JUDGMENT OF THE GENERAL COURT (Fifth Chamber, Extended Composition)

24 May 2023 (*)

(Competition – Data market – Administrative procedure – Article 18(3) and Article 24(1)(d) of Regulation (EC) No 1/2003 – Request for information – Virtual data room – Obligation to state reasons – Legal certainty – Rights of the defence – Necessity of the information requested – Misuse of powers – Right to privacy – Proportionality – Principle of good administration – Professional secrecy)

In Case T‑451/20,

Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd, established in Dublin (Ireland), represented by D. Jowell KC, D. Bailey, Barrister, J. Aitken, D. Das, S. Malhi, R. Haria, M. Quayle, Solicitors, and T. Oeyen, lawyer,

applicant,

v

European Commission, represented by G. Conte, C. Urraca Caviedes and C. Sjödin, acting as Agents,

defendant,

supported by

Federal Republic of Germany, represented by S. Costanzo, acting as Agent,

intervener,

THE GENERAL COURT (Fifth Chamber, Extended Composition),

composed, at the time of the deliberations, of S. Papasavvas, President, D. Spielmann (Rapporteur), R. Mastroianni, M. Brkan and I. Gâlea, Judges,

Registrar: I. Kurme, Administrator,

having regard to the written part of the procedure,

further to the hearing on 1 June 2022,

gives the following

Judgment

1        By its action under Article 263 TFEU, the applicant, Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd, seeks annulment of Commission Decision C(2020) 3011 final of 4 May 2020 relating to a proceeding pursuant to Article 18(3) and to Article 24(1)(d) of Council Regulation (EC) No 1/2003 (Case AT.40628 – Facebook Data-related practices) (‘the initial decision’), as amended by Commission Decision C(2020) 9231 final of 11 December 2020 (‘the amending decision’) (together, ‘the contested decision’).

I.      Background to the dispute

2        On 13 March 2019, the European Commission sent the applicant a request for information by decision taken pursuant to Article 18(3) of Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation of the rules on competition laid down in Articles [101] and [102 TFEU] (OJ 2003 L 1, p. 1). That request for information comprised more than 100 unique questions, concerning various aspects of the applicant’s business and product offering.

3        The applicant replied to that request for information in three stages, on 23 April, 21 May and 18 June 2019. The documents produced were identified based on an initial search conducted by way of search terms chosen by the applicant and a relevance review carried out by the applicant’s external EU-qualified lawyers.

4        On 30 August 2019, the Commission sent a request for information on the basis of Article 18(2) of Regulation No 1/2003. That request for information comprised 83 unique questions regarding Facebook Marketplace, social networking and online classified advertisement providers.

5        The applicant replied to that request for information in three stages, on 30 September, 10 October and 5 November 2019.

6        On 11 November 2019, the Commission adopted a further decision under Article 18(3) of Regulation No 1/2003. The Commission requested the applicant to provide, inter alia, a number of internal documents meeting certain cumulative criteria. In essence, the requested documents were those prepared by or for, or received by, certain depositaries (custodians), dated 1 January 2013 until the date of that decision and containing certain search terms. In particular, two different sets of search terms were to be applied to two sets of custodians respectively. For one set of custodians, the search terms to be used were those which the applicant itself had selected and used on its own initiative in order to search for and identify internal documents to be submitted in response to the decision of 13 March 2019. For the second set of custodians, the search terms to be used had been formulated by the Commission on the basis, first, of the applicant’s documents and responses submitted following the decision of 13 March 2019 and, second, certain internal documents of the applicant published on 5 December 2018 by the Digital, Culture, Media and Sport Committee of the Parliament of the United Kingdom of Great Britain and Northern Ireland (‘the DCMS Committee’).

7        By letter of 20 November 2019, the applicant expressed its concerns regarding the necessity and proportionality of, and adequacy of reasons for, certain aspects of the decision of 11 November 2019. A series of exchanges took place between the applicant and the Commission with the aim of refining the search terms and reducing the number of documents identified.

8        On 17 January 2020, the Commission sent the applicant a revised set of search terms.

9        On 22 January 2020, the Commission informed the applicant of its intention to adopt a new decision containing amended search terms.

10      On 4 May 2020, the Commission adopted the initial decision. Under Article 1 of that decision, the applicant was to supply the Commission with the information specified in Annexes I.A, I.B and I.C to the decision by 15 June 2020. Article 2 provided for a potential penalty payment of EUR 8 million per day for failure to provide complete and accurate information requested under Article 1.

11      On 4 May 2020, the Director-General of the Commission’s Directorate-General (DG) for Competition sent the applicant a letter proposing a separate procedure for the production of sensitive documents which, according to the applicant, contained only personal information wholly unconnected with its commercial activities. Those documents would be placed on the file only after having been examined in a virtual data room.

12      In a series of exchanges, the applicant and the Commission discussed possible ways in which the virtual data room might be used.

13      By letter of 12 June 2020, the Commission agreed to extend until 27 July 2020 the period within which the applicant was required to reply to the request for information contained in the initial decision.

II.    Forms of order sought

14      By application lodged at the Registry of the General Court on 15 July 2020, the applicant brought the present action.

15      The applicant claims that the Court should:

–        annul the contested decision;

–        in the alternative, annul Article 1 of the contested decision;

–        order the Commission to pay the costs and order the Federal Republic of Germany to bear its own costs.

16      The Commission contends that the Court should:

–        declare inadmissible the applicant’s head of claim seeking the annulment in part of Article 1 of the contested decision in so far as it does not provide for accurate and adequate guarantees to be put in place safeguarding the rights of the persons concerned by the production of irrelevant documents which are personal or private in nature;

–        dismiss the action;

–        order the applicant to pay the costs.

17      The Federal Republic of Germany contends that the action should be dismissed and that the applicant should be ordered to pay the costs.

III. Facts subsequent to the action having been brought

A.      Procedure for interim relief

18      By a separate document lodged at the Court Registry on 15 July 2020, the applicant submitted an application for interim measures.

19      By order of 24 July 2020, Facebook Ireland v Commission (T‑451/20 R, not published), adopted on the basis of Article 157(2) of the Rules of Procedure of the General Court, the President of the General Court ordered that the operation of the initial decision be suspended until the date of the order terminating the proceedings for interim relief.

20      By order of 29 October 2020, Facebook Ireland v Commission (T‑451/20 R, not published, EU:T:2020:515), the President of the General Court set aside the order of 24 July 2020 referred to in paragraph 19 above, reserved the costs, ordered as follows and dismissed the application for interim relief as to the remainder:

‘1.      The operation of Article 1 of the [initial decision] is suspended, in so far as the obligation set out therein relates to documents which are not linked to [the applicant’s] business activities and which contain sensitive personal data, and for as long as the procedure referred to in point 2 has not been put in place.

2.      [The applicant] shall identify the documents containing the data referred to in point 1 and transmit them to the Commission on a separate electronic medium. Those documents shall then be placed in a virtual data room which shall be accessible to as limited a number as possible of members of the team responsible for the investigation, in the presence (virtual or physical) of an equivalent number of [the applicant’s] lawyers. The members of the team responsible for the investigation shall examine and select the documents in question, while giving [the applicant’s] lawyers the opportunity to comment on them before the documents considered relevant are placed on the file. In the event of disagreement as to the classification of a document, [the applicant’s] lawyers shall have the right to explain the reasons for their disagreement. In the event of continuing disagreement, [the applicant] may ask the Director for Information, Communication and Media at the Commission’s Directorate-General for Competition to resolve the disagreement.’

B.      Adoption of an amending decision and modification of the application

21      On 11 December 2020, the Commission adopted the amending decision, which provides for a separate procedure for the production of documents wholly unconnected with the applicant’s commercial activities and which contain sensitive personal information.

22      By separate document lodged at the Court Registry on 8 February 2021, the applicant, on the basis of Article 86 of the Rules of Procedure, modified the application, so that it takes account of the adoption of the amending decision.

