JUDGMENT OF THE GENERAL COURT (Fifth Chamber, Extended Composition)

24 May 2023 (*)

(Competition – Data market – Administrative procedure – Article 18(3) and Article 24(1)(d) of Regulation (EC) No 1/2003 – Request for information – Virtual data room – Obligation to state reasons – Legal certainty – Rights of the defence – Necessity of the information requested – Misuse of powers – Right to privacy – Proportionality – Principle of good administration – Professional secrecy)

In Case T‑452/20,

Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd, established in Dublin (Ireland), represented by D. Jowell KC, D. Bailey, Barrister, J. Aitken, D. Das, S. Malhi, R. Haria, M. Quayle, Solicitors, and T. Oeyen, lawyer,

applicant,

v

European Commission, represented by G. Conte, C. Urraca Caviedes and C. Sjödin, acting as Agents,

defendant,

supported by

Federal Republic of Germany, represented by S. Costanzo, acting as Agent,

intervener,

THE GENERAL COURT (Fifth Chamber, Extended Composition),

composed, at the time of the deliberations, of S. Papasavvas, President, D. Spielmann (Rapporteur), R. Mastroianni, M. Brkan and I. Gâlea, Judges,

Registrar: I. Kurme, Administrator,

having regard to the written part of the procedure,

further to the hearing on 1 June 2022,

gives the following

Judgment

1        By its action under Article 263 TFEU, the applicant, Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd, seeks annulment of Commission Decision C(2020) 3013 final of 4 May 2020 relating to a proceeding under Article 18(3) and Article 24(1)(d) of Council Regulation (EC) No 1/2003 (Case AT.40684 – Facebook Marketplace) (‘the initial decision’), as amended by Commission Decision C(2020) 9229 final of 11 December 2020 (‘the amending decision’) (together, ‘the contested decision’).

I.      Background to the dispute

2        On 13 March 2019, the European Commission sent the applicant a request for information by decision taken pursuant to Article 18(3) of Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation of the rules on competition laid down in Articles [101] and [102 TFEU] (OJ 2003 L 1, p. 1). That request for information comprised more than 100 unique questions, concerning various aspects of the applicant’s business and product offering.

3        The applicant replied to that request for information in three stages, on 23 April, 21 May and 18 June 2019. The documents produced were identified based on an initial search conducted by way of search terms chosen by the applicant and a relevance review carried out by the applicant’s external EU-qualified lawyers.

4        On 30 August 2019, the Commission sent a request for information on the basis of Article 18(2) of Regulation No 1/2003. That request for information comprised 83 unique questions regarding Facebook Marketplace, social networking and online classified advertisement providers.

5        The applicant replied to that request for information in three stages, on 30 September, 10 October and 5 November 2019.

6        On 4 May 2020, the Commission adopted the initial decision. Under Article 1 of that decision, the applicant was to supply the Commission with the information specified in Annex I.A to that decision by 15 June 2020 and the information specified in Annex I.B by 29 June 2020. Article 2 provided for a potential penalty payment of EUR 8 million per day for failure to provide complete and accurate information requested under Article 1.

7        On 4 May 2020, the Director-General of the Commission’s Directorate-General (DG) for Competition sent the applicant a letter proposing a separate procedure for the production of sensitive documents which, according to the applicant, contained only personal information wholly unconnected with its commercial activities. Those documents would be placed on the file only after having been examined in a virtual data room.

8        In a series of exchanges, the applicant and the Commission discussed possible ways in which the virtual data room might be used.

9        By letter of 12 June 2020, the Commission agreed to extend until 10 August 2020 the period within which the applicant was required to reply to the request for information contained in the initial decision.

II.    Forms of order sought

10      By application lodged at the Registry of the General Court on 15 July 2020, the applicant brought the present action.

11      The applicant claims that the Court should:

–        annul the contested decision;

–        in the alternative, annul Article 1 of the contested decision;

–        order the Commission to pay the costs and order the Federal Republic of Germany to bear its own costs.

12      The Commission contends that the Court should:

–        declare inadmissible the applicant’s head of claim seeking the annulment in part of Article 1 of the contested decision in so far as it does not provide for accurate and adequate guarantees to be put in place safeguarding the rights of the persons concerned by the production of irrelevant documents which are personal or private in nature;

–        dismiss the action;

–        order the applicant to pay the costs.

13      The Federal Republic of Germany contends that the action should be dismissed and that the applicant should be ordered to pay the costs.

III. Facts subsequent to the action having been brought

A.      Procedure for interim relief

14      By a separate document lodged at the Court Registry on 15 July 2020, the applicant submitted an application for interim measures.

15      By order of 24 July 2020, Facebook Ireland v Commission (T‑452/20 R, not published), adopted on the basis of Article 157(2) of the Rules of Procedure of the General Court, the President of the General Court ordered that the operation of the initial decision be suspended until the date of the order terminating the present proceedings for interim relief.

16      By order of 29 October 2020, Facebook Ireland v Commission (T‑452/20 R, not published, EU:T:2020:516), the President of the General Court set aside the order of 24 July 2020 referred to in paragraph 15 above, reserved the costs, ordered as follows and dismissed the application for interim relief as to the remainder:

‘1.      The operation of Article 1 of the [initial decision] is suspended, in so far as the obligation set out therein relates to documents which are not linked to [the applicant’s] business activities and which contain sensitive personal data, and for as long as the procedure referred to in point 2 has not been put in place.

2.      [The applicant] shall identify the documents containing the data referred to in point 1 and transmit them to the Commission on a separate electronic medium. Those documents shall then be placed in a virtual data room which shall be accessible to as limited a number as possible of members of the team responsible for the investigation, in the presence (virtual or physical) of an equivalent number of [the applicant’s] lawyers. The members of the team responsible for the investigation shall examine and select the documents in question, while giving [the applicant’s] lawyers the opportunity to comment on them before the documents considered relevant are placed on the file. In the event of disagreement as to the classification of a document, [the applicant’s] lawyers shall have the right to explain the reasons for their disagreement. In the event of continuing disagreement, [the applicant] may ask the Director for Information, Communication and Media at the Commission’s Directorate-General for Competition to resolve the disagreement.’

B.      Adoption of an amending decision and modification of the application

17      On 11 December 2020, the Commission adopted the amending decision, which provides for a separate procedure for the production of documents wholly unconnected with the applicant’s commercial activities and which contain sensitive personal information.

18      By separate document lodged at the Court Registry on 8 February 2021, the applicant, on the basis of Article 86 of the Rules of Procedure, modified the application, so that it takes account of the adoption of the amending decision.

C.      Requests for confidential treatment and that certain data not be made public; intervention

19      On 15 July 2020, 7 May and 10 September 2021, the applicant requested, pursuant to Article 66 of the Rules of Procedure, that certain data not be made public.

20      By letters of 30 October and 27 November 2020 as well as 8 February and 14 May 2021, the applicant requested, pursuant to Article 144(2) of the Rules of Procedure, that certain information be treated as confidential vis-à-vis the Federal Republic of Germany.

21      By order of 21 December 2020, the President of the Fifth Chamber of the General Court granted the Federal Republic of Germany leave to intervene and granted the applicant’s requests for confidential treatment vis-à-vis the Federal Republic of Germany.

IV.    Law

22      In support of its action, the applicant relies on three pleas in law alleging, first, infringements of Article 18(1) and (3) of Regulation No 1/2003, second, infringements of the right to privacy and the right to good administration as well as failure to observe the principle of proportionality and, third, infringement of the obligation to state reasons.

A.      Admissibility of the head of claim concerning the failure to put in place accurate and adequate guarantees

23      The Commission disputes the admissibility of the applicant’s head of claim seeking the annulment in part of Article 1 of the contested decision in so far as it does not provide for accurate and adequate guarantees safeguarding the rights of the persons affected by the production of irrelevant documents which are personal or private in nature. It maintains that that head of claim did not appear in the application challenging the initial decision and that no statement of reasons was provided in the statement of modification to explain its addition. Accordingly, the statement of modification does not explain how that additional head of claim is justified by the adoption of the amending decision and why it could not already have been formulated in the application challenging the initial decision.

24      It is settled case-law of the Court of Justice that the forms of order sought by the parties may not, in principle, be altered. Article 86 of the Rules of Procedure of the General Court, on the modification of the application initiating proceedings, is a codification of pre-existing case-law on the admissible exceptions to the principle that the forms of order sought by the parties are unalterable (see judgment of 9 November 2017, HX v Council, C‑423/16 P, EU:C:2017:848, paragraph 18 and the case-law cited).

25      Under Article 86(1) of the Rules of Procedure, where a measure, the annulment of which is sought, is replaced or amended by another measure with the same subject matter, the applicant may, before the oral part of the procedure is closed, or before the decision of the Court to rule without an oral part of the procedure, modify the application to take account of that new factor.

26      In order for an applicant to be entitled to amend the form of order initially sought in the course of the proceedings, it must, in any event, not alter the nature of the action (see, to that effect, judgment of 13 June 2012, Insula v Commission, T‑246/09, not published, EU:T:2012:287, paragraph 103 and the case-law cited).

27      In the present case, it is true that the applicant’s head of claim seeking the annulment in part of Article 1 of the contested decision, in so far as it does not provide for accurate and adequate guarantees to be put in place safeguarding the rights of persons affected by the production of irrelevant documents of a personal or private nature, does not appear, as such, in the application initiating proceedings and appears explicitly only in the statement of modification.

28      However, it should be noted that the Commission does not dispute that the statement of modification otherwise complies with the conditions laid down in Article 86 of the Rules of Procedure, as interpreted in accordance with the case-law referred to in paragraph 26 above.

29      In that regard, it should be noted that that head of claim, in so far as it seeks the annulment in part of Article 1 of the contested decision to the extent that it does not provide for accurate and adequate guarantees to be put in place, is covered by the head of claim seeking annulment of Article 1 put forward in the alternative in the application.

