JUDGMENT OF THE COURT (Grand Chamber)
19 June 2018 (*)
(Reference for a preliminary ruling — Approximation of laws — Directive 2004/39/EC — Article 54(1) — Scope of the obligation of professional secrecy on national financial supervision authorities — Concept of ‘confidential information’)
In Case C‑15/16,
REQUEST for a preliminary ruling under Article 267 TFEU from the Bundesverwaltungsgericht (Federal Administrative Court, Germany), made by decision of 4 November 2015, received at the Court on 11 January 2016, in the proceedings
Bundesanstalt für Finanzdienstleistungsaufsicht
v
Ewald Baumeister,
intervening party:
Frank Schmitt, in his capacity as liquidator of Phoenix Kapitaldienst GmbH,
THE COURT (Grand Chamber),
composed of K. Lenaerts, President, A. Tizzano, Vice-President, R. Silva de Lapuerta, M. Ilešič, J.L. da Cruz Vilaça (Rapporteur), C.G. Fernlund and C. Vajda, Presidents of Chambers, J.-C. Bonichot, A. Arabadjiev, C. Toader, M. Safjan, D. Šváby, A. Prechal, E. Jarašiūnas and S. Rodin, Judges,
Advocate General: Y. Bot,
Registrar: K. Malacek, Administrator,
having regard to the written procedure and further to the hearing on 4 July 2017,
after considering the observations submitted on behalf of:
– the Bundesanstalt für Finanzdienstleistungsaufsicht, by R. Wiegelmann, acting as Agent,
– Mr Baumeister, by P. A. Gundermann, Rechtsanwalt,
– Mr Schmitt, in his capacity as liquidator of Phoenix Kapitaldienst GmbH, by A.J. Baumert, Rechtsanwalt,
– the German Government, by T. Henze, J. Möller and D. Klebs, acting as Agents,
– the Estonian Government, by K. Kraavi-Käerdi and N. Grünberg, acting as Agents,
– the Netherlands Government, by M. Bulterman and B. Koopman, acting as Agents,
– the Polish Government, by B. Majczyna, B. Majerczyk-Graczykowska and A. Kramarczyk-Szaładzińska, acting as Agents,
– the United Kingdom Government, by S. Simmons and Z. Lavery, acting as Agents, and by V. Wakefield and S. Ford, Barristers,
– the European Commission, by I.V. Rogalski, J. Rius and K. P. Wojcik, acting as Agents,
– the EFTA Surveillance Authority, by C. Zatschler, M. Schneider, I. O. Vilhjálmsdóttir and M.L. Hakkebo, acting as Agents,
after hearing the Opinion of the Advocate General at the sitting on 12 December 2017,
gives the following
Judgment
1 This request for a preliminary ruling concerns the interpretation of Article 54(1) of Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments, amending Council Directives 85/611/EEC and 93/6/EEC and Directive 2000/12/EC of the European Parliament and of the Council and repealing Council Directive 93/22/EEC (OJ 2004 L 145, p. 1).
2 The request has been made in proceedings where the opposing parties are the Bundesanstalt für Finanzdienstleistungsaufsicht (Federal Financial Supervisory Authority, Germany) and Mr Ewald Baumeister, with respect to the decision of the former to refuse access to certain documents relating to Phoenix Kapitaldienst GmbH (‘Phoenix’).
Legal context
EU law
3 Recitals 2 and 63 of Directive 2004/39 state:
‘(2) … it is necessary to provide for the degree of harmonisation needed to offer investors a high level of protection and to allow investment firms to provide services throughout the Community, being a Single Market, on the basis of home country supervision …
…
(63) … Due to increasing cross-border activity, competent authorities should provide each other with the relevant information for the exercise of their functions, so as to ensure the effective enforcement of this Directive, including in situations where infringements or suspected infringements may be of concern to authorities in two or more Member States. In the exchange of information, strict professional secrecy is needed to ensure the smooth transmission of that information and the protection of particular rights.’
4 Article 17(1) of that directive, that article being headed ‘General obligation in respect of on-going supervision’, provides:
‘Member States shall ensure that the competent authorities monitor the activities of investment firms so as to assess compliance with the operating conditions provided for in this Directive. Member States shall ensure that the appropriate measures are in place to enable the competent authorities to obtain the information needed to assess the compliance of investment firms with those obligations.’