C.      Requests for confidential treatment and that certain data not be made public; intervention

23      On 15 July 2020, 7 May and 10 September 2021, the applicant requested, pursuant to Article 66 of the Rules of Procedure, that certain data not be made public.

24      By letters of 30 October and 27 November 2020 as well as 8 February and 14 May 2021, the applicant requested, pursuant to Article 144(2) of the Rules of Procedure, that certain information be treated as confidential vis-à-vis the Federal Republic of Germany.

25      By order of 21 December 2020, the President of the Fifth Chamber of the General Court granted the Federal Republic of Germany leave to intervene and also granted the applicant’s requests for confidential treatment vis-à-vis the Federal Republic of Germany.

IV.    Law

26      In support of its action, the applicant relies on four pleas in law alleging, first, failure to indicate the subject matter of the investigation in sufficiently clear terms, second, infringement of Article 18(1) and (3) of Regulation No 1/2003, third, infringements of the right to privacy, the right to good administration as well as failure to observe the principle of proportionality and, fourth, infringement of the obligation to state reasons.

A.      Admissibility of the head of claim concerning the failure to put in place accurate and adequate guarantees

27      The Commission disputes the admissibility of the applicant’s head of claim seeking the annulment in part of Article 1 of the contested decision in so far as it does not provide for accurate and adequate guarantees safeguarding the rights of the persons affected by the production of irrelevant documents which are personal or private in nature. It maintains that that head of claim did not appear in the application challenging the initial decision and that no statement of reasons was provided in the statement of modification to explain its addition. Accordingly, the statement of modification does not explain how that additional head of claim is justified by the adoption of the amending decision and why it could not already have been formulated in the application challenging the initial decision.

28      It is settled case-law of the Court of Justice that the forms of order sought by the parties may not, in principle, be altered. Article 86 of the Rules of Procedure, on the modification of the application initiating proceedings, is a codification of pre-existing case-law on the admissible exceptions to the principle that the forms of order sought by the parties are unalterable (see judgment of 9 November 2017, HX v Council, C‑423/16 P, EU:C:2017:848, paragraph 18 and the case-law cited).

29      Under Article 86(1) of the Rules of Procedure, where a measure, the annulment of which is sought, is replaced or amended by another measure with the same subject matter, the applicant may, before the oral part of the procedure is closed, or before the decision of the Court to rule without an oral part of the procedure, modify the application to take account of that new factor.

30      In order for an applicant to be entitled to amend the form of order initially sought in the course of the proceedings, it must, in any event, not alter the nature of the action (see, to that effect, judgment of 13 June 2012, Insula v Commission, T‑246/09, not published, EU:T:2012:287, paragraph 103 and the case-law cited).

31      In the present case, it is true that the applicant’s head of claim seeking the annulment in part of Article 1 of the contested decision, in so far as it does not provide for accurate and adequate guarantees to be put in place safeguarding the rights of persons affected by the production of irrelevant documents of a personal or private nature, does not appear, as such, in the application initiating proceedings and appears explicitly only in the statement of modification.

32      However, it should be noted that the Commission does not dispute that the statement of modification otherwise complies with the conditions laid down in Article 86 of the Rules of Procedure, as interpreted in accordance with the case-law referred to in paragraph 30 above.

33      In that regard, it should be stated that that head of claim, in so far as it seeks the annulment in part of Article 1 of the contested decision to the extent that it does not provide for accurate and adequate guarantees to be put in place, is covered by the head of claim seeking annulment of Article 1 put forward in the alternative in the application.

34      In addition, it must be stated that Article 86 of the Rules of Procedure does not require the applicant to explain specifically why (i) it decided to formulate a head of claim which did not appear, as such, in the application and (ii) it was unable to formulate that head of claim in the application initiating proceedings, which is directed against the initial decision.

35      It follows that the Commission’s plea of inadmissibility seeking to dispute the admissibility of the applicant’s head of claim referred to in paragraph 27 above must be rejected.

B.      Substance

1.      The first plea, alleging failure to indicate the subject matter of the investigation in sufficiently clear terms

36      The applicant complains that the Commission failed to observe the principle of legal certainty, the general obligation to state reasons pursuant to Article 296 TFEU, the special obligation to state reasons pursuant to Article 18(3) of Regulation No 1/2003 as well as its rights of defence and the right to good administration, by failing to define the subject matter and scope of its investigation in sufficiently clear and consistent terms.

(a)    Failure to observe the obligation to state reasons

37      According to settled case-law, the statement of reasons required under Article 296 TFEU for measures adopted by EU institutions must be appropriate to the measure at issue and must disclose clearly and unequivocally the reasoning followed by the institution which adopted that measure in such a way as to enable the persons concerned to ascertain the reasons for it and to enable the competent court to review its legality. The requirements to be satisfied by the statement of reasons depend on all the circumstances of each case, in particular the content of the measure in question, the nature of the reasons given and the interest which the addressees of the measure, or other parties to whom it is of direct and individual concern, may have in obtaining explanations. It is not necessary for the reasoning to go into all the relevant facts and points of law, since the question whether the statement of reasons meets the requirements of Article 296 TFEU must be assessed with regard not only to its wording but also to its context and to all the legal rules governing the matter in question (see judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 16 and the case-law cited).

38      It should be recalled that Article 18(3) of Regulation No 1/2003 defines, in particular, the essential elements of a statement of reasons in respect of a decision requesting information. That provision states as follows:

‘Where the Commission requires undertakings and associations of undertakings to supply information by decision, it shall state the legal basis and the purpose of the request, specify what information is required and fix the time limit within which it is to be provided. It shall also indicate the penalties provided for in Article 23 and indicate or impose the penalties provided for in Article 24. It shall further indicate the right to have the decision reviewed by the Court of Justice.’

39      That obligation to state specific reasons is a fundamental requirement designed not merely to show that the request for information is justified, but also to enable the undertakings concerned to assess the scope of their duty to cooperate whilst at the same time safeguarding their rights of defence (see judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 19 and the case-law cited).

40      With respect to the obligation to state the ‘purpose of the request’, this relates to the Commission’s obligation to indicate the subject of its investigation in its request, and therefore to identify the alleged infringement of competition rules (see judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 20 and the case-law cited).

41      In that regard, the Commission is not required to communicate to the addressee of a decision requesting information all the information at its disposal concerning the presumed infringements, or to make a precise legal analysis of those infringements, providing it clearly indicates the suspicions which it intends to investigate (see judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 21 and the case-law cited).

42      That obligation may be explained, inter alia, by the fact that, as is apparent from Article 18(1) of Regulation No 1/2003 and recital 23 thereof, in order to carry out the duties assigned to it by that regulation, the Commission may, by simple request or by decision, require undertakings and associations of undertakings to provide ‘all necessary information’ (judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 22).

43      It follows that the Commission is entitled to require the disclosure only of information which may enable it to investigate presumed infringements which justify the conduct of the investigation and are set out in the request for information (see, to that effect, judgments of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 23, and of 28 April 2010, Amann & Söhne and Cousin Filterie v Commission, T‑446/05, EU:T:2010:165, paragraph 333 and the case-law cited).

44      Since the necessity of the information must be judged in relation to the purpose stated in the request for information, that purpose must be indicated with sufficient precision, otherwise it will be impossible to determine whether the information is necessary and the EU Courts will be prevented from exercising judicial review (see judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 24 and the case-law cited).

45      Whether or not the statement of reasons of the contested decision is sufficiently reasoned depends therefore on whether or not the putative infringements that the Commission intends to investigate are defined in sufficiently clear terms (see, to that effect, judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 25).