30      In addition, it must be stated that Article 86 of the Rules of Procedure does not require the applicant to explain specifically why (i) it decided to formulate a head of claim which did not appear, as such, in the application and (ii) it was unable to formulate that head of claim in the application initiating proceedings, which is directed against the initial decision.

31      It follows that the Commission’s plea of inadmissibility seeking to dispute the admissibility of the applicant’s head of claim referred to in paragraph 23 above must be rejected.

B.      Substance

1.      The third plea, alleging infringement of the obligation to state reasons

32      The applicant complains that the Commission infringed the obligation to state reasons as regards, first, the definition of the search terms referred to in the contested decision and, second, the treatment of documents not relevant to its investigation and produced in compliance with the contested decision.

33      According to settled case-law, the statement of reasons required under Article 296 TFEU for measures adopted by EU institutions must be appropriate to the measure at issue and must disclose clearly and unequivocally the reasoning followed by the institution which adopted that measure in such a way as to enable the persons concerned to ascertain the reasons for it and to enable the competent court to review its legality. The requirements to be satisfied by the statement of reasons depend on all the circumstances of each case, in particular the content of the measure in question, the nature of the reasons given and the interest which the addressees of the measure, or other parties to whom it is of direct and individual concern, may have in obtaining explanations. It is not necessary for the reasoning to go into all the relevant facts and points of law, since the question whether the statement of reasons meets the requirements of Article 296 TFEU must be assessed with regard not only to its wording but also to its context and to all the legal rules governing the matter in question (see judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 16 and the case-law cited).

34      It should be recalled that Article 18(3) of Regulation No 1/2003 defines, in particular, the essential elements of a statement of reasons in respect of a decision requesting information. That provision states as follows:

‘Where the Commission requires undertakings and associations of undertakings to supply information by decision, it shall state the legal basis and the purpose of the request, specify what information is required and fix the time limit within which it is to be provided. It shall also indicate the penalties provided for in Article 23 and indicate or impose the penalties provided for in Article 24. It shall further indicate the right to have the decision reviewed by the Court of Justice.’

35      That obligation to state specific reasons is a fundamental requirement designed not merely to show that the request for information is justified, but also to enable the undertakings concerned to assess the scope of their duty to cooperate whilst at the same time safeguarding their rights of defence (see judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 19 and the case-law cited).

36      With respect to the obligation to state the ‘purpose of the request’, this relates to the Commission’s obligation to indicate the subject of its investigation in its request, and therefore to identify the alleged infringement of competition rules (see judgment of 10 March 2016, HeidelbergCement v Commission C‑247/14 P, EU:C:2016:149, paragraph 20 and the case-law cited).

37      In that regard, the Commission is not required to communicate to the addressee of a decision requesting information all the information at its disposal concerning the presumed infringements, or to make a precise legal analysis of those infringements, providing it clearly indicates the suspicions which it intends to investigate (see judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 21 and the case-law cited).

38      That obligation may be explained, inter alia, by the fact that, as is apparent from Article 18(1) of Regulation No 1/2003 and recital 23 thereof, in order to carry out the duties assigned to it by that regulation, the Commission may, by simple request or by decision, require undertakings and associations of undertakings to provide ‘all necessary information’ (judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 22).

39      It follows that the Commission is entitled to require the disclosure only of information which may enable it to investigate presumed infringements which justify the conduct of the investigation and are set out in the request for information (see, to that effect, judgments of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 23, and of 28 April 2010, Amann & Söhne and Cousin Filterie v Commission, T‑446/05, EU:T:2010:165, paragraph 333 and the case-law cited).

40      Since the necessity of the information must be judged in relation to the purpose stated in the request for information, that purpose must be indicated with sufficient precision, otherwise it will be impossible to determine whether the information is necessary and the EU Courts will be prevented from exercising judicial review (see judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 24 and the case-law cited).

41      Whether or not the statement of reasons of the contested decision is sufficiently reasoned depends therefore on whether or not the putative infringements that the Commission intends to investigate are defined in sufficiently clear terms (see, to that effect, judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 25).

42      When assessing the extent of the obligation to state reasons with regard to a decision requesting information under Article 18(3) of Regulation No 1/2003, account must also be taken of the stage of the investigation at which such a decision is adopted and of whether or not the Commission already had certain information on the presumed infringements (see, to that effect, judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 39, and Opinion of Advocate General Wahl in HeidelbergCement v Commission, C‑247/14 P, EU:C:2015:694, point 50).

(a)    The appropriateness of the search terms

43      The applicant maintains that the Commission failed to explain how and why it considered that the search terms mandated to be applied identified only documents which are relevant to its investigation, making it possible for it to determine whether the suspected alleged infringements had been committed.

44      The Commission disputes the applicant’s arguments.

45      In the light of the provisions and the case-law referred to in paragraphs 32 to 42 above, which define the scope of the obligation to state reasons for a decision requesting information, that obligation does not go so far as to require the Commission to provide in respect of each item of information requested or, as in the present case, each search term requested to be applied, a specific statement of the reasons why the Commission asserts that that information or search term, first, is necessary for its investigation and, second, contains or identifies only information relevant to that investigation.

46      To impose such a statement of reasons on the Commission would also exceed its obligations, set out in paragraphs 66 to 70 below, in the light of the principle of necessity. In particular, the requirement that a correlation must exist between the request for information and the suspected infringement is satisfied if the Commission could reasonably suppose, at the time of the request, that that information may help it to determine whether that infringement has taken place. Certainty cannot be required from the Commission in that regard.

47      Furthermore, as is apparent from paragraph 33 above, compliance with the obligation to state reasons must be assessed with regard not only to its wording but also to its context.

48      In that regard, the contested decision was adopted in the context of the preliminary investigation stage of the administrative procedure under Regulation No 1/2003, which is intended to enable the Commission to gather all the relevant evidence confirming that there has or has not been an infringement of the competition rules and to adopt an initial position on the course which the procedure is to follow (see, to that effect, judgment of 29 September 2011, Elf Aquitaine v Commission, C‑521/09 P, EU:C:2011:620, paragraph 113 and the case-law cited).

49      In particular, the sole purpose of a request for information such as the contested decision is to enable the Commission to obtain the information and documentation necessary to check the actual existence and scope of a given factual and legal situation (judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 37).

50      Moreover, the contested decision was adopted following exchanges between the applicant and the Commission in which, inter alia, the applicant itself identified certain search terms which might be relevant for the purposes of providing the Commission with the information which it wished to obtain. Accordingly, in particular, Annex I.B to the contested decision contains certain search terms which were identified by the applicant in response to the request for information sent by the Commission on 13 March 2019.

51      In the light of the foregoing, the applicant cannot reasonably rely on an infringement of the obligation to state reasons as regards the appropriateness of the search terms in the contested decision.

(b)    The processing of irrelevant documents

52      The applicant complains that the Commission failed to give reasons in the initial decision for its refusal to permit a review of the relevance of the documents captured by the search terms. In particular, first, it argues that the Commission did not explain why the applicant could not be permitted to withhold certain documents even if its independent EU-qualified lawyers had found those documents to be manifestly irrelevant. Second, it argues that the Commission did not explain why documents containing confidential information covered by legal professional privilege would not be sent to it, whereas documents containing personal data could be sent to it. In that regard, the applicant maintains that, since the initial decision required information containing personal data to be provided, the Commission ought to provide adequate and effective safeguards for that information. However, the Commission did not give reasons for its refusal to grant such guarantees.

53      The Commission disputes the applicant’s arguments.

54      As a preliminary point, it should be recalled that Article 1 of the initial decision states that the applicant is to provide the Commission with the documents referred to in Annexes I.A and I.B to that decision. By Article 3 of the amending decision, the Commission adopted a special procedure for the documents required to be produced by the applicant under the contested decision, but which were not linked to its business activities and which contained sensitive personal data.

55      In addition, on 8 February 2021, the applicant modified the application, on the basis of Article 86 of the Rules of Procedure, to take account of the adoption of the amending decision. Consequently, and having regard to the heads of claim referred to in paragraph 11 above, the purpose of the applicant’s action is to seek the annulment of the initial decision, as amended by the amending decision.

56      In the present case, the Court cannot rule on the lawfulness of the initial decision without taking into account the amendments resulting from the amending decision.

57      An action for annulment brought by a natural or legal person is admissible only in so far as that person has an interest in having the contested act annulled. Such an interest requires that the annulment of that act must be capable, in itself, of having legal consequences and that the action may therefore, through its outcome, procure an advantage to the party which brought it (judgment of 17 September 2015, Mory and Others v Commission, C‑33/14 P, EU:C:2015:609, paragraph 55). By analogy, the same is true of an interest in raising a plea in law (judgment of 28 February 2017, Canadian Solar Emea and Others v Council, T‑162/14, not published, EU:T:2017:124, paragraph 68).

58      In the present case, the applicant did not, before the adoption of the amending decision, provide the Commission with documents which would have been captured by the virtual data room procedure decided in that decision.

59      Therefore, the applicant could not, as appropriate, derive any benefit from a possible annulment of the initial decision on the basis of a breach of the obligation to state reasons resulting from the failure to state in that decision, first, reasons why it could not refuse to provide certain documents and, second, reasons for the failure to put in place specific guarantees, such as a procedure establishing a virtual data room, in order to safeguard the privacy of certain natural persons.

60      It follows that that complaint must be rejected as being inadmissable.

61      Since none of the arguments put forward by the applicant in support of the third plea is well founded, that plea must be rejected.

2.      The first plea, alleging infringement of Article 18 of Regulation No 1/2003, infringement of the rights of the defence and misuse of powers

62      By its first plea, the applicant submits that the contested decision infringes Article 18(3) of Regulation No 1/2003 on the ground that, by requiring it to produce many documents which are irrelevant to the Commission’s investigation, that decision is contrary to the principle of necessity, infringes its rights of defence and constitutes a misuse of the powers conferred on the Commission by Article 18 of Regulation No 1/2003 for the improper purpose of obtaining information which is irrelevant to the alleged infringements as described in the contested decision.