5 Article 50 of that directive, headed ‘Powers to be made available to competent authorities’, provides:
‘1. Competent authorities shall be given all supervisory and investigatory powers that are necessary for the exercise of their functions …
2. The powers referred to in paragraph 1 shall be exercised in conformity with national law and shall include, at least, the rights to:
(a) have access to any document in any form and to receive a copy of it;
(b) demand information from any person and if necessary to summon and question a person with a view to obtaining information;
…’
6 Article 54 of Directive 2004/39, headed ‘Professional secrecy’, provides:
‘1. Member States shall ensure that competent authorities, all persons who work or who have worked for the competent authorities or entities to whom tasks are delegated pursuant to Article 48(2), as well as auditors and experts instructed by the competent authorities, are bound by the obligation of professional secrecy. No confidential information which they may receive in the course of their duties may be divulged to any person or authority whatsoever, save in summary or aggregate form such that individual investment firms, market operators, regulated markets or any other person cannot be identified, without prejudice to cases covered by criminal law or the other provisions of this Directive.
2. Where an investment firm, market operator or regulated market has been declared bankrupt or is being compulsorily wound up, confidential information which does not concern third parties may be divulged in civil or commercial proceedings if necessary for carrying out the proceeding.
3. Without prejudice to cases covered by criminal law, the competent authorities, bodies or natural or legal persons other than competent authorities which receive confidential information pursuant to this Directive may use it only in the performance of their duties and for the exercise of their functions, in the case of the competent authorities, within the scope of this Directive or, in the case of other authorities, bodies or natural or legal persons, for the purpose for which such information was provided to them and/or in the context of administrative or judicial proceedings specifically related to the exercise of those functions. However, where the competent authority or other authority, body or person communicating information consents thereto, the authority receiving the information may use it for other purposes.
4. Any confidential information received, exchanged or transmitted pursuant to this Directive shall be subject to the conditions of professional secrecy laid down in this Article. Nevertheless, this Article shall not prevent the competent authorities from exchanging or transmitting confidential information in accordance with this Directive and with other Directives applicable to investment firms, credit institutions, pension funds, UCITS [undertakings for collective investment in transferable securities], insurance and reinsurance intermediaries, insurance undertakings, regulated markets or market operators or otherwise with the consent of the competent authority or other authority or body or natural or legal person that communicated the information.
5. This Article shall not prevent the competent authorities from exchanging or transmitting in accordance with national law, confidential information that has not been received from a competent authority of another Member State.’
7 Article 56(1) of Directive 2004/39, that article being headed ‘Obligation to cooperate’, provides:
‘Competent authorities of different Member States shall cooperate with each other whenever necessary for the purpose of carrying out their duties under this Directive, making use of their powers whether set out in this Directive or in national law.
Competent authorities shall render assistance to competent authorities of the other Member States. In particular, they shall exchange information and cooperate in any investigation or supervisory activities.
…’
8 Article 58(1) of that directive, that article being headed ‘Exchange of information’, provides:
‘Competent authorities of Member States having been designated as contact points for the purposes of this Directive in accordance with Article 56(1) shall immediately supply one another with the information required for the purposes of carrying out the duties of the competent authorities, designated in accordance to Article 48(1), set out in the provisions adopted pursuant to this Directive.
Competent authorities exchanging information with other competent authorities under this Directive may indicate at the time of communication that such information must not be disclosed without their express agreement, in which case such information may be exchanged solely for the purposes for which those authorities gave their agreement.’
German law
9 Paragraph 1(1) of the Informationsfreiheitsgesetz (the Law Governing Access to Information) of 5 September 2005 (BGBl. 2005 I, p. 2722), as amended by the law of 7 August 2013 (BGBl. 2013 I, p. 3154; ‘the IFG’), is worded as follows:
‘Everyone is entitled to official information from the authorities of the Federal Government in accordance with the provisions of this Law.’
10 Paragraph 3(4) of the IFG, that paragraph being headed ‘Protection of special public interests’, provides:
‘The right of access to information shall not apply
…
4. where the information is subject to an obligation to maintain confidentiality by virtue of a statutory regulation or the general administrative regulation on the material and organisational protection of classified information, or where the information is subject to professional or special official secrecy.’