46      When assessing the extent of the obligation to state reasons with regard to a decision requesting information under Article 18(3) of Regulation No 1/2003, account must also be taken of the stage of the investigation at which such a decision is adopted and of whether or not the Commission already had certain information on the presumed infringements (see, to that effect, judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 39, and Opinion of Advocate General Wahl in HeidelbergCement v Commission, C‑247/14 P, EU:C:2015:694, point 50).

47      In the present case, it is apparent from the very title of the contested decision that it was adopted on the basis of Article 18(3) and Article 24(1)(d) of Regulation No 1/2003.

48      In recital 1 of the contested decision, the Commission mentioned that it was investigating the conduct of the Facebook group in relation to, first, its use of data and, second, Facebook’s social network platform in the European Economic Area (EEA).

49      In recital 3 of the contested decision, the Commission stated the following:

‘The Commission is focusing its investigation on Facebook’s use of data, as illustrated in certain Facebook internal documents published on 5 December 2018 and 18 February 2019 by the [DCMS Committee]. The aforementioned Facebook internal documents are from the period 2012-2015. A number of those documents appear to relate to Facebook internal discussions, business strategies or conducts concerning access to Facebook data, access to Facebook features and data monetisation strategies, including possibilities to grant to third parties access to Facebook data or features in exchange for different types of consideration and under different conditions. Other documents appear to illustrate Facebook’s use of the Onavo application … in order to obtain commercially valuable data on competing services.’

50      Thus, the Commission stated that it was focusing its investigation on the use of data by the applicant, highlighted by certain internal documents of the applicant, made public by the DCMS Committee, the content of which it described briefly. It also stated that other documents appeared to illustrate the applicant’s use of the Onavo application in order to obtain commercially valuable data on competing services.

51      In recital 4 of the contested decision, the Commission stated the following:

‘Based on those documents, it appears that Facebook may have engaged or be engaging in (i) conditional data sharing agreements that increase the data flow between Facebook and third parties, thereby reinforcing Facebook’s market power in a possible data market or raising barriers to entry through the accumulation of data; (ii) practices concerning the use of Facebook products (including but not limited to: the Onavo app, Facebook Research app and Facebook Business Tools) to obtain commercially valuable data on competing services, thereby foreclosing potential competitors and raising barriers to entry in possible markets for the social networking services and/or other digital services, and (iii) potentially discriminatory practices restricting access to Facebook data, features, application programming interfaces (“APIs”) or other tools based on the possible qualification of third parties as competitors, thereby foreclosing potential competitors and raising barriers to entry in possible markets for social networking services and/or other digital services.’

52      In recital 5 of the contested decision, the Commission observed as follows:

‘The Commission also understands, based on publicly available information, that there might have been instances in which Facebook blocked references to competing apps or websites in the Facebook suite, thereby foreclosing potential competitors or raising barriers to entry in possible markets for social networking services and/or other digital services. Further, based on publicly available information, the Commission understands that Facebook’s announced plan to integrate its different communications platforms (i.e. WhatsApp, Instagram and Facebook Messenger) could strengthen its position as a provider of consumer communication services, leading to the foreclosure of potential competitors.’

53      In recital 6 of the contested decision, the Commission stated as follows:

‘If the existence of any such behaviours were to be confirmed, they might constitute one or more infringements of Articles 101 and/or 102 [TFEU] and of Articles 53 and/or 54 of the EEA Agreement.’

54      It is appropriate to examine, in the first place, the applicant’s argument that the subject matter of the Commission’s investigation was ambiguous.

(1)    Establishing the subject matter of the Commission’s investigation

55      The applicant submits, in essence, that the statement of reasons for the contested decision is ambiguous in that recitals 1 to 3 of that decision suggest that the subject matter of the Commission’s investigation covers any practice involving the use of data, whereas recitals 4 and 5 of that decision contain non-exhaustive examples of the use of data and practices in which the Commission suspects the applicant to have been engaged. It adds that the contested decision does not describe any identifiable infringement of competition law and that it appears to permit the Commission to carry out an unfettered, general audit of all of the applicant’s business. The Commission’s investigation is therefore akin to a ‘fishing expedition’ and the applicant is not in a position to ascertain the extent of its rights and obligations and the Court is not in a position to assess whether the request for information at issue is justified and whether the requested information is required.

56      The Commission and the Federal Republic of Germany dispute the arguments put forward by the applicant.

57      It should be noted, as the Commission does, that recitals 1 and 3 of the contested decision are, in essence, used as an introduction. Accordingly, recital 1 identifies the entities under investigation, namely Facebook Inc. and all its group companies, including, in particular, WhatsApp Inc., Instagram LLC, Facebook Israel Ltd and Onavo Inc., as well as the area of the conduct under investigation, namely the use of data, the services under investigation, namely Facebook’s social network platform, as well as the geographic scope under examination, namely the EEA.

58      As regards recital 3 of the contested decision, the Commission identified in that recital the documents on the basis of which it had decided to initiate its investigation into the use of data by the applicant.

59      In recitals 4 and 5 of the contested decision, the Commission listed the practices which it suspects the applicant to have engaged in, based on the documents identified in recital 3 of that decision, and which it intended to investigate.

60      In recital 6 of the contested decision, the Commission stated that ‘such behaviours’ could constitute one or more infringements of Articles 101 and 102 TFEU and Articles 53 and 54 of the EEA Agreement. In so doing, it necessarily referred to the practices identified in recitals 4 and 5 of that decision.

61      In that regard, it must be held, as the Commission itself asserts, that the practices listed in recitals 4 and 5 of the contested decision are an exhaustive list. By means of that list, the Commission clearly indicated the suspicions which it intended to investigate, identified the alleged infringements of the competition rules and, in so doing, defined the subject matter of its investigation, within the meaning of the case-law referred to in paragraphs 40 and 41 above.

62      Such a statement of reasons therefore satisfies the requirement to state the purpose of the request for information, as provided for in Article 18(3) of Regulation No 1/2003.

63      In that regard, it must be stated that the other interpretations referred to by the applicant – which seek to regard the practices referred to in recitals 4 and 5 of the contested decision as being ‘non-exhaustive examples’ or ‘more particular practices’ concerning the use of data – would lead to the subject matter of the Commission’s investigation being interpreted in a manner which is excessively broad, which is incompatible with the case-law recalled in paragraphs 40 and 41 above.

64      It is settled case-law that where it is necessary to interpret a provision of secondary EU law, preference should as far as possible be given to the interpretation which renders the provision consistent with the Treaty and the general principles of EU law (judgments of 4 October 2007, Schutzverband der Spirituosen-Industrie, C‑457/05, EU:C:2007:576, paragraph 22; of 10 July 2008, Bertelsmann and Sony Corporation of America v Impala, C‑413/06 P, EU:C:2008:392, paragraph 174; and of 25 November 2009, Germany v Commission, T‑376/07, EU:T:2009:467, paragraph 22).

65      In those circumstances, the applicant is not entitled to argue that the subject matter of the Commission’s investigation is ambiguous, in that it extends to any practice involving the applicant’s use of data.

(2)    Description of the conduct complained of

66      The applicant maintains that, even if the subject matter of the Commission’s investigation must be understood as being confined solely to the practices listed in recitals 4 and 5 of the contested decision, that decision fails to describe in sufficiently precise terms a number of central aspects of the infringements suspected by the Commission.

67      First, the applicant maintains that the Commission failed to identify, in the contested decision, the business or products which might be affected by the data-sharing agreements referred to in recital 4(i) of that decision, or the discriminatory practices restricting access to the data, features and APIs or other tools, referred to in recital 4(iii) of that decision. Second, it argues that the Commission did not identify the competitor(s) which may have been affected by the discriminatory practices mentioned in recital 4(ii) of the contested decision, by the suspected blocking of references to competitors’ advertisements or websites and by the preliminary plan to integrate its different communications platforms, referred to in recital 5 of the contested decision. Third, the references in recitals 4 and 5 of that decision to foreclosing potential competitors and raising barriers to entry are so general that they do not define the nature of the conduct suspected by the Commission. In addition, in the absence of any identification of the type or origin of the alleged foreclosure or barriers, it is not possible to distinguish between anticompetitive foreclosure and competition on the merits, leading to the foreclosure of less efficient competitors.