63      The first plea comprises three parts.

(a)    The first part of the first plea, alleging infringement of Article 18(1) and (3) of Regulation No 1/2003

64      The applicant complains that the Commission failed to observe the principle of necessity set out in Article 18 of Regulation No 1/2003. It maintains that applying the search terms mentioned in the contested decision inevitably leads to the capture of a significant number of documents which are irrelevant to the Commission’s investigation, on account, first, of the long duration of the period over which the searches are requested and, second, of the fact that the search terms in question are very common words or expressions, or even part of everyday language. Such search terms may thus be used in a context which has no relation to the practices which are the subject of the Commission’s investigation. The applicant also alleges that the Commission failed to observe the principle of necessity by requesting that numerous documents to be produced without putting in place safeguards at least equivalent to those granted to undertakings in the context of inspections carried out under Article 20 of Regulation No 1/2003.

65      The Commission disputes the admissibility of the applicant’s arguments challenging certain search terms appearing in the contested decision, on the ground that since they were raised for the first time in the reply, they are out of time and that, moreover, they appear only in an annex to the reply.

66      As set out in recital 23 of Regulation No 1/2003, the Commission should be empowered throughout the European Union to require such information to be supplied as is necessary to detect any agreement, decision or concerted practice prohibited by Article 101 TFEU or any abuse of a dominant position prohibited by Article 102 TFEU.

67      It is also apparent from Article 18(1) of Regulation No 1/2003 that, in order to carry out the duties assigned to it by that regulation, the Commission may, by simple request or by decision, require undertakings and associations of undertakings to provide ‘all necessary information’.

68      Having regard to the broad powers of investigation conferred on the Commission by Regulation No 1/2003, it is for the Commission to decide whether a particular item of information is necessary to enable it to bring to light an infringement of the competition rules. Even if it already has evidence, or indeed proof, of the existence of an infringement, the Commission may legitimately take the view that it is necessary to request further information enabling it better to define the scope of the infringement, determine its duration or identify the circle of undertakings involved (judgment of 28 January 2021, Qualcomm and Qualcomm Europe v Commission, C‑466/19 P, EU:C:2021:76, paragraph 69).

69      As regards the judicial review carried out by the EU Courts of the Commission’s finding that an item of information is necessary, it is apparent from the case-law that that necessity must be judged in relation to the purpose stated in the request for information, namely the suspected infringement which the Commission intends to investigate. The requirement that a correlation must exist between the request for information and the suspected infringement is satisfied if the Commission could reasonably suppose, at the time of the request, that the information may help it to determine whether the infringement has taken place (judgment of 28 January 2021, Qualcomm and Qualcomm Europe v Commission, C‑466/19 P, EU:C:2021:76, paragraph 70).

70      In the present case, it should be recalled that, in the first paragraph of Article 1 of the contested decision, the Commission decided that the applicant was to supply it with the information specified in Annexes I.A and I.B to that decision. Annex I.A, entitled ‘Questionnaire’, is divided into four sections. The first, second and fourth sections contain lists of questions to which the applicant is required to provide a response and lists of data which the applicant must provide. The third section contains a list of documents which the applicant is required to produce. Annex I.B, entitled ‘Internal documents’, contains definitions of the relevant concepts, technical instructions and instructions as to presentation to be complied with in relation to the production of the documents requested, the list of search terms to be applied by the applicant to its internal documents as well as explanations in that regard. The documents requested by the Commission are those captured by those search terms and which were prepared by certain depositaries (custodians), on their behalf, or received by them. There are five custodians, namely [confidential]. (1)

(1)    The scope of the applicant’s arguments and the identification of the contested search terms

71      In support of its argument that applying the search terms referred to in the contested decision would give rise to results containing a large number of irrelevant documents, the applicant identifies in particular certain search terms mentioned in Annex I.B to the contested decision, while arguing that those terms must be understood as non-exhaustive examples intended to illustrate its arguments. It adds that it would have been unreasonable, if not impossible, to focus on each search term separately.

72      It should be recalled that the Court may not, merely because it considers a plea relied upon by the applicant in support of its action for annulment to be well founded, automatically annul the challenged act in its entirety. Annulment of the act in its entirety is not acceptable where it is obvious that that plea, directed only at a specific part of the challenged act, is such as to provide a basis only for annulment in part (judgment of 11 December 2008, Commission v Département du Loiret, C‑295/07 P, EU:C:2008:707, paragraph 104).

73      However, annulment in part of an EU act is possible only in so far as the elements whose annulment is sought may be severed from the remainder of the act. That requirement of severability is not satisfied where the annulment in part of an act would have the effect of altering its substance. Review of whether the contested provisions are severable requires consideration of their scope, in order to be able to assess whether their annulment would alter the spirit and substance of the decision challenged (see judgment of 16 July 2015, Commission v Council, C‑425/13, EU:C:2015:483, paragraph 94 and the case-law cited).

74      It should be recalled that Article 1 of the contested decision places the applicant under an obligation, under Article 18(3) of Regulation No 1/2003, to produce the documents referred to in the annexes to that decision, namely those resulting from applying in its databases the search terms referred to in those annexes and which have been prepared by certain custodians, on their behalf or received by them over a certain period.

75      In that regard, it must be held that an overall assessment of compliance by the Commission with the principle of necessity is not appropriate, even if it were possible. The fact that certain search terms may, as the applicant submits, be too vague – in the sense that, by requiring the production of all documents resulting from the application of those search terms, the Commission failed to have regard to the principle of necessity – has no bearing on the fact that other search terms may be sufficiently precise or targeted to enable the correlation required under the case-law referred to in paragraph 70 above to be established.

76      It follows that, if the Court were to consider that certain search terms were too vague, with the result that they appeared in the contested decision in disregard of the principle of necessity, it ought to annul that decision only in so far as it requires the applicant to produce the documents resulting from the application of the search terms in question.

77      Such annulment in part would have no effect on the obligation on the applicant, under Article 1 of the contested decision, to produce the documents resulting from the application of the other search terms, which were adopted in accordance with the principle of necessity. In so doing, such an annulment in part would not have the effect of altering either the spirit or the substance of the contested decision, within the meaning of the case-law referred to in paragraph 74 above.

78      Furthermore, according to settled case-law, acts of the EU institutions are presumed to be valid. It is for parties seeking their annulment to rebut that presumption by producing evidence to cast doubt on the assessments made by the defendant institution (see judgment of 6 October 1999, Salomon v Commission, T‑123/97, EU:T:1999:245, paragraph 46 and the case-law cited).

79      In those circumstances, only the search terms specifically challenged by the applicant may be reviewed by the Court as to whether the principle of necessity has been observed. The other search terms must be regarded as having been defined in accordance with that principle.

80      The applicant identified certain search terms in the application, and others only at the stage of the reply, some in the body of that pleading, and others in an annex thereto.

81      The Commission disputes the admissibility of the applicant’s arguments concerning the search terms mentioned for the first time at the stage of the reply, on the grounds that they are out of time and that they appear only in an annex to the reply.

82      It is apparent from Article 84 of the Rules of Procedure that no new plea in law may be introduced in the course of proceedings unless it is based on matters of law or of fact which come to light in the course of the procedure.

83      The concept of a ‘plea in law’ within the meaning of that provision has been interpreted broadly, also covering complaints (judgment of 29 November 2018, Spain v Commission, T‑459/16, not published, EU:T:2018:857, paragraph 25) and even mere ‘arguments’ (see, to that effect, judgment of 11 July 2019, Silver Plastics and Johannes Reifenhäuser v Commission, T‑582/15, not published, EU:T:2019:497, paragraph 198).

84      In the present case, the applicant submits, in essence, that the reference, at the stage of the reply, to new search terms is simply intended to support arguments already set out in the application and not to cast doubt on arguments or evidence to the contrary submitted by the Commission at the stage of the defence. However, in the light of the considerations set out in paragraphs 76 and 77 above, it must be held that, in so doing, the applicant developed a new line of argument directed against evidence, first, which it had not expressly disputed in the application, even though it was open to it to do so, and, second, to which the Commission did not refer in the defence.

85      Moreover, as regards the search terms in question, which were found not in the body of the reply itself, but solely in an annex thereto, it should be recalled that the annexes have a purely evidential and instrumental function (judgment of 21 March 2002, Joynson v Commission, T‑231/99, EU:T:2002:84, paragraph 154).

86      Therefore, the applicant’s arguments based on search terms referred to for the first time at the stage of the reply must be rejected as being inadmissible.

(2)    The substance of the arguments directed against the search terms referred to in the application

87      First, the applicant maintains that the terms ‘marketplace & advertising’, ‘marketplace & grow*’, ‘marketplace + quality’, ‘marketplace + insight*’, ‘marketplace + advantage’, ‘marketplace + looked at’, ‘*commerce + awareness’ and ‘*commerce + advantage’ are, by their very nature, capable of being used in everyday conversation in relation to topics which, on any view, have nothing to do with the conduct or practices falling within the scope of the Commission’s investigation. In that respect, such search terms are clearly too vague and general. The applicant adds that applying those general terms to documents concerning [confidential] public figures [confidential] increases the likelihood of obtaining irrelevant results. Those persons have responsibility for, and oversight over, every area of the applicant’s business, including activities which have little or no connection with the facts under investigation, such as the human resources, corporate finance and corporate social responsibility of the undertaking, or even their involvement in their own personal projects and philanthropic activities. Furthermore, the applicant provides certain examples of documents which it regards as irrelevant and which were identified by applying certain search terms.

