Platforms v Commission (¶41, citing T-451/20 R, ¶57), and that the exercise of the powers conferred on the Commission by EUMR helps to maintain the competitive regime laid down by the Treaties, which therefore meets objectives of general interest recognised by the Union (¶45). However, with regards to proportionality, it was noted that the safeguards proposed by the European Commission only applied to sensitive personal data and documents likely to reveal journalistic sources, leaving no protection for data relating, for example, to family life, tastes or private activities of a political, religious, philosophical or trade union nature (¶52). While the Commission indicated it has agreed to extend the scope of this procedure to all documents falling within the strictly personal sphere, it has not alleged the RFI Decision had been amended to that effect (¶54). On that basis, the Vice-President of the General Court concluded that it cannot be excluded that the RFI Decision goes beyond what is necessary to achieve the general interest objective it pursues.

The key point here is the scope of the protection offered by the Commission in its modified RFI Decision and the letter of 6 December 2023. The Vice-President of the General Court, following the reasoning of the Vice-President of the Court of Justice, did not limit his assessment to the formal appreciation of whether the data at issue qualifies as ‘sensitive personal data’ with the meaning of GDPR, but rather examined the substantial consequences of an access from EC officials to the very personal data at issue, considering the amount and nature of that data. The remaining question is: what procedural safeguards would be deemed sufficient to qualify as proportional limitation of the right to privacy with the meaning of Article 52(1) of the Charter and Article 8(2) of the ECHR? The Vice-President of the General Court also added one consideration on virtual data-rooms, asserting that this solution would not be suitable for all documents containing personal data, as this “would potentially involve a very large number of documents, making it relatively difficult to implement in practice” (¶75). All eyes on the General Court on the main proceedings.

Last, the developments on the third condition, i.e. the balance of conflicting interests, do not raise serious questions in these proceedings, and thus will not be commented further.

 

Conclusions

It follows from the Vivendi and Lagardère interim proceedings that, to the extent the case-law is not yet settled on the question of privacy in the context of a competition inquiry (either antitrust or merger), there will be room for successful interim measures applications. However, depending on the outcome of the proceedings before the Court of Justice in Meta Platforms Ireland v Commission, and in both Vivendi and Lagardère applications for annulment, the condition of fumus boni juris might not be met in future cases. Thus, the “privacy argument” is a circumstantial one, linked to the European Commission’s practice of requesting ever more detailed production of documents, raising issues of possible conflicts with (a) national legislation; (b) fundamental rights (privacy, journalistic sources); (c) competence of the required undertaking to produce documents that are not in their possession nor control.

The main proceedings in Meta Platforms, Vivendi, and Lagardère will provide EU Courts with an opportunity to clarify these issues.

Story originally seen here