68      According to the applicant, that vagueness makes it impossible to determine whether the Commission could reasonably suppose that some of the documents referred to in the contested decision would help it to determine whether the practices referred to in recitals 4 and 5 of that decision have taken place. The applicant refers, by way of example, to three documents requested by the Commission to be produced, and to search terms referred to in the contested decision, even though (i) the content of those documents is irrelevant for the purpose of verifying whether the practices referred to in recitals 4 and 5 of that decision have taken place and (ii) the terms in question have no plausible link with those practices. Nor is the applicant able to make its views known to the Commission and, in essence, must guess what accusations are made against it.

69      The Commission and the Federal Republic of Germany dispute the arguments put forward by the applicant.

70      It is necessary to examine whether, in the light of the context of the adoption of the contested decision and the stage of the investigation at which that decision was adopted, the statement of reasons for the contested decision is consistent with the case-law referred to in paragraphs 37 to 46 above.

71      The Commission described, in recital 4 of the contested decision, the practices in which it suspected the applicant to have been engaged and the applicant’s products or services concerned, as appropriate, by those practices. It mentioned, first, data-sharing agreements reinforcing the applicant’s market power in a possible data market or raising barriers to the entry to such a market; second, practices relating to its use of the Onavo, Facebook Research and Facebook Business Tools products to obtain commercially valuable data on competing services; and, third, potentially discriminatory practices restricting competitors’ access to data, features and APIs. As regards the last two types of practices, it stated that they could have the effect of foreclosing potential competitors or raising barriers to entry in possible markets for social networking services and other digital services.

72      In recital 5 of the contested decision, the Commission stated that there might have been instances in which the applicant had blocked, in some of its applications, references to competitors’ applications or websites, thereby foreclosing potential competitors and raising barriers to entry to possible markets for social networking services and other digital services. The Commission added that the applicant’s plan to integrate its different communications platforms, namely WhatsApp, Instagram and Facebook Messenger, could strengthen its position as a provider of consumer communication services, leading to the foreclosure of potential competitors.

73      It must be held that the content of recitals 4 and 5 of the contested decision constitutes a clear and unequivocal description of the object or effect of the practices in which the Commission suspects the applicant to have been engaged, as well as the applicant’s products or services possibly concerned by those practices. Such information also makes it possible to establish with sufficient precision the products to which the investigation relates and the suspected infringements justifying the adoption of that decision.

74      In addition, it should be observed that the Commission adopted the contested decision admittedly around one year after the first decision requesting information, adopted on 13 March 2019, and following exchanges with the applicant, recalled in paragraphs 3 to 9 above, in the context of which the applicant provided the Commission with certain information for the purposes of its investigation. However, the contested decision was adopted in the context of the preliminary investigation stage of the administrative procedure under Regulation No 1/2003, which is intended to enable the Commission to gather all the relevant evidence confirming that there has or has not been an infringement of the competition rules and to adopt an initial position on the course which the procedure is to follow (see, to that effect, judgment of 29 September 2011, Elf Aquitaine v Commission, C‑521/09 P, EU:C:2011:620, paragraph 113 and the case-law cited).

75      Having regard to those factors, it must be held that the statement of reasons of the contested decision enables (i) the applicant to ascertain whether the requested information is necessary for the purposes of the investigation and (ii) the EU Courts to exercise their power of review. It must be inferred therefrom that the contested decision is sufficiently reasoned.

76      That finding is not called into question by the applicant’s arguments referred to in paragraph 67 above.

77      In the light of the case-law referred to in paragraph 41 above, the Commission was required in the contested decision to indicate clearly the suspicions which it intended to investigate, but not to communicate to the applicant all the information at its disposal concerning the presumed infringements, nor to make a precise legal analysis of those infringements.

78      Therefore, contrary to the applicant’s assertions, the Commission’s obligation to state reasons in the present case did not require, at the stage when the contested decision was adopted, a more precise reference to the applicant’s business and products which might be affected by the practices referred to in recital 4(i) to (iii) of the contested decision, a more precise identification of potential competitors affected by the practices referred to in recital 4(ii) and in recital 5 of that decision, or further details regarding foreclosing potential competitors and raising barriers to entry.

79      Moreover, in recital 1 of the contested decision, the Commission defined the geographic scope of its investigation, namely the EEA, and its material scope, namely the use of data by the applicant and its social network platform. As the Commission correctly submits, the mere fact that the investigation relates to numerous activities and that the geographic scope of that investigation is wide cannot, as such, be regarded as an indication of vague reasoning.

80      Accordingly, it must be held that the alleged inaccuracies of which the applicant complains were not such as to harm its understanding of the purpose and subject matter of the investigation or of the suspected infringements which the Commission intended to investigate, nor the possibility for the Court to exercise its power of review.

81      Lastly, as regards the arguments based on examples of documents and of search terms, mentioned by the applicant and which are allegedly irrelevant for the purpose of verifying whether the practices referred to in recitals 4 and 5 of the contested decision have taken place, they are, in reality, seeking to dispute the necessity for the investigation of those documents and search terms. Arguments disputing the necessity of the information requested go to the substantive legality of the contested decision and cannot be taken into account in the examination of a plea alleging infringement of the obligation to state reasons (see, to that effect, judgment of 9 April 2019, Qualcomm and Qualcomm Europe v Commission, T‑371/17, not published, EU:T:2019:232, paragraph 55 and the case-law cited). Those arguments will, therefore, be analysed in Court’s examination of the second plea.

82      In the light of the foregoing, the applicant is not entitled to rely on an infringement of the obligation to state reasons, as laid down in Article 296 TFEU and Article 18(3) of Regulation No 1/2003, as regards the subject matter of the Commission’s investigation and the description of the practices the existence of which it intended to investigate.

(b)    Failure to observe the principle of legal certainty, infringement of the rights of the defence and of the right to good administration

83      As regards the complaints alleging failure to observe the principle of legal certainty, infringement of the rights of the defence and of the right to good administration, it must be stated that the applicant has put forward in support of them no independent argument distinct from those put forward in support of the complaint alleging infringement of the obligation to state reasons. Those complaints must therefore be rejected.

84      It follows from the foregoing that the first plea must be rejected in its entirety.

2.      The fourth plea, alleging infringement of the obligation to state reasons as regards the definition of the search terms referred to in the contested decision and the treatment of documents not relevant to the investigation

85      The applicant complains that the Commission infringed the obligation to state reasons as regards, first, the definition of the search terms referred to in the contested decision and, second, the treatment of documents not relevant to its investigation and produced in compliance with the contested decision.

(a)    The appropriateness of the search terms

86      The applicant maintains that the Commission failed to explain how and why it considered that the search terms mandated to be applied identified only documents which are relevant to its investigation, making it possible for it to determine whether the suspected alleged infringements had been committed.

87      The Commission disputes the applicant’s arguments.

88      As is apparent from paragraphs 57 to 82 above, the contested decision is sufficiently reasoned as regards the subject matter of the Commission’s investigation, the description of the practices the existence of which it intended to investigate and the need for the information requested.

89      In the light of the provisions and the case-law referred to in paragraphs 37 to 46 above, which define the scope of the obligation to state reasons for a decision requesting information, that obligation does not go so far as to require the Commission to provide in respect of each item of information requested or, as in the present case, each search term requested to be applied, a specific statement of the reasons why the Commission asserts that that information or search term, first, is necessary for its investigation and, second, contains or identifies only information relevant to that investigation.