88      The Commission disputes the claims relating to the search terms ‘marketplace & advertising’, ‘marketplace & grow*’, ‘marketplace + quality’, ‘marketplace + insight*’, ‘marketplace + advantage’, ‘marketplace + looked at’, ‘*commerce + awareness’ and ‘*commerce + advantage’.

89      Accordingly, the Commission asserts that the search term ‘marketplace + advertising’ was expected to identify documents referring to the monetisation of Facebook Marketplace via advertising and that the term ‘marketplace & grow*’ was expected to identify documents referring to growth strategies for Facebook Marketplace. It adds that the term ‘marketplace + insight*’ was expected to identify external and internal studies and analyses of the Facebook Marketplace product and a comparative assessment of that product. In that regard, it states that on 5 November 2019, in response to a request for information, the applicant produced seven studies making a comparative assessment of Marketplace. Three of those documents contained the word ‘insight’ in their title. It adds that the term ‘marketplace + advantage’ was expected to identify documents in which Facebook Marketplace was compared with its rivals. Furthermore, the term ‘marketplace + looked at’ was expected to identify documents concerning the awareness of users of Facebook Marketplace’s online advertising services, which is a performance indicator for Marketplace, as well as documents concerning Facebook’s use of data provided by Marketplace’s competitors. Referring in that regard to recital 1 of the contested decision, the Commission states that such data include information on products which consumers ‘looked at’ on websites of Marketplace’s competitors. It also asserts that the term ‘marketplace + quality’ was expected to identify documents assessing features of Facebook Marketplace against its competitors. Lastly, it asserts that the term ‘commerce + advantage’ was expected to identify documents in which the applicant’s e-commerce platform was compared to its rivals and in which the applicant discussed the inherent potential of the ‘Facebook Marketplace’ tab on its social network as a distribution advantage in comparison to Marketplace’s rivals.

90      The applicant does not challenge any of those statements.

91      As set out in recital 1 of the contested decision, the Commission was investigating conducts by the applicant in relation to the tying of its online classified advertising service – Facebook Marketplace – to its social network platform in the European Economic Area (EEA) and the applicant’s use of data belonging to competing providers of online classified advertising services and concerning those providers, which the applicant can obtain in connection to the provision of its social networking services. Recital 2 of that decision states that the Commission’s view is that if the existence of any such behaviours were to be confirmed, they might constitute one or more infringements of Article 101 or 102 TFEU and of Article 53 or 54 of the EEA Agreement.

92      Therefore, and in the light of the circumstances referred to in paragraph 90 above, which are not challenged by the applicant, the Commission, by requesting the applicant to produce the documents resulting from applying the search terms ‘marketplace & advertising’, ‘marketplace & grow*’, ‘marketplace + quality’, ‘marketplace + insight*’, ‘marketplace + advantage’, ‘marketplace + looked’ and ‘commerce + advantage’ could reasonably have supposed, at the time of the contested decision, that that information may help it to determine whether the conducts referred to in recital 1 of that decision have taken place, in accordance with the case-law referred to in paragraph 70 above.

93      As regards the search term ‘commerce + awareness’, the Commission maintains that that term was expected to identify documents concerning the awareness of users of the applicant’s e-commerce platform, which includes Facebook Marketplace.

94      The applicant maintains that recital 1 of the contested decision states that the scope of the investigation is limited to Marketplace. From that, the applicant infers that, if the Commission intended to justify that search term by the fact that it identified documents relating to its e-commerce activities other than Facebook Marketplace, for example Facebook Shops and Instagram Shopping, it would go beyond the subject matter of the investigation, as defined in the contested decision.

95      In that regard, it should be observed that it is not apparent from the contested decision, in particular from recital 1 thereof, which sets out the subject matter of the Commission’s investigation, that the Commission intended to investigate the applicant’s e-commerce activities other than Marketplace. Therefore, it cannot be inferred merely from the Commission’s assertion set out in paragraph 94 above that it intended to probe outside the scope of its investigation, as defined in recital 1 of the contested decision.

96      Furthermore, the Commission notes, without being challenged by the applicant, that the term ‘awareness’ appears in several internal documents relating to Marketplace which were previously submitted to it, which indicates that Facebook users’ awareness of Marketplace is an important indicator of Marketplace’s performance, which the applicant monitors.

97      Therefore, and having regard to the subject matter of the Commission’s investigation defined in recital 1 of the contested decision, it must be held that, for the reason referred to in paragraph 93 above, the Commission was entitled, there being no failure to observe the principle of necessity, to request that applicant to produce the documents resulting from the application of the search term ‘commerce + awareness’.

98      Those findings cannot be called into question by the applicant’s argument alleging that the search terms ‘marketplace & advertising’, ‘*commerce + awareness’ and ‘*commerce + advantage’ are not consistent with the principle of necessity, owing to the number, which it considers to be very high, of documents identified when those terms were applied to its internal databases.

99      As the Commission submits, those arguments do not make it possible to challenge the appropriateness or the necessity of the terms in question for its investigation. It follows from the nature of the request for information at issue that its scope becomes fully apparent only after the search terms have been applied to the applicant’s databases in order to identify the documents captured by those terms. The mechanism for applying search terms means it is inevitable that documents will be identified which will ultimately prove not to be relevant to the investigation. Accordingly, the mere fact that applying search terms causes numerous documents to be captured, some of which subsequently prove not to be relevant to the Commission’s investigation, is not sufficient, in itself, to make a finding, in accordance with the case-law cited in paragraphs 69 and 70 above, that the search terms in question have no correlation with the infringement suspected by the Commission. Nor is that sufficient to rule out the possibility that the Commission could reasonably have supposed, at the time of the contested decision, that applying those search terms could have helped it to determine the existence and extent of that infringement, its duration or the circle of undertakings involved.

100    Moreover, in the light of the Commission having complied with its obligation to state reasons, as is apparent from the examination of the third plea, the applicant also errs in criticising the Commission for failing to explain how the use of certain search terms was consistent with the principle of necessity.

101    Lastly, the applicant regards the search terms as ‘clearly too vague and general’, without, however, substantiating that claim in any way.

102    Second, as regards the search terms ‘*commerce + lead*’, ‘Marketplace + lead*’, ‘MP + lead*’, ‘*commerce + track*’ and ‘Marketplace + track*’, it should be noted that the applicant disputes the lawfulness of those terms on account of the number, which it considers to be very high, of documents captured by applying those terms. As regards the terms ‘Marketplace + distribut*’, ‘Marketplace + performance’, ‘classified* + lead*’, ‘data + classified*’, ‘marketplace + “top of mind”’, ‘Marketplace + *signal*’, ‘Marketplace + ecosystem’, ‘Marketplace + vertical*’, ‘advertising + classified*’, ‘classified* & grow*’, ‘classified* + [confidential]’, ‘classified* & performance’, ‘compet* + classified*’, ‘marketing + classified*’, ‘classified* + “looked at”’, ‘classified* + advantage’, ‘classified* + track*’, ‘classified* + [confidential]’ and ‘classified* + [confidential]’, the applicant submits that applying those terms captures documents which it regards as irrelevant to the Commission’s investigation. Those two matters demonstrate that not all those search terms comply with the principle of necessity.

103    Those arguments must be rejected for the reasons set out in paragraphs 99 and 100 above.

104    In the light of the foregoing, the applicant has not established that a search term in the contested decision was not consistent with the principle of necessity stemming from Article 18(1) of Regulation No 1/2003, as interpreted by the case-law referred to in paragraphs 67 to 70 above.

105    As regards the applicant’s argument that the Commission failed to observe the principle of necessity in that it requested documents to be produced without putting in place safeguards at least equivalent to those granted to undertakings in the context of inspections carried out under Article 20 of Regulation No 1/2003, it should be noted that it is for the Court, when hearing an action for annulment of a decision requesting information, such as the contested decision, to review, within the limits of the pleas raised before it, whether such decision respects the rights which the undertaking concerned derives from the legal framework applicable to such a decision. By contrast, it is not for the Court to review the lawfulness of such a decision by comparison with the legal framework applicable to decisions adopted on different legal bases, such as inspection decisions.

106    Nevertheless, it must be recalled that the undertakings to which a request for information is addressed enjoy adequate guarantees.

107    In particular, in the context of the implementation of a decision requesting information, such an undertaking may identify the documents requested by the Commission and examine them with the assistance of its lawyers before communicating them to the Commission. Therefore, it has the possibility of refusing to disclose documents covered by legal professional privilege. In addition, it may submit to the Commission a reasoned request for irrelevant documents to be returned. That possibility is explicitly recognised in the Commission notice on best practices for the conduct of proceedings concerning Articles 101 and 102 TFEU (OJ 2011 C 308, p. 6). The Commission is required to examine such a request and, as appropriate, return the irrelevant documents.

108    Consequently, the first part of the first plea must be rejected.

(b)    The second part of the first plea, alleging infringement of the rights of the defence

109    The applicant maintains that the contested decision infringes its rights of defence, as protected by Article 48(2) of the Charter of Fundamental Rights of the European Union (‘the Charter’), in that the alleged infringements under investigation by the Commission are unknown to it or have not been clearly identified. For those reasons, it is impossible for it to prepare its defence effectively during the inter partes stage of the administrative procedure and to take the measures which it considers may be useful for that purpose, such as finding and preserving evidence or identifying exculpatory witness statements.

110    The Commission and the Federal Republic of Germany dispute the applicant’s arguments.

111    In that regard, it should be recalled that observance of the rights of the defence in the conduct of administrative procedures relating to competition policy constitutes a general principle of EU law whose observance the EU Courts ensure (see judgment of 3 September 2009, Prym and Prym Consumer v Commission, C‑534/07 P, EU:C:2009:505, paragraph 26 and the case-law cited).

