Luxembourg, 24 May 2023
Judgment of the General Court in Case T-451/20 | Meta Platforms Ireland v Commission
Competition: The action brought by Meta Platforms Ireland (Facebook group) against a Commission request seeking disclosure of documents identified by means of search terms is dismissed
—
The General Court finds that Meta Platforms Ireland has not successfully demonstrated that the request to provide documents to be identified by search terms went beyond what was necessary or that establishing a virtual data room failed to ensure that sensitive personal data was sufficiently protected
On the basis of suspicions of anticompetitive behaviour by the Facebook group in its use of data and in the management of its social network platform, the European Commission, by decision of 4 May 20201, sent a request for information to Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd. That decision, adopted pursuant to Article 18(3) of Regulation No 1/20032, required Meta Platforms Ireland to provide the Commission with all documents prepared or received by three of its executives within the period concerned which contained one or more of the search terms defined in the annexes. That decision provided for a potential penalty payment of € 8 million per day in the event of failure to provide the information requested3.
The decision of 4 May 2020 replaced an earlier similar decision, which laid down broader search criteria. That new decision, taken after exchanges between the Commission and Meta Platforms Ireland, reduced the number of documents requested by refining search terms and limiting the number of officials concerned.
On 15 July 2020, Meta Platforms Ireland brought, first, an action for annulment of the decision of 4 May 2020 and, second, an application for interim measures.
By interim order of 29 October 20204, the President of the General Court ordered that the operation of the decision of 4 May 2020 be suspended until a specific procedure had been put in place for the production of the requested documents which were not linked to Meta Platforms Ireland’s business activities and which also contained sensitive personal data. Subsequent to that order, the Commission adopted an amending decision5 stating that those documents could be placed on the investigation file only after having been examined in a virtual data room in the manner specified in the interim order.
Meta Platforms Ireland modified its application for annulment to take account of that amending decision. The Fifth Chamber, Extended Composition, of the General Court dismisses the action in its entirety. In that context, the General Court examines, for the first time, the lawfulness under Regulation No 1/2003 of a request for information using search terms, as well as the lawfulness of a virtual data room procedure for the processing of documents containing sensitive personal data.
Findings of the Court
In support of its action for annulment, Meta Platforms Ireland argued, inter alia, that applying the search terms specified in the request for information would inevitably lead to the capture of a significant number of documents with no relevance to the investigation carried out by the Commission, which would be contrary to the principle of necessity set out in Article 18 of Regulation No 1/2003.
On that point, the Court recalled that, under Article 18(1) of Regulation No 1/2003, the Commission may, by simple request or by decision, require undertakings to provide ‘all necessary information’ in order to monitor compliance with the EU competition rules. It follows that the Commission is entitled to require the disclosure only of information that may enable it to investigate presumed infringements that justify the conduct of its investigation. Having regard to the broad powers of investigation conferred on the Commission by Regulation No 1/2003, that necessity requirement is satisfied if the Commission could reasonably suppose, at the time of the request, that the information may help it to determine whether an infringement of the competition rules has taken place.
In support of its complaints challenging whether the principle of necessity had been complied with, Meta Platforms Ireland had disputed certain search terms in the request for information, while arguing that those specific criticisms ought to be understood as non-exhaustive examples intended to illustrate its more general line of argument. In its view, it would have been unreasonable, if not impossible, to focus on each search term separately.
However, the Court rejects that approach and considers that an overall assessment of compliance with the principle of necessity set out in Article 18 of Regulation No 1/2003 is not appropriate in the present case, even if it were possible. The fact that certain search terms may, as Meta Platforms Ireland submits, be too vague has no bearing on the fact that other search terms may be sufficiently precise or targeted to enable the finding – that they may help the Commission to determine whether an infringement of the competition rules has taken place – to be established.
Having regard to the presumption that acts of the EU institutions are valid, the Court accordingly concludes that only the search terms specifically challenged by Meta Platforms Ireland may be reviewed as to whether the principle of necessity has been observed. The other search terms must, by contrast, be regarded as having been defined in accordance with that principle.
In addition, after noting that the arguments concerning the search terms referred to for the first time at the stage of the reply are inadmissible, the Court examines only the search terms referred to in the application. Taking the view that Meta Platforms Ireland has not successfully established that those terms were contrary to the principle of necessity, the Court rejects the various arguments put forward in that regard as being unfounded.
In its action for annulment, Meta Platforms Ireland also submitted that, by requiring the production of numerous irrelevant documents of a private nature, the decision of 4 May 2020, as amended (‘the contested decision’), infringed the fundamental right to privacy enshrined in Article 7 of the Charter of Fundamental Rights of the European Union (‘the Charter’) and Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms (‘the ECHR’).
In that regard, the Court recalls that, in accordance with Article 7 of the Charter, which contains rights that correspond to those guaranteed by Article 8(1) ECHR, everyone has the right to respect for his or her private and family life, home, and communications.
As regards impediments to that right, Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and respect the essence of those rights and freedoms. In addition, subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.
In the light of those clarifications, the Court examines whether the impediment to Article 7 of the Charter created by the contested decision satisfies the conditions set out in Article 52(1) thereof.
