EU General Court Rules On Protection Of Private Data In Competition Investigations

• Published date: 06 July 2023
• Subject Matter: Antitrust/Competition Law, Privacy, Antitrust, EU Competition , Data Protection, Privacy Protection
• Law Firm: Mayer Brown
• Author: Ms Nathalie Jalabert-Doury and Sarah Wilks

Introduction

Like many competition authorities, the European Commission ("Commission") has far reaching powers to ask for huge amounts of information for its competition law investigations.¹ These days it is no longer just hard copy documents being asked for, but significant amounts of electronic data in specified formats expected to be produced in short time frames. Given the commercial implications of resourcing such a request as well as the potential penalties and reputational damage at stake, it is not surprising when businesses push back. The European Courts have already established that the Commission must act within its powers and in particular only ask for information which is necessary and proportionate. The recent decision by the General Court of the EU ("General Court") concerning requests for information ("RFIs") sent to Meta,² brings this caselaw into the digital age. Last month's ruling marks the first time we hear from the European Courts about the legality of a RFI using digital search terms (so called keyword RFIs), as well as to what extent investigatory powers may interfere with the protection of sensitive personal data. The ruling is likely to have a major impact on the way in which the Commission requests information going forward both in the context of written RFIs and in other investigatory contexts such as dawn raids, and businesses would be well advised to plan ahead, as to how they might respond.

Background

In May 2020, the Commission sent several RFIs to Meta concerning how its marketplace competes with classified advertisement services of other operators and its data collection and processing practices.³ More specifically, Meta was asked to provide the Commission with all documents prepared or received by numerous custodians within a defined time period, which contained one or more of the search terms defined in the annexes to one of the RFIs. This required Meta to run 2,500 search terms across its internal systems and analyse more than a million documents. The Commission bolstered this request with a reminder that it had the right to impose a multi-million euro fine per day of non-compliance.

Two months later, after partially responding to the RFIs, Meta lodged at the General Court both an action for annulment of the decision of May 2020 and an application for interim measures. Meta submitted that applying the Commission's search terms would identify hundreds of thousands of documents, many of which would be wholly irrelevant to the Commission's investigation and/or include highly private or personal information about the business, its officers and employees such as private medical and financial data of employees, documents relating to personal wills or company security assessments. Search terms included: "not good for us", "for free", "shut down", "big question", "advantage", "quality" and "looked...