112    In that regard, it should be borne in mind that the administrative procedure under Regulation No 1/2003, which takes place before the Commission, is divided into two distinct and separate stages, each having its own internal logic, namely a preliminary investigation stage and an inter partes stage. The preliminary investigation stage, during which the Commission uses the powers of investigation provided for in Regulation No 1/2003 and which covers the period up until the notification of the statement of objections, is intended to enable the Commission to gather all the relevant information tending to prove or disprove the existence of an infringement of the competition rules and to adopt an initial position on the course of the procedure and how it is to proceed. By contrast, the inter partes stage, which covers the period from the notification of the statement of objections to the adoption of the final decision, must enable the Commission to reach a final decision on the alleged infringement (see judgment of 14 March 2014, Cementos Portland Valderrivas v Commission, T‑296/11, EU:T:2014:121, paragraph 33 and the case-law cited).

113    The starting point for the preliminary investigation stage is the date on which the Commission, in exercise of the powers conferred on it by Articles 18 and 20 of Regulation No 1/2003, takes measures which involve the allegation of an infringement and which have major repercussions on the situation of the undertakings under suspicion. It is not until the beginning of the inter partes administrative stage that the undertaking concerned is informed, by means of the notification of the statement of objections, of all the essential evidence on which the Commission relies at that stage of the procedure and that that undertaking has a right of access to the file in order to ensure that its rights of defence are effectively exercised. Consequently, it is only after notification of the statement of objections that the undertaking concerned is able to rely in full on its rights of defence. If those rights were extended to the period preceding the notification of the statement of objections, the effectiveness of the Commission’s investigation would be compromised, since the undertaking concerned would already be able, at the preliminary investigation stage, to identify the information known to the Commission, hence the information that could still be concealed from it (see judgment of 14 March 2014, Cementos Portland Valderrivas v Commission, T‑296/11, EU:T:2014:121, paragraph 34 and the case-law cited).

114    However, the measures of inquiry adopted by the Commission during the preliminary investigation stage – in particular, the investigation measures and the requests for information – suggest, by their very nature, that an infringement has been committed and may have major repercussions on the situation of the undertakings under suspicion. Consequently, it is necessary to prevent the rights of the defence from being irremediably compromised during that stage of the administrative procedure since the measures of inquiry taken may be decisive in providing evidence of the unlawful nature of conduct engaged in by undertakings for which they may be liable (see judgment of 14 March 2014, Cementos Portland Valderrivas v Commission, T‑296/11, EU:T:2014:121, paragraph 35 and the case-law cited; see also, to that effect, judgment of 21 September 1989, Hoechst v Commission, 46/87 and 227/88, EU:C:1989:337, paragraph 15).

115    In the present case, it should be noted that the Commission adopted the contested decision in the preliminary stage of its investigation into the use of data by the applicant and before a statement of objections was adopted. Therefore, in accordance with the case-law referred to in paragraph 115 above, it is necessary to determine whether the applicant has established that its rights of defence have been irremediably compromised owing to the adoption of the contested decision.

116    First, the arguments by which the applicant alleges that its rights of defence have been infringed owing to being required, under the contested decision, to produce documents which are unnecessary for the Commission’s investigation, are based on the premiss that that decision was adopted contrary to the principle of necessity referred to in Article 18(1) of Regulation No 1/2003. They must therefore be rejected as a result of the rejection of the first part of the present plea.

117    Second, the applicant alleges that it is not in a position to identify the practices in which the Commission suspects it to have been engaged.

118    As recalled in paragraph 92 above, in accordance with recital 1 of the contested decision, the Commission is investigating the applicant’s conducts in relation to the tying of its online classified advertising service (Facebook Marketplace) to its social network platform in the EEA and its use of data of and on competing online classified advertising providers, which it can obtain in connection with the provision of its social networking services. Recital 2 of that decision states that the Commission’s view is that if the existence of any such behaviours were to be confirmed, they might constitute one or more infringements of Article 101 or 102 TFEU and of Article 53 or 54 of the EEA Agreement.

119    From that, it is clear that the Commission, in essence, objects to, first, the applicant tying Marketplace to the Facebook social network and, second, the applicant’s use of data, collected via that social network and belonging to online classified advertising providers who are competing with Marketplace.

120    In that regard, it should be recalled that the Commission is not required to communicate to the addressee of a decision requesting information all the information at its disposal concerning the presumed infringements or to make a precise legal analysis of those infringements, providing it clearly indicates the suspicions which it intends to investigate (see judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 21 and the case-law cited). It also cannot be required to indicate at the preliminary investigation stage – besides the putative infringements which it intends to investigate – the evidence, that is to say the information leading it to consider that Article 101 TFEU may have been infringed. Such an obligation would upset the balance struck by the case-law between preserving the effectiveness of the investigation and upholding the defence rights of the undertaking concerned (judgment of 14 March 2014, Cementos Portland Valderrivas v Commission, T‑296/11, EU:T:2014:121, paragraph 37).

121    Furthermore, it must be stated that the applicant submits that the alleged uncertainty regarding the conduct of which it is accused prevented it from taking the measures which it considered useful for its defence and thus from preparing its defence at the inter partes stage of the administrative procedure, without, however, establishing that those uncertainties irremediably infringed its rights of defence.

122    In those circumstances, the contested decision, which is part of the preliminary investigation stage of the administrative procedure provided for by Regulation No 1/2003, must be considered to have been adopted in compliance with the applicant’s rights of defence.

123    Accordingly, the second part of the first plea must be rejected.

(c)    The third part of the first plea, alleging misuse of powers

124    The applicant complains the Commission misused its powers of investigation by requesting the production of documents which are manifestly irrelevant for the purpose of investigating other possible practices not articulated in the contested decision.

125    It must be stated, however, that it does not substantiate that allegation in any way.

126    It follows from the foregoing that the third part of the first plea, and, consequently, the first plea in its entirety must be rejected.

3.      The second plea, alleging infringement of the right to privacy and the right to good administration and failure to observe the principle of proportionality

127    By its second plea, the applicant submits that, by requiring the production of numerous irrelevant documents of a private nature, the contested decision infringes the fundamental right to privacy enshrined in Article 7 of the Charter and in Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’) and the right to good administration, and fails to observe the principle of proportionality.

128    The plea comprises three parts.

(a)    The first part of the second plea, alleging infringement of the right to privacy

129    The applicant pleads infringement of its right to privacy and that of its staff and third parties, as protected by Article 7 of the Charter and Article 8 ECHR.

130    The applicant maintains that the contested decision constitutes an unjustified interference with the right to privacy, as referred to in Article 8 ECHR. First, the applicant argues that it follows from the arguments set out in support of each of the pleas in the application that that interference is not in accordance with the law, namely Article 18(3) of Regulation No 1/2003. Second, the contested decision does not pursue a legitimate aim, in that the Commission requests the production of information which it could not reasonably suppose would help it to determine whether any of the alleged infringements have taken place. Third, that decision does not comply with the principle of necessity required by Article 8 ECHR.

131    The Commission and the Federal Republic of Germany dispute the applicant’s arguments.

132    Under Article 7 of the Charter, everyone has the right to respect for his or her private and family life, home and communications.

133    According to Article 8 ECHR, everyone has the right to respect for his or her private and family life, home and correspondence.

134    Article 7 of the Charter, concerning the right to respect for private and family life, contains rights which correspond to those guaranteed by Article 8(1) ECHR. In accordance with Article 52(3) of the Charter, Article 7 thereof is thus to be given the same meaning and the same scope as Article 8(1) ECHR, as interpreted by the case-law of the European Court of Human Rights (judgment of 17 December 2015, WebMindLicenses, C‑419/14, EU:C:2015:832, paragraph 70).

135    Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.

136    It is necessary to examine whether the contested decision complies with Article 7 of the Charter and, to that end, satisfies the conditions set out in Article 52(1) of the Charter.

(1)    Whether there is a legal basis for the interference with privacy

137    The applicant submits that the contested decision constitutes an unlawful interference with the right to privacy, for the following reasons. First, it follows from the arguments set out in support of each of the pleas in the application that that interference is not provided for by law, namely Article 18(3) of Regulation No 1/2003. Second, providing the Commission with all the documents captured by the search terms in the contested decision entails communicating personal data relating to: (i) the custodians referred to in that decision, (ii) other members of the applicant’s staff and (iii) friends or family members of those persons (‘the personal data at issue’). Third, the applicant submits that it cannot be required to communicate to the Commission information which is irrelevant for the purposes of the investigation. It maintains that, if that were the case, it would contravene Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2), by unlawfully processing personal data, in so far as it is not necessary for compliance with a legal obligation, within the meaning of that provision.

138    Under the conditions set out in Article 52(1) of the Charter, the limitation on the right to respect for private life must first of all be provided for by law. The measure in question must therefore have a legal basis (see judgment of 28 May 2013, Trabelsi and Others v Council, T‑187/11, EU:T:2013:273, paragraph 79 and the case-law cited).

139    That is so in the present case. The contested decision was adopted on the basis of Article 18(3) of Regulation No 1/2003, which confers on the Commission the power to require undertakings and associations of undertakings to supply information by decision.

140    That conclusion cannot be called into question by the applicant’s arguments that the contested decision is unlawful in so far as it entails unlawful processing of personal data on its part, as referred to in Article 6(1) of Regulation 2016/679.

141    First of all, it should be noted that Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39) applies, according to Article 2(1) thereof, to the processing of personal data by all EU institutions and bodies, whereas Regulation 2016/679 applies to any other natural or legal person, except in the cases provided for in Article 2(2) of that regulation.

142    Next, Article 6(1) of Regulation 2016/679 provides that:

‘Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(c)      processing is necessary for compliance with a legal obligation to which the controller is subject’.

143    It should be recalled that Article 1 of the contested decision places the applicant under an obligation, pursuant to Article 18(3) of Regulation No 1/2003, to supply the documents referred to in the annexes to that decision. Therefore, that decision constitutes a legal obligation within the meaning of Article 6(1)(c) of Regulation 2016/679.

144    The other arguments raised by the applicant in paragraph 100 of the application are formulated in a general and indiscriminate manner and therefore do not comply with the requirements set out in Article 76 of the Rules of Procedure.