90      To impose such a statement of reasons on the Commission would also exceed its obligations, set out in paragraphs 110 to 114 below, in the light of the principle of necessity. In particular, the requirement that a correlation must exist between the request for information and the suspected infringement is satisfied if the Commission could reasonably suppose, at the time of the request, that that information may help it to determine whether that infringement has taken place. Certainty cannot be required from the Commission in that regard.

91      Furthermore, as is apparent from paragraph 37 above, compliance with the obligation to state reasons must be assessed with regard not only to its wording but also to its context.

92      In that regard, as recalled in paragraph 74 above, the contested decision was adopted in the context of the preliminary investigation stage of the administrative procedure under Regulation No 1/2003, which is intended to enable the Commission to gather all the relevant evidence confirming that there has or has not been an infringement of the competition rules and to adopt an initial position on the course which the procedure is to follow.

93      In particular, the sole purpose of a request for information such as the contested decision is to enable the Commission to obtain the information and documentation necessary to check the actual existence and scope of a given factual and legal situation (judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 37).

94      Moreover, the contested decision was adopted following exchanges between the applicant and the Commission in which, inter alia, the applicant itself identified certain search terms which might be relevant for the purposes of providing the Commission with the information which it wished to obtain. Accordingly, in particular, Annex I.C to the contested decision specifies certain search terms as having been identified by the applicant in response to the request for information sent by the Commission on 13 March 2019. In addition, it is apparent from recital 15 of the contested decision – which concerns the decision of 11 November 2019 requesting information, which was subsequently withdrawn by the Commission – that the Commission had drawn up the list of search terms which it had requested to be applied based on the applicant’s reply to the information request of 13 March 2019 and on the basis of internal documents of the applicant made public by the DCMS Committee.  It is common ground that the search terms in the contested decision also appeared in the decision of 11 November 2019.

95      In the light of the foregoing, the applicant cannot reasonably rely on an infringement of the obligation to state reasons as regards the appropriateness of the search terms in the contested decision.

(b)    The processing of irrelevant documents

96      The applicant complains that the Commission failed to give reasons in the initial decision for its refusal to permit a review of the relevance of the documents captured by the search terms. In particular, first, it argues that the Commission did not explain why the applicant could not be permitted to withhold certain documents, even if its independent EU-qualified lawyers had found those documents to be manifestly irrelevant. Second, it argues that the Commission did not explain why documents containing confidential information covered by legal professional privilege would not be sent to it, whereas documents containing personal data could be sent to it. In that regard, the applicant maintains that, since the initial decision required information containing personal data to be provided, the Commission ought to provide adequate and effective safeguards for that information. However, the Commission did not give reasons for its refusal to grant such guarantees.

97      The Commission disputes the applicant’s arguments.

98      As a preliminary point, it should be recalled that Article 1 of the initial decision provides that the applicant is to provide the Commission with the documents referred to in Annexes I.A, I.B and I.C to that decision. By Article 3 of the amending decision, the Commission adopted a special procedure for the documents required to be produced by the applicant under the contested decision, but which were not linked to its business activities and which contained sensitive personal data.

99      In addition, on 8 February 2021, the applicant modified the application, on the basis of Article 86 of the Rules of Procedure, to take account of the adoption of the amending decision. Consequently, and having regard to the heads of claim referred to in paragraph 15 above, the purpose of the applicant’s action is to seek the annulment of the initial decision, as amended by the amending decision.

100    In the present case, the Court cannot rule on the lawfulness of the initial decision without taking into account the amendments resulting from the amending decision.

101    An action for annulment brought by a natural or legal person is admissible only in so far as that person has an interest in having the contested act annulled. Such an interest requires that the annulment of that act must be capable, in itself, of having legal consequences and that the action may therefore, through its outcome, procure an advantage to the party which brought it (judgment of 17 September 2015, Mory and Others v Commission, C‑33/14 P, EU:C:2015:609, paragraph 55). By analogy, the same is true of an interest in raising a plea in law (judgment of 28 February 2017, Canadian Solar Emea and Others v Council, T‑162/14, not published, EU:T:2017:124, paragraph 68).

102    In the present case, the applicant did not, before the adoption of the amending decision, provide the Commission with documents which would have been captured by the virtual data room procedure decided in that decision.

103    Therefore, the applicant could not, as appropriate, derive any benefit from a possible annulment of the initial decision on the basis of a breach of the obligation to state reasons resulting from the failure to state in that decision, first, reasons why it could not refuse to provide certain documents and, second, reasons for the failure to put in place specific guarantees, such as a procedure establishing a virtual data room, in order to safeguard the privacy of certain natural persons.

104    It follows that that complaint must be rejected as being inadmissible.

105    Since none of the arguments put forward by the applicant in support of the fourth plea is well founded, that plea must be rejected.

3.      The second plea, alleging infringement of Article 18 of Regulation No 1/2003, infringement of the rights of the defence and misuse of powers

106    By its second plea, the applicant submits that the contested decision infringes Article 18(3) of Regulation No 1/2003 on the ground that, by requiring it to produce many documents which are irrelevant to the Commission’s investigation, that decision is contrary to the principle of necessity, infringes its rights of defence and constitutes a misuse of the powers conferred on the Commission by Article 18 of Regulation No 1/2003 for the improper purpose of obtaining information which is irrelevant to the alleged infringements as described in the contested decision.

107    The second plea comprises three parts.

(a)    The first part of the second plea, alleging infringement of Article 18(1) and (3) of Regulation No 1/2003

108    The applicant complains that the Commission failed to observe the principle of necessity set out in Article 18 of Regulation No 1/2003. It maintains that applying the search terms mentioned in the contested decision inevitably leads to the capture of a significant number of documents which are irrelevant to the Commission’s investigation, on account, first, of the long duration of the period over which the searches are requested and, second, of the fact that the search terms in question are very common words or expressions, or even part of everyday language. Such search terms may thus be used in a context which has no relation to the practices which are the subject of the Commission’s investigation. The applicant also alleges that the Commission failed to observe the principle of necessity by requesting that numerous documents be produced without putting in place safeguards at least equivalent to those granted to undertakings in the context of inspections carried out under Article 20 of Regulation No 1/2003.

109    The Commission disputes the admissibility of the applicant’s arguments challenging certain search terms appearing in the contested decision, on the ground that since they were raised for the first time in the reply, they are out of time and that, moreover, they appear only in an annex to the reply.

110    As set out in recital 23 of Regulation No 1/2003, the Commission should be empowered throughout the European Union to require such information to be supplied as is necessary to detect any agreement, decision or concerted practice prohibited by Article 101 TFEU or any abuse of a dominant position prohibited by Article 102 TFEU.

111    It is also apparent from Article 18(1) of Regulation No 1/2003 that, in order to carry out the duties assigned to it by that regulation, the Commission may, by simple request or by decision, require undertakings and associations of undertakings to provide ‘all necessary information’.

112    As recalled in paragraph 43 above, the Commission is entitled to require the disclosure only of information which may enable it to investigate presumed infringements which justify the conduct of the investigation and are set out in the request for information.

113    Having regard to the broad powers of investigation conferred on the Commission by Regulation No 1/2003, it is for the Commission to decide whether a particular item of information is necessary to enable it to bring to light an infringement of the competition rules. Even if it already has evidence, or indeed proof, of the existence of an infringement, the Commission may legitimately take the view that it is necessary to request further information enabling it better to define the scope of the infringement, determine its duration or identify the circle of undertakings involved (judgment of 28 January 2021, Qualcomm and Qualcomm Europe v Commission, C‑466/19 P, EU:C:2021:76, paragraph 69).

114    As regards the judicial review carried out by the EU Courts of the Commission’s finding that an item of information is necessary, it is apparent from the case-law that that necessity must be judged in relation to the purpose stated in the request for information, namely the suspected infringement which the Commission intends to investigate. The requirement that a correlation must exist between the request for information and the suspected infringement is satisfied if the Commission could reasonably suppose, at the time of the request, that the information may help it to determine whether the infringement has taken place (judgment of 28 January 2021, Qualcomm and Qualcomm Europe v Commission, C‑466/19 P, EU:C:2021:76, paragraph 70).