11 Paragraph 9(1) of the Kreditwesengesetz (Law on the activities of credit institutions), of 9 September 1998 (BGBl. 1998 I, p. 2776), as amended by the law of 4 July 2013 (BGBl. 2013 I, p. 1981, ‘the KWG’), that paragraph being headed ‘Obligation of confidentiality’, provides:
‘Persons employed by [the Federal Financial Supervisory Authority], in so far as their work serves to implement this Law, may not divulge or use without authorisation facts which have come to their notice in the course of their duties and which are to remain confidential in the interests of the [persons subject to this Law] or of a third party, in particular business and trade secrets, even after they have left such employment or their duties have ended …’
The dispute in the main proceedings and the questions referred for a preliminary ruling
12 It is apparent from the order for reference that insolvency proceedings were initiated against Phoenix in the course of 2005. That company was then dissolved and is now in judicial liquidation. Phoenix’s business model took the form of a Ponzi scheme.
13 Mr Baumeister is one of the investors who suffered loss due to the activities of Phoenix. He made a request to the Federal Financial Supervisory Authority, under Paragraph 1(1) of the IFG, to obtain access to documents concerning Phoenix, such as a special audit report, reports prepared by the auditors, and internal documents, reports and correspondence received or sent out by that authority as part of its supervision of Phoenix. The Federal Financial Supervisory Authority refused that request for access.
14 After his informal complaint was unsuccessful, Mr Baumeister brought an action against the refusal of the Federal Financial Supervisory Authority before the Verwaltungsgericht Frankfurt am Main (Administrative Court of Frankfurt am Main, Germany). By a judgment of 12 March 2008, the court ordered that authority to grant access to the documents requested, with the exception of those containing trade or business secrets and documents relating to the United Kingdom Financial Services Authority.
15 By a judgment of 29 November 2013, the Hessischer Verwaltungsgerichtshof (Higher Administrative Court of Hesse, Germany), before whom an appeal against that judgment had been brought, held that (i) that Mr Baumeister had a right of access to the documents requested under Paragraph 1(1) of the IFG and (ii) his request for access could not be refused in general terms on the basis of the combined application of Paragraph 3(4) of the IFG and Paragraph 9(1) of the KWG. That court held that access to the documents at issue could be refused solely if they related to trade or business secrets, which had to be identified individually in each specific case, in the same way as the personal data of third parties. No other approach would be consistent with EU law.
16 The Federal Financial Supervisory Authority brought an appeal on a point of law against that judgment before the Bundesverwaltungsgericht (Federal Administrative Court, Germany).
17 The Federal Administrative Court states, in essence, that the scope attributed by the Hessischer Verwaltungsgerichtshof (Higher Administrative Court of Hesse) to the protection conferred by Paragraph 9(1) of the KWG is too restrictive in two respects. First, that provision is designed to give general protection to all information the confidentiality of which the supervised entity or a third party have a legitimate interest in maintaining, including information that has an economic value that can be realised in the course of insolvency proceedings, irrespective of whether the information strictly concerns trade or business secrets. Second, that provision also provides protection against the disclosure of information the confidentiality of which the Federal Financial Supervisory Authority has a legitimate interest in maintaining. In all cases, it is necessary to examine the content of the information in order to decide whether there is such a legitimate interest. Further, the extent to which information merits protection should generally diminish over time.
18 Nonetheless, in the light of Article 54(1) of Directive 2004/39, the referring court is uncertain as to whether the scope of the obligation of confidentiality laid down in Paragraph 9(1) of the KWG should be construed more broadly.
19 In that regard, essentially, the referring court, first, recalls certain findings of the Courts of the European Union in the context of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43), and of Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation of the rules on competition laid down in Articles [101] and [102 TFEU] (OJ 2003 L 1, p. 1) (see, inter alia, judgments of 16 July 2015, ClientEarth v Commission, C‑612/13 P, EU:C:2015:486, paragraphs 68, 69 and 77, and of 28 January 2015, Evonik Degussa v Commission, T‑341/12, EU:T:2015:51, paragraphs 84 and 94). Second, the referring court observes that the specific characteristics of the activity of monitoring the financial markets might justify the attribution of a particularly broad scope to Paragraph 9(1) of the KWG, not least from a temporal perspective.