145    Lastly, Article 5(1)(a) of Regulation 2018/1725 provides that EU institutions may lawfully process personal data when it is ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body’.

146    In that regard, the exercise of the powers given to the Commission by Regulation No 1/2003 contributes to the maintenance of the system of competition intended by the Treaties, which undertakings have an absolute duty to comply with (see judgment of 20 June 2018, České dráhy v Commission, T‑621/16, not published, EU:T:2018:367, paragraph 105 and the case-law cited).

147    Since Regulation No 1/2003 confers on the Commission the power to adopt decisions requesting information, the applicant cannot maintain that the contested decision constitutes an interference not provided for by the law, within the meaning of Article 52(1) of the Charter.

(2)    Whether objectives of general interest recognised by the European Union are pursued

148    As regards the condition that, subject to the principle of proportionality, limitations on the exercise of a right may be made only if they genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others, the applicant disputes that the contested decision meets such objectives. In that regard, it maintains that the Commission requires information to be disclosed which it cannot reasonably suppose will help it to determine whether the practices under investigation actually took place.

149    It is apparent from the case-law that the powers conferred on the Commission by Article 18 of Regulation No 1/2003 are intended to allow it to carry out its duty under the Treaties of ensuring compliance with the competition rules in the internal market. The function of those rules is to prevent competition from being distorted to the detriment of the public interest, individual undertakings and consumers (see, by analogy, judgment of 20 June 2018, České dráhy v Commission, T‑621/16, not published, EU:T:2018:367, paragraph 105 and the case-law cited).

150    Accordingly, the contested decision is an expression of the exercise of the powers conferred on the Commission by Regulation No 1/2003, which, as has been pointed out in paragraph 147 above, contributes to the maintenance of the system of competition intended by the Treaties, which undertakings have an absolute duty to comply with.

151    Therefore, contrary to the applicant’s assertions, the contested decision does meet objectives of general interest recognised by the European Union.

(3)    Whether the essence of the right to privacy has been observed

152    The applicant does not maintain that the contested decision compromises the essence of the right to privacy as referred to in Article 7 of the Charter.

(4)    Whether the interference with privacy is proportionate

153    It should be recalled that the principle of proportionality requires that the limitations which may be imposed by acts of EU law on the rights and freedoms enshrined in the Charter do not exceed the limits of what is appropriate and necessary in order to meet the legitimate objectives pursued or the need to protect the rights and freedoms of others; where there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued (see judgment of 26 April 2022, Poland v Parliament and Council, C‑401/19, EU:C:2022:297, paragraph 65 and the case-law cited).

154    Accordingly, in order to examine whether the interference with privacy caused by the contested decision is proportionate, it is necessary to ascertain whether that interference is appropriate and necessary in order to achieve the objectives of general interest pursued by the European Union before considering the balance of interests.

(i)    Whether the interference is appropriate

155    In the present case, having regard to paragraphs 66, 150 and 151 above, it must be held that a request for information such as the contested decision constitutes an appropriate measure for achieving the objectives of general interest pursued by the Commission.

(ii) Whether the interference is necessary

156    As regards whether the contested decision goes beyond what is necessary in order to achieve the objectives of general interest which it pursues, the applicant puts forward a number of arguments.

–       The insufficient level of protection under the virtual data room procedure

157    The applicant maintains that the virtual data room procedure adopted by the Commission in the amending decision does not protect adequately its right and that of the individuals concerned to respect for their privacy. In that regard, first, it maintains that that procedure enables Commission staff to carry out a cursory examination of the personal data at issue, contrary to the right to privacy of the individuals concerned and that it would be likely to cause serious harm to them. Second, that procedure has no bearing on the obligation, contrary to the right to privacy of those persons, to provide the Commission with information, such as the personal data at issue, which is irrelevant to the Commission’s investigation. In that regard, the applicant maintains that a proportionate approach capable of remedying the unlawfulness of the contested decision would be to adopt different measures or additional measures.

158    It should be recalled that, following the adoption of the order of 29 October 2020, Facebook Ireland v Commission (T‑452/20 R, not published, EU:T:2020:516), the Commission adopted the amending decision on 11 December 2020. As provided in that decision, the Commission adopted a separate procedure concerning documents required to be produced by the applicant pursuant to the contested decision but which, prima facie, were not linked with its commercial activities and which contained sensitive personal data (‘the Protected Documents’).

159    Article 3 of the amending decision provides for the points (9 o) and (9 p) to be added to Annex I.B to the contested decision, worded as follows:

‘(9      o)      Protected Documents shall be transmitted to the Commission on a separate electronic medium. Those documents shall then be placed in a virtual data room which shall be accessible to as limited a number as possible of members of the team responsible for the investigation, in the presence (virtual or physical) of an equivalent number of Facebook’s lawyers. The members of the team responsible for the investigation shall examine and select the documents in question, while giving Facebook’s lawyers the opportunity to comment on them before the documents considered relevant are placed on the file. In the event of disagreement as to the classification of a document, Facebook’s lawyers shall have the right to explain the reasons for their disagreement. In the event of continuing disagreement, Facebook may ask the Director for Information, Communication and Media at the Commission’s Directorate-General for Competition to resolve the disagreement.’

‘9      p)      Protected Documents may be transmitted to the Commission in a redacted form, by removing the names of the individuals concerned and any information allowing to identify them. Upon request by the Commission motivated by the needs of the investigation, Protected Documents which have been transmitted in a redacted form must be provided to the Commission in a full, unredacted version.’

160    It should be recalled that, pursuant to Article 6(1)(c) of Regulation 2016/679, the applicant lawfully processes personal data when it provides to the Commission documents containing such data which are requested pursuant to the contested decision.

161    In addition, as recalled in paragraph 146 above, under Article 5(1)(a) of Regulation 2018/1725, the EU institutions may lawfully process personal data when that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in those institutions.

162    Furthermore, the applicant has alleged, without being challenged by the Commission, that certain documents identified following the application of the search terms contained in the contested decision, and therefore required to be produced pursuant to that decision, contained sensitive personal data.

163    Such data are capable of falling within the scope of the data referred to in Article 9(1) of Regulation 2016/679 and Article 10(1) of Regulation 2018/1725.

164    Article 9(1) and (2)(g) of Regulation 2016/679 and Article 10(1) and (2)(g) of Regulation 2018/1725 provide, in identical terms, as follows:

‘1.      Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

2.      Paragraph 1 shall not apply if one of the following applies:

…

(g)      the processing is necessary for reasons of substantial public interest, on the basis of Union … law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject …’

165    Article 9(2)(g) of Regulation 2016/679 and Article 10(2)(g) of Regulation 2018/1725 thereby make subject to three conditions the possibility of processing the personal data referred to in Article 9(1) and Article 10(1) of those regulations respectively. First, the processing must pursue a significant public interest, with its basis in EU law. Second, the processing must be necessary to fulfil that public interest. Third, EU law must be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

166    The applicant does not allege that the conditions laid down by those provisions have been infringed, with the result that the Court is not required to review whether the contested decision complies with those provisions. However, those provisions are relevant for assessing whether the contested decision satisfies the third of the conditions set out in Article 52(1) of the Charter, namely whether that decision goes beyond what is necessary in order to achieve the objectives of general interest which it pursues.

167    As regards the first condition, it has been recalled in paragraph 156 above that a request for information such as the contested decision constituted an appropriate measure for achieving the objectives of general interest pursued by the Commission.

168    As regards the second condition, it is apparent from the examination of the first part of the first plea that the Commission has sufficiently established, in the light of the case-law referred to in paragraph 70 above, the required correlation between the information requested in the contested decision and the suspected infringements mentioned in that decision. Therefore, the processing of personal data entailed by the contested decision is necessary to fulfil the significant public interest pursued.

169    As regards the third condition, it should be recalled that Article 5 of Regulation 2018/1725 sets out the limits of EU institutions’ power to process personal data, by providing, inter alia, in Article 5(1)(a) thereof, that such processing is to be permitted when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in that institution. In addition, as is apparent from recital 3 of the amending decision, the purpose of the virtual data room procedure is to place on the file only those Protected Documents which are found actually to be relevant to the Commission’s investigation after they have been examined in such a room. In addition, the applicant does not maintain that the contested decision compromises the essence of the right to privacy as provided for in Article 7 of the Charter.

170    Furthermore, as is apparent from points (9 o) and (9 p) of Annex I.B to the contested decision, the Protected Documents must be sent to the Commission separately from the other documents requested, on a separate electronic medium. In addition, the virtual data room in which those documents will then be placed will be accessible only to as limited a number as possible of members of the team responsible for the investigation, in the virtual or physical presence of an equivalent number of the applicant’s lawyers. Also, the applicant’s lawyers have the opportunity to comment on the documents considered relevant by the members of the team responsible for the investigation before they place them on the file. Moreover, point (9 o) of Annex I.B to the contested decision provides that, in the event of disagreement as to the classification of a document, the applicant’s lawyers will have the right to explain the reasons for their disagreement, which, if it persists, gives the applicant the right to request the Director responsible for information, communication and media in the Commission’s DG for Competition to arbitrate. Furthermore, point (9 p) of Annex I.B to the contested decision provides that the Protected Documents may be transmitted to the Commission in a redacted form, by removing the names of the individuals concerned and any information allowing them to be identified, and that it is only upon request by the Commission, motivated by the needs of the investigation, that the Protected Documents which have been transmitted in a redacted form must be provided to the Commission in their full and unredacted version.

171    Therefore, the measures provided for in points (9 o) and (9 p) of Annex I.B to the contested decision do not go beyond what is necessary for purposes of the objectives pursued by the contested decision and their disadvantages are not disproportionate to the aims pursued, as provided for in the case-law referred to in paragraph 154 above.