After observing that Regulation No 1/2003 confers on the Commission the power to adopt the contested decision, such that the interference with privacy which it causes is provided for by law, that that decision meets objectives of general interest of the European Union and that Meta Platforms Ireland had not maintained that the contested decision compromises the essence of the right to privacy, the Court examines whether the contested decision disproportionately impedes that right.
On that point, the Court confirms, in the first place, that a request for information under Article 18(3) of Regulation No 1/2003 constitutes an appropriate measure for attaining the objectives of general interest pursued by the Commission, namely the maintenance of the system of competition intended by the Treaties.
As regards, in the second place, the question whether the contested decision goes beyond what is necessary in order to achieve those objectives of general interest, the Court notes that, following the delivery of the interim order of 29 October 2020, the Commission adopted a separate procedure for the treatment of documents to be produced by Meta Platforms Ireland but which, prima facie, were not linked with its business activities and which contained sensitive personal data (‘the Protected Documents’).
Under that procedure, the Protected Documents were to be transmitted to the Commission on a separate electronic medium and placed in a virtual data room accessible to a limited number of members of the team responsible for the investigation, in the presence of Meta Platforms Ireland’s lawyers, with a view to selecting the documents to be placed on the file. In the event of continuing disagreement regarding the classification of a document, the amending decision also lays down a system for resolving disputes. In accordance with that decision, the Protected Documents may, moreover, be transmitted to the Commission in a redacted form by removing the names of the individuals concerned and any information allowing to identify them. Upon request by the Commission motivated by the needs of the investigation, those documents must nevertheless be provided to it in a full version.
The Court observes, furthermore, that it is not disputed that certain documents requested by the Commission contained sensitive personal data capable of falling within the data referred to in Article 9 of Regulation 2016/679 6 and Article 10 of Regulation 2018/1725 7, in relation to which the ability to undertake processing is subject to the
following three conditions:
the processing must pursue a significant public interest, with its basis in EU law;
the processing must be necessary to fulfill that public interest;
EU law must be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
Since those conditions are also relevant for assessing whether, in accordance with Article 52(1) of the Charter, the contested decision does not go beyond what is necessary to achieve the objectives of general interest which it pursues, the Court recalls, first, that a request for information such as the contested decision constitutes an appropriate measure for achieving the objectives of general interest pursued by the Commission (first condition) and, second, that the processing of personal data entailed by the contested decision is necessary to fulfill the significant public interest pursued (second condition).
Referring to the arrangements for the transmission, consultation, evaluation and anonymisation of the Protected Documents, the Court considers that the third condition referred to above is also satisfied in the present case.
Having thereby established that the contested decision, in so far as it lays down the virtual data room procedure, does not go beyond what is necessary to achieve the objectives of general interest pursued, the Court finds, in the third place, that the disadvantages involved in that procedure were also not disproportionate to the aims pursued.
In the light of all the foregoing, the Court concludes that the impediment to the right to privacy caused by the contested decision satisfies the conditions set out in Article 52(1) of the Charter and therefore rejects the complaints alleging infringement of Article 7 of the Charter.
Since the other pleas in law raised by Meta Platforms Ireland have also proved to be unfounded, the Court dismisses the action in its entirety.
NOTE: An action for annulment seeks the annulment of acts of the institutions of the European Union that are contrary to European Union law. The Member States, the European institutions and individuals may, under certain conditions, bring an action for annulment before the Court of Justice or the General Court. If the action is well-founded, the act is annulled. The institution concerned must fill any legal vacuum created by the annulment of the act.
NOTE: An appeal, on a point or points of law only, may be brought before the Court of Justice against a judgment or order of the General Court. In principle, the appeal does not have suspensive effect. If the appeal is admissible and well-founded, the Court of Justice sets aside the judgment of the General Court. Where the state of the proceedings so permits, the Court of Justice may itself give final judgment in the case. Otherwise, it refers the case back to the General Court, which is bound by the decision given by the Court of Justice on the appeal.
Unofficial document for media use, not binding on the General Court. The full text of the judgment is published on the CURIA website on the day of delivery.
—
1 Commission Decision (C(2020) 3011 final of 4 May 2020 relating to a proceeding pursuant to Article 18(3) and to Article 24(1)(d) of Regulation (EC) No 1/2003 (Case AT.40628 – Facebook Data-related practices).
2 Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation of the rules on competition laid down in Articles [101] and [102 TFEU] (OJ 2003 L 1, p. 1).
3 On the same date, the Commission adopted a request for information under Article 18(3) of Regulation (EC) No 1/2003 in respect of Meta Platforms Ireland Ltd in the context of its parallel investigation into certain practices relating to the Marketplace product. The action for annulment brought by Meta Platforms Ireland Ltd against that decision is dismissed by the Court in its judgment of the same date in Case T-452/20 Meta Platforms Ireland v Commission.
4 Order of 29 October 2020, Facebook Ireland v Commission (T-451/20 R, EU:T:2020:515).
5 Commission Decision C(2020) 9231 final of 11 December 2020
6 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2).
7 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, (OJ 2018 L 295, p. 39).
Source – EU General Court: 83/2023 : 24 May 2023 – Judgment of the General Court in case T-451/20