20 In those circumstances, the Bundesverwaltungsgericht (Federal Administrative Court) decided to stay the proceedings and to refer the following questions to the Court for a preliminary ruling:
‘(1) (a) Is all business information communicated to the supervisory authority by the supervised entity covered by the term “confidential information” within the meaning of the second sentence of Article 54(1) of Directive [2004/39], and therefore the obligation of professional secrecy in accordance with the first sentence of Article 54(1) of [that] directive, independently of any further conditions?
(b) Does “prudential secrecy”, as a component of professional secrecy within the meaning of the first sentence of Article 54(1) of Directive 2004/39, independently of any further conditions, cover all statements of the supervisory authority contained in the file, including its correspondence with other bodies?
If questions (a) or (b) are answered in the negative:
(c) Must the provision on professional secrecy in Article 54(1) of Directive 2004/39 be interpreted as meaning that, as regards classification of information as confidential,
(i) the determining factor is whether the information is by its nature covered by the obligation of professional secrecy or whether access to the information could actually and specifically undermine the interest served by confidentiality, or
(ii) account must be taken of other circumstances under which the information is covered by the obligation of professional secrecy, or
(iii) in respect of business information of the [supervised entity] communicated to and held in the files of the supervisory authority as well as related documentation of its own, the supervisory authority may rely on a rebuttable presumption that this information concerns business or prudential secrets?
(2) Must the term “confidential information” within the meaning of the second sentence of Article 54(1) of Directive 2004/39 be interpreted as meaning that for business information communicated by the supervisory authority to be classified as a business secret meriting protection or as information otherwise meriting protection, the only relevant factor is the date of communication to the supervisory authority?
If the second question is answered in the negative:
(3) Regarding the question whether an item of business information is to be protected as a business secret regardless of changes in the economic climate and is therefore subject to the obligation of professional secrecy in accordance with the second sentence of Article 54(1) of Directive 2004/39, must, in a general manner, a time limit — of five years, say — be assumed, following the expiry of which there will be a rebuttable presumption that the information has lost its economic value? Do analogous considerations apply as regards prudential secrecy?’
Consideration of the questions referred
The first question
21 By its first question, the referring court seeks, in essence, to ascertain whether Article 54(1) of Directive 2004/39 must be interpreted as meaning that all information relating to the supervised entity and communicated by it to the competent authority, and all statements of that authority in its supervision file, including its correspondence with other bodies, constitutes, unconditionally, confidential information that is covered, consequently, by the obligation to maintain professional secrecy that is laid down in that provision. If it does not, the referring court seeks to ascertain, essentially, what criteria are relevant to determining which information, of that held by the authorities established by the Member States to perform the functions laid down by that directive (‘the competent authorities’), must be regarded meeting the definition of confidential information.
22 In that regard, it is clear that neither Article 54 of Directive 2004/39 nor any other provision of that directive states explicitly which information that is held by the competent authorities is to be classified as ‘confidential’ and subject, consequently, to the obligation of professional secrecy.
23 Further, while there is significant diversity in the relevant national rules on the matter, the text of Directive 2004/39 makes no reference to national law with respect to the determination of the meaning and scope of the concept of ‘confidential information’ in Article 54(1) of that directive.
24 In accordance with the Court’s settled case-law, the need for a uniform application of EU law requires that, where a provision of EU law makes no reference to the law of the Member States with regard to a particular concept, that concept must be given an independent and uniform interpretation throughout the European Union. That interpretation must be sought having regard not only to the wording of the provision at issue but also to its context and to the objective pursued by the legislation in question (see, to that effect, judgments of 19 December 2013, Fish Legal and Shirley, C‑279/12, EU:C:2013:853, paragraph 42, and of 16 July 2015, A, C‑184/14, EU:C:2015:479, paragraphs 31 and 32).
25 As regards the wording of Article 54 of Directive 2004/39, the fact that that article refers repeatedly to ‘confidential information’ and not, generically, to ‘information’, implies that a distinction should be drawn between confidential information and other information that is not confidential which the competent authorities hold in connection with the exercise of their functions.
26 As regards the context of Article 54 of Directive 2004/39 and the objectives pursued by that directive, it is stated in recital 2 thereof that its purpose is to provide for the degree of harmonisation required to offer investors a high level of protection and to allow investment firms to provide services throughout the European Union on the basis of home country supervision (judgment of 12 November 2014, Altmann and Others, C‑140/13, EU:C:2014:2362, paragraph 26).