172    It follows from the foregoing that the contested decision, in so far as it lays down the virtual data room procedure, does not go beyond what is necessary in order to achieve the objectives of general interest which it pursues, namely to contribute to the maintenance of the system of competition intended by the Treaties, which undertakings have an absolute duty to comply with.

173    That conclusion is not called into question by the applicant’s arguments seeking to identify a more proportionate approach which could have been adopted in the contested decision, by means of different measures or additional measures. According to the applicant, the Commission ought to have allowed its lawyers to review the relevance for the investigation of the documents requested by the Commission and to identify and describe, in a document provided to it, the documents containing sensitive personal data, without providing those documents themselves. The Commission could also, or even should, have obtained the consent of the individuals concerned before the documents in question were communicated.

174    In that regard, concerning the intervention by the applicant’s lawyers, in order to assess the relevance of the documents requested, first, it is recalled in paragraph 69 above that it is for the Commission to decide whether a particular item of information is necessary to enable it to bring to light an infringement of the competition rules. Second, as the Commission and the Federal Republic of Germany correctly point out, if the undertaking under investigation, or its lawyers, could themselves establish which documents were, in their view, relevant for the Commission’s investigation, that would seriously undermine the Commission’s powers of investigation, with the risk that the documents which it might regard as relevant would be omitted and never be presented to the Commission, with no possibility for verification.

175    As regards obtaining the consent of the individuals concerned for the transmission to the Commission of the Protected Documents, first, as recalled in paragraphs 143 and 144 above, Article 6(1) of Regulation 2016/679 provides that the processing of personal data is lawful where at least one of the six conditions referred to in that paragraph is met. The processing of the personal data involved in producing the documents requested by the Commission is lawful in that it is necessary for compliance with a legal obligation to which the applicant is subject, as provided for in Article 6(1)(c) of Regulation 2016/679. Therefore, the consent of persons whose personal data are processed is not required under Article 6(1)(a) of that regulation. Second, such consent is not, under Article 5(1)(a) of Regulation 2018/1725, a condition for data processing by the Commission to be lawful in the context of the performance of a task carried out in the public interest or in the exercise of official authority vested in it, which is the case for an investigation based on Regulation No 1/2003.

176    Therefore, the applicant, by its arguments, has not identified less onerous measures which the Commission ought to have adopted. It follows from the foregoing that the applicant’s arguments must be rejected.

–       The exclusion of certain categories of documents from the virtual data room procedure

177    The applicant complains that the Commission failed to include within the scope of the virtual data room procedure documents which were linked to its business activities and which also contained sensitive personal data. That is contrary to the principle that respect for privacy also applies to correspondence sent from a workplace and in the context of commercial communications. The applicant identifies three documents capable of falling within that category.

178    The Commission disputes the applicant’s arguments and maintains that it defined the virtual data room procedure in accordance with the operative part of the order of 29 October 2020, Facebook Ireland v Commission (T‑452/20 R, not published, EU:T:2020:516).

179    As a preliminary point, it should be noted that the question whether or not a document containing sensitive personal data is connected with the applicant’s commercial activities, with the result that it is to be processed in accordance with the virtual data room procedure, is specifically assessed, in the first place, by the applicant. Indeed, the Commission is not in a position to review the applicant’s assessment in that regard before consulting the document in question, whether under the virtual data room procedure or outside of that procedure. It can impose a penalty for failure to comply with the obligations incumbent on the applicant only later.

180    As regards the documents relied on by the applicant, the following should be noted.

181    The first document is an email in which [confidential] invites colleagues to a Halloween party and gives details of the food and drink planned to be served to them. It must be stated that that email does not contain data covered by Article 9(1) of Regulation 2016/679 and Article 10(1) of Regulation 2018/1725.

182    The same applies to the second document, which consists of a performance level self-assessment by a member of the applicant’s staff. The only personal information relied on by the applicant is the desire expressed by the person concerned to travel more and the expression of that person’s – by its very nature subjective – view of the private life of another person, with no reference to specific data or facts.

183    Similarly, as regards the third document, which consists of an assessment of the performance level of a member of the applicant’s staff, the fact that a person expresses hopes that another person will be able to benefit from a rest period in order to spend time with family does not fall within the scope of the data referred to in Article 9(1) of Regulation 2016/679 and Article 10(1) of Regulation 2018/1725.

184    Lastly, the applicant cannot infer from the mere adoption of the amending decision that the production of documents containing personal data which were not examined in the context of the virtual data room procedure infringed its right to privacy and that of the individuals concerned.

185    It follows that the applicant’s arguments must be rejected.

–       Disproportionate workload imposed by the virtual data room

186    The applicant maintains that the virtual data room procedure imposes on it, in view of the deadline for producing the documents in question, a workload which is disproportionate to the needs of the Commission’s investigation. The requirements of that procedure would result in it having to redact the personal data at issue contained therein from approximately [confidential] documents, which are highly likely to be irrelevant.

187    The Commission disputes the applicant’s arguments.

188    It should be noted that point (9 p) of Annex I.B to the contested decision states that ‘Protected Documents may be transmitted to the Commission in a redacted form, by removing the names of the individuals concerned and any information allowing to identify them’.

189    It follows that redacting the names of the individuals concerned is an option available to the applicant, but it is not required of the applicant, with the result that it is entitled not to do so. Therefore, the applicant cannot reasonably assert that the contested decision imposes a disproportionate workload on it in that regard.

190    It follows from the foregoing that the applicant has not demonstrated any unlawfulness vitiating the virtual data room procedure set out in points (9 o) and (9 p) of Annex I.B to the contested decision.

(iii) Failure to weigh the needs of the investigation against the protection of the applicant’s rights

191    The applicant complains that the Commission did not weigh the need to collect information necessary for its investigation against the need to protect its privacy and that of the individuals concerned. According to the applicant, such a weighing exercise ought to have resulted in the Commission not requiring production of all the documents captured by applying the search terms referred to in the contested decision, even though it had demonstrated to the Commission that numerous documents were irrelevant to its investigation.

192    The Commission disputes the applicant’s arguments.

193    In the present case, it should be recalled that, in the light of the Commission’s discretion, referred to in paragraphs 68 to 70 above, regarding the information which it may seek to be produced by means of a request, the fact that documents may ultimately prove to be irrelevant to the investigation is not sufficient to establish that a request for information is disproportionate or unjustified, or that the needs of the investigation have not been weighed against the rights of the applicant and the individuals whose personal data might appear in the information requested pursuant to the contested decision.

194    Moreover, it must be pointed out that the contested decision concerns only five custodians. That number, which the applicant itself describes as ‘small’, must be regarded as evidence that the needs of the Commission’s investigation were weighed against the protection of the applicant’s right to privacy and that of the individuals concerned.

195    Furthermore, in so far as the applicant relies on the judgment of the European Court of Human Rights of 2 April 2015, Vinci Construction and GTM Génie Civil et Services v. France (CE:ECHR:2015:0402JUD006362910), it is sufficient to state that that case dealt with the possibility of requesting an effective review of whether legal professional privilege had been observed during inspections. In the present case, the contested decision does not prescribe that the content of communications between the applicant, or any other person, and its lawyers are to be produced to the Commission.

196    It must therefore be held that the applicant has not demonstrated that the contested decision was based on a failure to weigh the needs of the Commission’s investigation against the protection of the applicant’s right to respect for its privacy and that of the individuals concerned.

(5)    Whether the obligation of professional secrecy is inadequate

197    The applicant maintains that the obligation of professional secrecy imposed on Commission staff under Article 339 TFEU and Article 28(1) of Regulation No 1/2003, first, does not confer on them an unfettered right of access to the personal data at issue and, second, does not, in itself, offer sufficient guarantees to protect effectively the privacy of the individuals concerned and their personal data.

198    The applicant also maintains that documents not relevant to the investigation could be used for illegitimate purposes, such as broadening the scope of the current investigation or initiating another investigation, or could even be disclosed beyond the restricted circle of Commission staff responsible for the investigation. The documents could be provided to third parties in response to possible requests for access to the file or they could become automatically disclosable in other jurisdictions. The applicant could also be obliged to provide those documents to persons bringing legal proceedings against it in the United States of America. The personal data at issue could thus be provided to numerous individuals outside the Commission, in breach of the right to privacy of the individuals concerned.

199    The Commission, supported by the Federal Republic of Germany, disputes the applicant’s arguments.

200    It should be recalled that Commission officials and servants are subject to strict obligations of professional secrecy under Article 339 TFEU and Article 28 of Regulation No 1/2003. Those provisions prohibit Commission officials from disclosing information covered by the obligation of professional secrecy obtained in response to a request for information or using it for purposes other than those for which it was obtained. In addition, Commission officials and servants are bound by Article 17 of the Staff Regulations of Officials of the European Union, which prohibits their making, including after leaving the service, ‘any unauthorised disclosure of information received in the line of duty, unless such information has already been made public or is accessible to the public’.

201    Neither Article 339 TFEU nor Article 28 of Regulation No 1/2003 explicitly indicates what information, apart from business secrets, is covered by the obligation of professional secrecy. It cannot be inferred from Article 28(2) of Regulation No 1/2003 that such would be the case as regards all information acquired under that regulation other than information whose publication is mandatory under Article 30 thereof. Like Article 339 TFEU, Article 28(2) of Regulation No 1/2003 – which supplements and applies that provision of the Treaty to the field of competition rules applicable to undertakings – prevents only the disclosure of information of the kind covered by the obligation of professional secrecy (see judgment of 28 January 2015, Akzo Nobel and Others v Commission, T‑345/12, EU:T:2015:50, paragraph 61 and the case-law cited).

202    The obligation of professional secrecy extends beyond business secrets to information which is known to only a limited number of persons and the disclosure of which is liable to cause serious harm to the person who has provided it or to third parties. Last, the interests liable to be harmed by disclosure of the information concerned must, objectively, be worthy of protection (see judgment of 15 July 2015, Pilkington Group v Commission, T‑462/12, EU:T:2015:508, paragraph 45 and the case-law cited).