115    In the present case, it should be recalled that, in the first paragraph of Article 1 of the contested decision, the Commission decided that the applicant was to supply it with the information specified in Annexes I.A, I.B and I.C to that decision. Annex I.A contains definitions of the relevant concepts as well as instructions, in particular technical instructions, to be complied with in relation to the production of the documents requested. Annex I.B contains instructions concerning presentation. Annex I.C contains the search terms to be applied by the applicant to its internal documents as well as explanations in that regard. The documents requested by the Commission are those captured by those search terms and which were prepared by certain depositaries (custodians), on their behalf, or received by them. There are three custodians, namely [confidential]. (1)

(1)    The scope of the applicant’s arguments and the identification of the contested search terms

116    In support of its argument that applying the search terms referred to in the contested decision would give rise to results containing a large number of irrelevant documents, the applicant identifies in particular certain search terms mentioned in Annex I.C to the contested decision, while arguing that those terms must be understood as non-exhaustive examples intended to illustrate its arguments. It adds that it would have been unreasonable, if not impossible, to focus on each search term separately.

117    It should be recalled that the Court may not, merely because it considers a plea relied upon by the applicant in support of its action for annulment to be well founded, automatically annul the challenged act in its entirety. Annulment of the act in its entirety is not acceptable where it is obvious that that plea, directed only at a specific part of the challenged act, is such as to provide a basis only for annulment in part (judgment of 11 December 2008, Commission v Département du Loiret, C‑295/07 P, EU:C:2008:707, paragraph 104).

118    However, annulment in part of an EU act is possible only in so far as the elements whose annulment is sought may be severed from the remainder of the act. That requirement of severability is not satisfied where the annulment in part of an act would have the effect of altering its substance. Review of whether the contested provisions are severable requires consideration of their scope, in order to be able to assess whether their annulment would alter the spirit and substance of the decision challenged (see judgment of 16 July 2015, Commission v Council, C‑425/13, EU:C:2015:483, paragraph 94 and the case-law cited).

119    It should be recalled that Article 1 of the contested decision places the applicant under an obligation, under Article 18(3) of Regulation No 1/2003, to produce the documents referred to in the annexes to that decision, namely those resulting from applying in its databases the search terms referred to in those annexes and which have been prepared by certain custodians, on their behalf or received by them over a certain period.

120    In that regard, it must be held that an overall assessment of compliance by the Commission with the principle of necessity is not appropriate, even if it were possible. The fact that certain search terms may, as the applicant submits, be too vague – in the sense that, by requiring the production of all documents resulting from the application of those search terms, the Commission failed to have regard to the principle of necessity – has no bearing on the fact that other search terms may be sufficiently precise or targeted to enable the correlation required under the case-law referred to in paragraph 114 above to be established.

121    It follows that, if the Court were to consider that certain search terms were too vague, with the result that they appeared in the contested decision in disregard of the principle of necessity, it ought to annul that decision only in so far as it requires the applicant to produce the documents resulting from the application of the search terms in question.

122    Such annulment in part would have no effect on the obligation on the applicant, under Article 1 of the contested decision, to produce the documents resulting from the application of the other search terms, which were adopted in accordance with the principle of necessity. In so doing, such an annulment in part would not have the effect of altering either the spirit or the substance of the contested decision, within the meaning of the case-law referred to in paragraph 118 above.

123    Furthermore, according to settled case-law, acts of the EU institutions are presumed to be valid. It is for parties seeking their annulment to rebut that presumption by producing evidence to cast doubt on the assessments made by the defendant institution (see judgment of 6 October 1999, Salomon v Commission, T‑123/97, EU:T:1999:245, paragraph 46 and the case-law cited).

124    In those circumstances, only the search terms specifically challenged by the applicant may be reviewed by the Court as to whether the principle of necessity has been observed. The other search terms must be regarded as having been defined in accordance with that principle.

125    The applicant identified certain search terms in the application, and others only at the stage of the reply, some in the body of that pleading, and others in an annex thereto.

126    The Commission disputes the admissibility of the applicant’s arguments concerning the search terms mentioned for the first time at the stage of the reply, on the grounds that they are out of time and that they appear only in an annex to the reply.

127    It is apparent from Article 84 of the Rules of Procedure that no new plea in law may be introduced in the course of proceedings unless it is based on matters of law or of fact which come to light in the course of the procedure.

128    The concept of a ‘plea in law’ within the meaning of that provision has been interpreted broadly, also covering complaints (judgment of 29 November 2018, Spain v Commission, T‑459/16, not published, EU:T:2018:857, paragraph 25) and even mere ‘arguments’ (see, to that effect, judgment of 11 July 2019, Silver Plastics and Johannes Reifenhäuser v Commission, T‑582/15, not published, EU:T:2019:497, paragraph 198).

129    In the present case, the applicant submits, in essence, that the reference, at the stage of the reply, to new search terms is simply intended to support arguments already set out in the application and not to cast doubt on arguments or evidence to the contrary submitted by the Commission at the stage of the defence. However, in the light of the considerations set out in paragraphs 120 and 121 above, it must be held that, in so doing, the applicant developed a new line of argument directed against evidence, first, which it had not expressly disputed in the application, even though it was open to it to do so, and, second, to which the Commission did not refer in the defence.

130    Moreover, as regards the search terms in question which were found not in the body of the reply itself, but solely in an annex thereto, it should be recalled that the annexes have a purely evidential and instrumental function (judgment of 21 March 2002, Joynson v Commission, T‑231/99, EU:T:2002:84, paragraph 154).

131    Therefore, the applicant’s arguments based on search terms referred to for the first time at the stage of the reply must be rejected as being inadmissible.

(2)    The substance of the arguments directed against the search terms referred to in the application

132    First, the applicant maintains that the terms ‘big question’, ‘for free’, ‘not good for us’ and ‘shut* down’ are, by their very nature, capable of being used in everyday conversation in relation to topics which, on any view, have nothing to do with the conduct or practices falling within the scope of the Commission’s investigation. In that respect, such search terms are clearly too vague and general and form part of an extensive ‘fishing expedition’. The applicant adds that applying those general terms to documents concerning [confidential] public figures [confidential] increases the likelihood of obtaining irrelevant results. Those persons have responsibility for, and oversight over, every area of the applicant’s business, including activities which have little or no connection with the facts under investigation, such as the human resources, corporate finance and corporate social responsibility of the undertaking, or even their involvement in their own personal projects and philanthropic activities. Furthermore, the applicant provides certain examples of documents, which it regards as irrelevant and which were identified by applying certain search terms.

133    The Commission disputes the claims relating to the search terms ‘big question’, ‘for free’, ‘not good for us’ and ‘shut* down’.

134    As regards the search term ‘big question’, the Commission correctly submits, without being challenged by the applicant, that that expression appears in an email sent by [confidential] to two of his colleagues, and copied to [confidential]. In that email, [confidential] gave the instruction to deny access to the applicant’s application programming interfaces (API) to certain operators. That email referred to a strategic decision to be taken in that regard as the ‘big question’. From that, the Commission infers, without being challenged by the applicant, that the words ‘big question’ could appear either in replies to that email, in follow-up emails referring to that ‘big question’ drafted by the abovementioned persons, or in other emails from the same persons referring to similar strategic anticompetitive decisions.

135    As is apparent from recital 4(iii) of the contested decision, the Commission intended to investigate the existence of potentially discriminatory practices restricting access to Facebook data, features and APIs or other tools depending on the possible qualification of third parties as competitors, thereby foreclosing potential competitors and raising barriers to entry in possible markets for social networking services or other digital services.