27 It is also apparent from the second sentence of recital 63 of Directive 2004/39 that, due to increasing cross-border activity, competent authorities should provide each other with the information that is necessary for the exercise of their functions, so as to ensure the effective enforcement of that directive (judgment of 12 November 2014, Altmann and Others, C‑140/13, EU:C:2014:2362, paragraph 27).
28 Thus, under Article 17(1) of Directive 2004/39, the Member States must ensure that the competent authorities continuously monitor the activities of investment firms so as to assess compliance with their obligations (judgment of 12 November 2014, Altmann and Others, C‑140/13, EU:C:2014:2362, paragraph 28).
29 Article 50(1) and (2) of that directive provide that the competent authorities must have all supervisory and investigatory powers that are necessary for the exercise of their functions, including the rights to have access to any document and to demand information from any person (judgment of 12 November 2014, Altmann and Others, C‑140/13, EU:C:2014:2362, paragraph 29).
30 Further, Article 56(1) of Directive 2004/39 states that competent authorities are to render assistance to competent authorities of the other Member States. In particular, they must exchange information and cooperate in any investigation or supervisory activities (judgment of 12 November 2014, Altmann and Others, C‑140/13, EU:C:2014:2362, paragraph 30).
31 The effective monitoring of the activities of investment firms, through supervision within a Member State and the exchanging of information by the competent authorities of several Member States, as briefly described in the preceding paragraphs, requires that both the supervised entities and the competent authorities can have confidence that the confidential information provided will, in principle, remain confidential (judgment of 12 November 2014, Altmann and Others, C‑140/13, EU:C:2014:2362, paragraph 31).
32 As is clear from, in particular, the last sentence of recital 63 of Directive 2004/39, the absence of such confidence is liable to compromise the smooth transmission of the confidential information that is necessary for monitoring (judgment of 12 November 2014, Altmann and Others, C‑140/13, EU:C:2014:2362, paragraph 32).
33 Therefore, in order to protect not only the specific interests of the firms directly concerned, but also the public interest in the normal functioning of the markets in financial instruments of the European Union, Article 54(1) of Directive 2004/39 imposes, as a general rule, the obligation to maintain professional secrecy (see, to that effect, judgment of 12 November 2014, Altmann and Others, C‑140/13, EU:C:2014:2362, paragraph 33).
34 In the light of all the foregoing considerations, it cannot be inferred from the wording of Article 54 of Directive 2004/39, or from the context of that article, or from the objectives pursued by that directive, that it is mandatory that all information relating to the supervised entity and communicated by it to the competent authority, and all statements of that authority in its supervision file, including its correspondence with other bodies, be deemed to be confidential.
35 It also follows from those considerations that the general prohibition on the disclosure of confidential information laid down in Article 54(1) of that directive applies to information held by the competent authorities (i) which is not public and (ii) the disclosure of which is likely to affect adversely the interests of the natural or legal person who provided that information or of third parties, or the proper functioning of the system for monitoring the activities of investment firms that the EU legislature established in adopting Directive 2004/39.
36 It should however be stated that the conditions set out in the preceding paragraph must be without prejudice to other provisions of EU law that are intended to ensure stricter protection of the confidentiality of certain information.
37 One of those provisions is the second subparagraph of Article 58(1) of Directive 2004/39 on the exchange of information by competent authorities, which provides that ‘[c]ompetent authorities exchanging information with other competent authorities under this Directive may indicate at the time of communication that such information must not be disclosed without their express agreement, in which case such information may be exchanged solely for the purposes for which those authorities gave their agreement’.
38 It must also be stated that Article 54 of Directive 2004/39 establishes the general rule that disclosure of confidential information held by the competent authorities is prohibited and lists exhaustively the specific cases where, exceptionally, that general prohibition does not preclude their communication or use (see, to that effect, judgment of 12 November 2014, Altmann and Others, C‑140/13, EU:C:2014:2362, paragraphs 34 and 35).
39 It is, accordingly, not the aim of Article 54 to create a right of access that can be exercised by the public to information held by the competent authorities or to regulate in detail how any such right of access that may be recognised in some cases by national law is to be exercised.
40 In that regard, the objective served by Article 54 of Directive 2004/39 differs from that pursued by Regulation No 1049/2001.