203    As regards, in the first place, the applicant’s argument that the obligation of professional secrecy which is imposed on Commission staff does not confer on them an unfettered right of access to the personal data at issue, it is recalled in paragraph 146 above that, under Article 5(1)(a) of Regulation 2018/1725, the EU institutions may lawfully process personal data when that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the EU institution or body.

204    As regards, in the second place, the argument that the obligations relating to professional secrecy do not constitute sufficient guarantees of effective protection of the privacy of the individuals concerned and of their personal data, it must be stated that that argument is not substantiated and that there is nothing to justify the assumption that the Commission will fail to ensure, when the time comes, that its obligations and those of its staff under Article 339 TFEU, Article 28 of Regulation No 1/2003 and Article 17 of the Staff Regulations of Officials are complied with (see, to that effect and by analogy, judgment of 12 December 1991, SEP v Commission, T‑39/90, EU:T:1991:71, paragraph 58).

205    As regards, in the third place, the argument alleging a risk that the documents obtained would be used for allegedly illegitimate purposes, such as broadening the scope of the current investigation or initiating another investigation, the following two principles should be recalled. First, the obligations on Commission staff under Article 339 TFEU and Article 28 of Regulation No 1/2003 preclude the use of information obtained in response to a request for information for purposes other than those for which it was acquired. Second, the purpose of a request for information is to enable the Commission to obtain the information and documentation necessary to check the actual existence and scope of a given factual and legal situation (see, to that effect, judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 37), without prejudice to the possibility for the Commission to develop the scope of its investigation following the information gathered.

206    The Court has confirmed, in relation to a decision requesting information adopted after a statement of objections, that in the administrative procedure applying the competition rules of the Treaty the Commission must logically be able to send supplementary requests for information after issuing the statement of objections in order to be able, if necessary, to withdraw complaints or add new ones (judgments of 30 September 2003, Atlantic Container Line and Others v Commission, T‑191/98 and T‑212/98 to T‑214/98, EU:T:2003:245, paragraph 121, and of 9 April 2019, Qualcomm and Qualcomm Europe v Commission, T‑371/17, not published, EU:T:2019:232, paragraph 76).

207    In the light of the into two distinct and successive stages of the administrative procedure under Regulation No 1/2003, referred to in paragraph 113 above, the foregoing considerations apply all the more to the adoption, as in the present case, of a decision requesting information during the preliminary investigation stage, before the adoption of a statement of objections. In that regard, it should be recalled that the preliminary stage is intended to enable the Commission to gather all the relevant evidence confirming that there has or has not been an infringement of the competition rules and to adopt an initial position on the course which the procedure is to follow.

208    Therefore, the applicant cannot reasonably rely on an alleged risk that certain documents produced in response to the contested decision will be used by the Commission in order to broaden the scope of the current investigation or to initiate another investigation.

209    As regards, in the fourth place, the applicant’s arguments that documents not relevant to the investigation or containing data such as the personal data at issue could be disseminated more widely outside the Commission, it must be stated that those arguments concern hypothetical situations, such as possible requests for access to the file by third parties and the disclosure, on an allegedly automatic basis of documents to courts, and that they are not substantiated.

210    It follows from the considerations set out in paragraphs 154 to 210 above that the applicant has not established that the contested decision constituted unjustified interference with its privacy or that of members of its staff or of other persons. In those circumstances, the first part of the second plea must be rejected.

(b)    The second part of the second plea, alleging failure to observe the principle of proportionality

211    The applicant complains that the Commission failed to observe the principle of proportionality. It maintains that the failure to observe that principle is apparent from, first, the obligation on it to produce, in the context of the virtual data room, documents containing sensitive personal data, second, the obligation to produce, in the same context, documents containing both commercial and personal data, third, the existence of methods better protecting the privacy of individuals than the virtual data room in order to assess the relevance of the Protected Documents and, fourth, the inadequacy and ineffectiveness of the possibility of anonymising the documents at issue.

212    The Commission disputes the applicant’s arguments.

213    It must be observed that the principle of proportionality, which is one of the general principles of EU law, requires that measures adopted by EU institutions should not exceed the limits of what is appropriate and necessary in order to attain the objective pursued, and where there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued (see, to that effect, judgments of 13 November 1990, Fedesa and Others, C‑331/88, EU:C:1990:391, paragraph 13, and of 14 July 2005, Netherlands v Commission C‑180/00, EU:C:2005:451, paragraph 103).

214    It is settled case-law that requests for information made by the Commission to an undertaking must comply with the principle of proportionality and that the obligation imposed on an undertaking to supply information should not be a burden on that undertaking which is disproportionate to the needs of the inquiry (judgments of 12 December 1991, SEP v Commission, T‑39/90, EU:T:1991:71, paragraph 51; of 14 March 2014, Cementos Portland Valderrivas v Commission, T‑296/11, EU:T:2014:121, paragraph 86; and of 9 April 2019, Qualcomm and Qualcomm Europe v Commission, T‑371/17, not published, EU:T:2019:232, paragraphs 120 and 121).

215    In the present case, first, the applicant relied on the workload entailed by a response to the contested decision being manifestly disproportionate only in relation to the redaction of the documents to which the virtual data room procedure applied. As has been pointed out in paragraph 190 above, redacting the names of the individuals concerned is an option available to the applicant, but it is not required of the applicant, with the result that it is entitled not to do so and that it is not justified in relying on a failure to observe the principle of proportionality in that regard. As regards anonymisation allegedly being inadequate due to the low number of custodians concerned, which would make it simple to identify them in a given document, it should be recalled that the small number of custodians concerned constitutes evidence of observance of the principle of necessity of the information requested, in accordance with Article 18(1) of Regulation No 1/2003, and evidence of the needs of the investigation having been weighed against the protection of the applicant’s rights.

216    Second, the applicant relies on the possibility, which may constitute an alternative to the virtual data room provided for in the contested decision, that the documents containing sensitive personal data be identified and described, in a document to be provided to the Commission, but without providing those documents themselves. According to the applicant, that practice makes it possible to avoid, first, Commission staff having access to the personal data in question by consulting documents in the virtual data room and, second, those documents having to undergo redaction of sensitive personal data contained in them before they are provided to the Commission.

217    As has been stated in paragraph 172 above, the virtual data room procedure established in the present case does not go beyond what is necessary in order to achieve the objectives of general interest which it pursues, in the light of the right to privacy of the applicant and the individuals concerned, as protected by Article 7 of the Charter.

218    Moreover, as is apparent from paragraph 185 above, the production of documents containing personal data which were not examined in the virtual data room procedure does not constitute an infringement of the right to privacy of the applicant and the individuals concerned.

219    It follows that the applicant has not established a failure to observe the principle of proportionality, with the result that the second part of the second plea must be rejected.

(c)    The third part of the second plea, alleging infringement of the right to good administration

220    The applicant maintains that the failure to review the relevance of the documents requested pursuant to the contested decision constitutes a manifest infringement of its right to good administration. In that regard, it recalls that the contested decision requires it to provide the Commission with many documents which are irrelevant to the investigation or contain personal data, including sensitive data.

221    The Commission disputes those arguments.

222    It should be pointed out that recital 37 of Regulation No 1/2003 states that the regulation ‘respects the fundamental rights and observes the principles recognised in particular by the Charter’ and that it ‘should be interpreted and applied with respect to those rights and principles’.

223    Article 41 of the Charter – which, under the first subparagraph of Article 6(1) TEU, has the same legal value as the Treaties – is entitled ‘Right to good administration’ and states, in paragraph 1, that ‘every person has the right to have his or her affairs handled impartially, fairly and within a reasonable time by the institutions, bodies, offices and agencies of the Union’.

224    According to the case-law on the principle of good administration, the guarantees afforded by the EU legal order in administrative procedures include, in particular, the duty of the competent institution to examine carefully and impartially all the relevant aspects of the individual case (judgments of 21 November 1991, Technische Universität München, C‑269/90, EU:C:1991:438, paragraph 14, and of 30 September 2003, Atlantic Container Line and Others v Commission, T‑191/98, T‑212/98 to T‑214/98, EU:T:2003:245, paragraph 404).

225    It must be held that, contrary to the applicant’s assertions in its reply to a question put by the Court, the arguments put forward in support of that part of the plea overlap in substance with those put forward in support of the second part of that plea, which themselves partly overlap with the arguments relied on in support of the second plea, alleging failure to observe the principle of necessity, and in support of the first part of the present plea.

226    Since all those arguments have already been rejected, it must be held that the applicant has not demonstrated that the Commission failed to carry out a diligent and impartial examination of the present case. Therefore, the applicant has failed to establish that the contested decision was vitiated by a failure to observe the principle of good administration.

227    Accordingly, the third part of the second plea must be rejected, as must, consequently, the second plea in its entirety.

228    It follows from all of the foregoing that the action must be dismissed in its entirety.

V.      Costs

229    Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. As the applicant has been unsuccessful, it must be ordered to bear its own costs and to pay those incurred by the Commission, including those incurred in the proceedings for interim relief.

230    Under Article 138(1) of the Rules of Procedure, the Member States which intervened in the proceedings are to bear their own costs. The Federal Republic of Germany must therefore bear its own costs.

On those grounds,

THE GENERAL COURT (Fifth Chamber, Extended Composition)

hereby:

1.      Dismisses the action;

2.      Orders Meta Platforms Ireland Ltd to bear its own costs and to pay those incurred by the European Commission, including those incurred in the proceedings for interim relief;

3.      Orders the Federal Republic of Germany to bear its own costs.

Papasavvas Spielmann Mastroianni

Brkan Gâlea

Delivered in open court in Luxembourg on 24 May 2023.

T. Henze S. Papasavvas

Acting Registrar President

*      Language of the case: English.

1 Confidential data omitted.