136    The applicant cannot maintain that the Commission ought to have limited its request to the emails referring to or in connection with that initial email, or significantly limited its request in other respects, for example by defining much shorter periods or by targeting only communications between certain persons. Nor can it allege that applying that term to all documents prepared or received by three custodians over a period of seven years constituted a large-scale ‘fishing expedition’.

137    It should be stated that the search term ‘big question’ is intended to be applied to only two custodians, namely [confidential], and that the period covered by the request relating to that search term is the same as the period covered by the investigation itself.

138    Therefore, and having regard to the findings referred to in paragraph 134 above, which are not disputed by the applicant, by asking it to produce the documents resulting from the application of the search term ‘big question’ despite the fact that that expression may be used in everyday language, the Commission could reasonably suppose, at the time of the contested decision, that that information could help it to determine whether the conduct referred to in recital 4(iii) of that decision took place, in accordance with the case-law referred to in paragraph 114 above.

139    As regards the search term ‘for free’, the Commission correctly submits, without being challenged by the applicant, that that expression appears in an email made public by the DCMS Committee, which referred to the applicant’s business strategies for data monetisation, in particular the various possibilities of granting third-party app developers access to APIs and data concerning its users. Nor does it dispute that the author of the email discussed whether access was to be granted free of charge or for a fee, conditioned on advertising spending or in exchange for total data and API reciprocity, under which the applicant’s APIs and data would be made available free of charge to third-party applications operating on the Facebook platform through APIs, in exchange for their user data being shared with the applicant. From that, the Commission infers, and it is not disputed by the applicant, that the search term ‘for free’ allows for the capture of documents referring to conditional data sharing arrangements which could increase the data flow between the applicant and third parties, thereby reinforcing the applicant’s market power or raising barriers to entry through the accumulation of data. As is apparent from recital 4(i) of the contested decision, the Commission intends precisely to investigate whether such arrangements exist.

140    The applicant also puts forward the arguments set out in paragraph 136 above in relation to that search term. It must be held, for reasons similar to those set out in paragraphs 137 and 138 above, that the Commission could reasonably suppose, at the time of the contested decision, that that information could help it to determine whether the conduct referred to in recital 4(i) of that decision took place, in accordance with the case-law referred to in paragraph 114 above.

141    As regards the search term ‘shut* down’, the Commission submits, without being challenged by the applicant, that that expression was used, first, in the applicant’s internal documents published by the DCMS Committee, in the context of the applicant possibly adopting a strategy of restricting access to its data for third parties perceived to be competitors, and, second, in an email in which [confidential] approved API access restrictions on the application named ‘Vine’.

142    The Commission adds, without being challenged by the applicant, that the search term ‘shut* down’ relates to the possible adoption by the applicant of a strategy of restricting access to its data for third parties perceived to be competitors, referred to in recital 4(iii) of the contested decision. Therefore, that search term allows for the capture of documents referring to such potentially anticompetitive practices, given that it would probably have been used to refer to restricting access to the applicant’s data for other competitors.

143    The applicant also puts forward the arguments set out in paragraph 136 above in relation to that search term. It must be held, for reasons similar to those set out in paragraphs 137 and 138 above, with the difference that the search term ‘shut* down’ was applied to three custodians, that the Commission could reasonably suppose, at the time of the contested decision, that that information could help it to determine whether the conduct referred to in recital 4(iii) of that decision took place, in accordance with the case-law referred to in paragraph 114 above.

144    As regards the search term ‘not good for us’, the applicant does not dispute that that expression appears in an email sent to [confidential] on 19 November 2012, made public by the DCMS Committee in 2018, which concerned the possibility that developers could build applications using data relating to Facebook users and their friends, without providing the applicant with data in return. In that email, [confidential] referred to various ways in which the applicant could obtain data from third parties in exchange for its own data.

145    The Commission adds, without being challenged by the applicant, that the expression ‘not good for us’ appears, in the light of the email in question, to concern possible conditional data sharing arrangements, referred to in recital 4(i) of the contested decision, which could increase the data flow between the applicant and third parties, thereby reinforcing the applicant’s market power or raising barriers to entry through the accumulation of data. It adds that that expression could also appear in replies to that email, in follow-up emails examining whether other developers’ practices might also be ‘not good for [the applicant]’, according to [confidential], or in other emails from the latter raising the same issue concerning similar practices implemented by other developers.

146    The applicant also puts forward the arguments set out in paragraph 136 above in relation to that search term. It must be held, for reasons similar to those set out in paragraphs 137 and 138 above, that the Commission could reasonably suppose, at the time of the contested decision, that that information could help it to determine whether the conduct referred to in recital 4(i) of that decision took place, in accordance with the case-law referred to in paragraph 114 above.

147    It follows that the applicant has not established that the Commission failed to observe the principle of necessity in relation to the search terms ‘big question’, ‘for free’, ‘not good for us’ and ‘shut* down’.

148    Moreover, in the light of the Commission’s compliance with its obligation to state reasons, as is apparent from the examination of the first plea above, the applicant is also wrong to complain that the Commission failed to explain how the use of certain search terms complied with the principle of necessity.

149    Second, as regards the search terms ‘compet* + shar*’, ‘compet* + partner*’, ‘compet * + strateg*’, ‘line + strateg*’ and ‘line + block*’, it should be noted that the applicant disputes the lawfulness of those terms on account of the number, which it considers to be very high, of documents captured by applying those terms in its internal databases. As regards the terms ‘[confidential] + shar*’, ‘[confidential] + shar*’, ‘[confidential] + shar*’, ‘[confidential] + shar*’, ‘[confidential] + shar*’, ‘duplicat* + (limit & data)’, ‘duplicat* + block*’ and ‘duplicat* + remov*’, the applicant submits that applying those terms captures documents which it regards as irrelevant to the Commission’s investigation. Those two matters demonstrate that not all those search terms comply with the principle of necessity.

150    However, as the Commission submits, those arguments do not make it possible to challenge the appropriateness or the necessity of the terms in question for its investigation. It follows from the nature of the request for information at issue that its scope becomes fully apparent only after the search terms have been applied to the applicant’s databases in order to identify the documents captured by those terms. The mechanism for applying search terms means it is inevitable that documents will be identified which will ultimately prove not to be relevant to the investigation. Accordingly, the mere fact that applying search terms causes numerous documents to be captured, some of which subsequently prove not to be relevant to the Commission’s investigation, is not sufficient, in itself, to make a finding, in accordance with the case-law cited in paragraphs 113 and 114 above, that the search terms in question have no correlation with the infringement suspected by the Commission. Nor is that sufficient to rule out the possibility that the Commission could reasonably have supposed, at the time of the contested decision, that applying those search terms could have helped it to determine the existence and extent of that infringement, its duration or the circle of undertakings involved.

151    In the light of the foregoing, the applicant has not established that a search term in the contested decision was not consistent with the principle of necessity stemming from Article 18(1) of Regulation No 1/2003, as interpreted by the case-law referred to in paragraphs 110 to 114 above.

152    As regards the applicant’s argument that the Commission failed to observe the principle of necessity in that it requested documents to be produced without putting in place safeguards at least equivalent to those granted to undertakings in the context of inspections carried out under Article 20 of Regulation No 1/2003, it should be noted that it is for the Court, when hearing an action for annulment of a decision requesting information, such as the contested decision, to review, within the limits of the pleas raised before it, whether such a decision respects the rights which the undertaking concerned derives from the legal framework applicable to such a decision. By contrast, it is not for the Court to review the lawfulness of such a decision by comparison with the legal framework applicable to decisions adopted on different legal bases, such as inspection decisions.

153    Nevertheless, it must be recalled that the undertakings to which a request for information is addressed enjoy adequate guarantees.