41 The aim of Regulation No 1049/2001 is to give the public a right of access to documents of the institutions of the European Union which is as wide as possible (see, to that effect, judgments of 1 July 2008, Sweden and Turco v Council, C‑39/05 P and C‑52/05 P, EU:C:2008:374, paragraph 33, and of 16 July 2015, ClientEarth v Commission, C‑612/13 P, EU:C:2015:486, paragraph 57).
42 That was the objective in the light of which the Court held that Regulation No 1049/2001 requires, as a general rule, an EU institution that proposes to refuse access to a document to explain how access to that document could specifically undermine the interest protected by one of the exceptions that are provided for to the right of access at issue, without prejudice to that institution’s right to rely, in that regard, on a general presumption of confidentiality that applies to a category of documents, where considerations of a generally similar kind are likely to apply to requests for disclosure relating to documents of the same nature (see, to that effect, judgments of 1 July 2008, Sweden and Turco v Council, C‑39/05 P and C‑52/05 P, EU:C:2008:374, paragraphs 48 to 50, and of 16 July 2015, ClientEarth v Commission, C‑612/13 P, EU:C:2015:486, paragraphs 68, 69 and 77).
43 However, where an individual submits to the competent authorities a request for access to information relating to a supervised entity and they consider, having regard to the cumulative conditions laid down in paragraph 35 of the present judgment, that the information requested is confidential, within the meaning of Article 54(1) of Directive 2004/39, they can grant such a request only in the situations that are listed exhaustively in Article 54.
44 It must, last, be emphasised that, since the sole aim of Article 54(1) of Directive 2004/39 is to impose on the competent authorities the obligation to refuse, as a general rule, to disclose confidential information, within the meaning of that provision, the Member States remain free to decide to extend the protection against disclosure to the entire contents of the supervision files of the competent authorities or, conversely, to permit access to information that is in the possession of the competent authorities which is not confidential information within the meaning of that provision.
45 In this case, it is for the referring court to determine, in the light of all the foregoing, whether the information held by the Federal Financial Supervisory Authority whose disclosure has been requested is covered by the obligation of professional secrecy which is binding on that authority under Article 54(1) of Directive 2004/39.
46 In the light of all the foregoing, the answer to the first question is that Article 54(1) of Directive 2004/39 must be interpreted as meaning that all information relating to the supervised entity and communicated by it to the competent authority, and all statements of that authority in its supervision file, including its correspondence with other bodies, do not constitute, unconditionally, confidential information that is covered, consequently, by the obligation to maintain professional secrecy laid down in that provision. Information held by the competent authorities (i) which is not public and (ii) the disclosure of which is likely to affect adversely the interests of the natural or legal person who provided that information or of third parties, or the proper functioning of the system for monitoring the activities of investment firms that the EU legislature established in adopting Directive 2004/39, is to be so classified.
The second question
47 By its second question, the referring court seeks, in essence, to ascertain whether Article 54(1) of Directive 2004/39 must be interpreted as meaning that the determination whether information relating to the supervised entity and transmitted to the competent authorities is confidential depends on the date of that transmission and how that information is classified on that date.
48 It must be stated, in that regard, that, if the objectives pursued by Article 54(1) of Directive 2004/39, as set out in paragraph 33 of the present judgment, are not to be jeopardised, the competent authorities are, as a general rule, bound to comply with the obligation of professional secrecy imposed on them by that provision throughout the period during which the information that they hold for the purposes of that directive has to be deemed to be confidential (see, to that effect, judgment of 12 November 2014, Altmann and Others, C‑140/13, EU:C:2014:2362, paragraphs 31 and 34).
49 That said, as the referring court and the European Commission have, in essence, observed, the passage of time is a circumstance that is normally liable to have an influence on the analysis of whether the conditions governing the confidentiality of the information concerned are satisfied at a given point in time (see, to that effect,judgments of 26 January 2010, Internationaler Hilfsfonds vCommission, C‑362/08 P, EU:C:2010:40, paragraphs 56 and 57, and of 14 March 2017, Evonik Degussa v Commission, C‑162/15 P, EU:C:2017:205, paragraph 64).
50 Consequently, it must be held that the general prohibition on disclosing confidential information laid down in Article 54(1) of Directive 2004/39 applies to information held by the competent authorities that must be classified as ‘confidential’ at the time of their examination of a request for disclosure, irrespective of how that information was classified at the time when it was communicated to those authorities.
51 The answer, therefore, to the second question is that Article 54(1) of Directive 2004/39 must be interpreted as meaning that the confidentiality of information relating to the supervised entity and communicated to the competent authorities must be assessed at the time of the examination which those authorities must undertake in order to decide on a request for disclosure relating to that information, irrespective of how that information was classified at the time when it was communicated to those authorities.
The third question
52 By its third question, the referring court seeks, in essence, to ascertain whether Article 54(1) of Directive 2004/39 must be interpreted as meaning that information held by the competent authorities which is at least five years old no longer constitutes business secrets or any other category of confidential information within the meaning of that provision.
53 As regards specifically information that can be classified as business secrets, it must be recalled that it is clear from the Court’s case-law that the protection of business secrets is a general principle of EU law (see, to that effect, judgment of 14 February 2008, Varec, C‑450/06, EU:C:2008:91, paragraph 49 and the case‑law cited).
54 Further, the Court’s case-law indicates that where information that could constitute business secrets at a certain moment in time is at least five years old, that information must, as a rule, on account of the passage of time, be considered historical and therefore as having lost its secret or confidential nature unless, exceptionally, the party relying on that nature shows that, despite its age, that information still constitutes an essential element of its commercial position or that of interested third parties (see, to that effect, judgment of 14 March 2017, Evonik Degussa v Commission, C‑162/15 P, EU:C:2017:205, paragraph 64).
55 The considerations set out in the preceding paragraph are equally valid in relation to the application of Article 54(1) of Directive 2004/39, in so far as the issue addressed is how time affects the relevance of certain information with respect to the commercial position of the undertakings concerned.
56 On the other hand, those considerations have no bearing in relation to information held by the competent authorities the confidentiality of which might be justified for reasons other than the importance of that information with respect to the commercial position of the undertakings concerned, such as, in particular, information relating to the supervision methodology and strategy employed by the competent authorities.
57 Consequently, the answer to the third question is that Article 54(1) of Directive 2004/39 must be interpreted as meaning that information held by the competent authorities that could constitute business secrets, but is at least five years old, must, as a rule, on account of the passage of time, be considered historical and therefore as having lost its secret or confidential nature unless, exceptionally, the party relying on that nature shows that, despite its age, that information still constitutes an essential element of its commercial position or that of interested third parties. Such considerations have no bearing in relation to information held by those authorities the confidentiality of which might be justified for reasons other than the importance of that information with respect to the commercial position of the undertakings concerned.
Costs
58 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Grand Chamber) hereby rules:
1. Article 54(1) of Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments amending Council Directives 85/611/EEC and 93/6/EEC and Directive 2000/12/EC of the European Parliament and of the Council and repealing Council Directive 93/22/EEC must be interpreted as meaning that all information relating to the supervised entity and communicated by it to the competent authority, and all statements of that authority in its supervision file, including its correspondence with other bodies, do not constitute, unconditionally, confidential information that is covered, consequently, by the obligation to maintain professional secrecy laid down in that provision. Information held by the authorities established by the Member States to perform the functions laid down by that directive that is information (i) which is not public and (ii) the disclosure of which is likely to affect adversely the interests of the natural or legal person who provided that information or of third parties, or the proper functioning of the system for monitoring the activities of investment firms that the EU legislature established in adopting Directive 2004/39, is to be so classified.
2. Article 54(1) of Directive 2004/39 must be interpreted as meaning that the confidentiality of information relating to the supervised entity and communicated to the authorities established by the Member States to perform the functions laid down by that directive must be assessed at the time of the examination which those authorities must undertake in order to decide on a request for disclosure relating to that information, irrespective of how that information was classified at the time when it was communicated to those authorities.
3. Article 54(1) of Directive 2004/39 must be interpreted as meaning that information held by the authorities established by the Member States to perform the functions laid down by that directive that could constitute business secrets, but is at least five years old, must, as a rule, on account of the passage of time, be considered historical and therefore as having lost its secret or confidential nature unless, exceptionally, the party relying on that nature shows that, despite its age, that information still constitutes an essential element of its commercial position or that of interested third parties. Such considerations have no bearing in relation to information held by those authorities the confidentiality of which might be justified for reasons other than the importance of that information with respect to the commercial position of the undertakings concerned.
[Signatures]