154    In particular, in the context of the implementation of a decision requesting information, such an undertaking may identify the documents requested by the Commission and examine them with the assistance of its lawyers before communicating them to the Commission. Therefore, it has the possibility of refusing to disclose documents covered by legal professional privilege. In addition, it may submit to the Commission a reasoned request for irrelevant documents to be returned. That possibility is explicitly recognised in the Commission notice on best practices for the conduct of proceedings concerning Articles 101 and 102 TFEU (OJ 2011 C 308, p. 6). The Commission is required to examine such a request and, as appropriate, return the irrelevant documents.

155    Consequently, the first part of the second plea must be rejected.

(b)    The second part of the second plea, alleging infringement of the rights of the defence

156    The applicant maintains that the contested decision infringes its rights of defence, as protected by Article 41(2) and Article 48(2) of the Charter of Fundamental Rights of the European Union (‘the Charter’), in that it requires the applicant to produce documents which, first, are unnecessary for the Commission’s investigation and, second, concern activities which are not covered by that decision, such as virtual or augmented reality. It adds that it is not clear on the basis of the contested decision whether the data centres it manages and whether some of its new products, such as the ‘Messenger Rooms’ group video call service, fall within the scope of the Commission’s investigation. Likewise, the alleged infringements under investigation by the Commission are unknown to it or have not been clearly identified. For those reasons, it is impossible for it to prepare its defence effectively during the inter partes stage of the administrative procedure and to take the measures which it considers may be useful for that purpose, such as finding and preserving evidence or identifying exculpatory witness statements.

157    The Commission and the Federal Republic of Germany dispute the applicant’s arguments.

158    In that regard, it should be recalled that observance of the rights of the defence in the conduct of administrative procedures relating to competition policy constitutes a general principle of EU law whose observance the EU Courts ensure (see judgment of 3 September 2009, Prym and Prym Consumer v Commission, C‑534/07 P, EU:C:2009:505, paragraph 26 and the case-law cited).

159    In that regard, it should be borne in mind that the administrative procedure under Regulation No 1/2003, which takes place before the Commission, is divided into two distinct and successive stages, each having its own internal logic, namely a preliminary investigation stage and an inter partes stage. The preliminary investigation stage, during which the Commission uses the powers of investigation provided for in Regulation No 1/2003 and which covers the period up until the notification of the statement of objections, is intended to enable the Commission to gather all the relevant evidence tending to prove or disprove the existence of an infringement of the competition rules and to adopt an initial position on the course of the procedure and how it is to proceed. By contrast, the inter partes stage, which covers the period from the notification of the statement of objections to the adoption of the final decision, must enable the Commission to reach a final decision on the alleged infringement (see judgment of 14 March 2014, Cementos Portland Valderrivas v Commission, T‑296/11, EU:T:2014:121, paragraph 33 and the case-law cited).

160    The starting point for the preliminary investigation stage is the date on which the Commission, in exercise of the powers conferred on it by Articles 18 and 20 of Regulation No 1/2003, takes measures which involve the allegation of an infringement and which have major repercussions on the situation of the undertakings under suspicion. It is not until the beginning of the inter partes administrative stage that the undertaking concerned is informed, by means of the notification of the statement of objections, of all the essential evidence on which the Commission relies at that stage of the procedure and that that undertaking has a right of access to the file in order to ensure that its rights of defence are effectively exercised. Consequently, it is only after notification of the statement of objections that the undertaking concerned is able to rely in full on its rights of defence. If those rights were extended to the period preceding the notification of the statement of objections, the effectiveness of the Commission’s investigation would be compromised, since the undertaking concerned would already be able, at the preliminary investigation stage, to identify the information known to the Commission, hence the information that could still be concealed from it (see judgment of 14 March 2014, Cementos Portland Valderrivas v Commission, T‑296/11, EU:T:2014:121, paragraph 34 and the case-law cited).

161    However, the measures of inquiry adopted by the Commission during the preliminary investigation stage – in particular, the investigation measures and the requests for information – suggest, by their very nature, that an infringement has been committed and may have major repercussions on the situation of the undertakings under suspicion. Consequently, it is necessary to prevent the rights of the defence from being irremediably compromised during that stage of the administrative procedure since the measures of inquiry taken may be decisive in providing evidence of the unlawful nature of conduct engaged in by undertakings for which they may be liable (see judgment of 14 March 2014, Cementos Portland Valderrivas v Commission, T‑296/11, EU:T:2014:121, paragraph 35 and the case-law cited; see also, to that effect, judgment of 21 September 1989, Hoechst v Commission, 46/87 and 227/88, EU:C:1989:337, paragraph 15).

162    In the present case, it should be noted that the Commission adopted the contested decision in the preliminary stage of its investigation into the use of data by the applicant and before a statement of objections was adopted. Therefore, in accordance with the case-law referred to in paragraph 161 above, it is necessary to determine whether the applicant has established that its rights of defence have been irremediably compromised owing to the adoption of the contested decision.

163    First, the arguments by which the applicant alleges that its rights of defence have been infringed owing to being required, under the contested decision, to produce documents which are unnecessary for the Commission’s investigation, are based on the premiss that that decision was adopted contrary to the principle of necessity referred to in Article 18(1) of Regulation No 1/2003. They must therefore be rejected as a result of the rejection of the first part of the present plea.

164    Second, it must be stated that, in arguing in support of that part of the plea that it is not in a position to identify the practices in which the Commission suspects it to have been engaged nor whether some of its activities and products fall within the scope of the Commission’s investigation, the applicant is in fact challenging the clarity with which the subject matter of the Commission’s investigation is defined and the Commission’s compliance with its obligation to state reasons.

165    In the light of the considerations set out in paragraph 82 above, from which it is apparent that the Commission complied with its obligation to state reasons as regards the subject matter of the investigation and the description of the practices the existence of which it intended to investigate, those allegations must be rejected.

166    As regards the applicant’s questions as to whether certain of its areas of activity or certain of its products are included in the subject matter of the Commission’s investigation, it is recalled in paragraph 41 above that the Commission is not required to communicate to the addressee of a decision requesting information all the information at its disposal concerning the putative infringements and that it cannot be required to indicate, at the preliminary investigation stage – besides the putative infringements which it intends to investigate – the evidence, that is to say, the information leading it to consider that Article 101 TFEU may have been infringed. Such an obligation would upset the balance struck by the case-law between preserving the effectiveness of the investigation and upholding the defence rights of the undertaking concerned (judgment of 14 March 2014, Cementos Portland Valderrivas v Commission, T‑296/11, EU:T:2014:121, paragraph 37).

167    Furthermore, it must be stated that the applicant submits that the alleged uncertainty regarding the conduct of which it is accused prevented it from taking the measures which it considered useful for its defence and thus from preparing its defence at the inter partes stage of the administrative procedure, without, however, establishing that those uncertainties irremediably infringed its rights of defence.

168    In those circumstances, the contested decision, which is part of the preliminary investigation stage of the administrative procedure provided for by Regulation No 1/2003 must be considered to have been adopted in compliance with the applicant’s rights of defence.

169    The second part of the second plea must therefore be rejected.

(c)    The third part of the second plea, alleging misuse of powers

170    The applicant complains the Commission misused its powers of investigation and conducted a general and unlimited investigation into all its activities and the activities of its most senior executives, or even a ‘fishing expedition’ by attempting, by means of the contested decision, to determine whether the applicant engaged in other anticompetitive practices or committed other infringements, including outside the scope of competition law. In that regard, it submits that the practices covered by the Commission’s investigation are formulated in vague terms in the contested decision, which fails to specify the markets and business activities concerned, any potential competitors who might have been adversely affected by such conduct, or what constitutes anticompetitive foreclosure as opposed to foreclosure resulting from competition on the merits.

171    The Commission and the Federal Republic of Germany dispute the arguments put forward by the applicant.

172    It should be noted that the applicant’s arguments put forward in support of that part of the plea seek, once more, to challenge the Commission’s compliance with its obligation to state reasons. Accordingly, the argument relating to the vagueness of the practices covered by the Commission’s investigation and the argument relating to the failure to identify competitors allegedly harmed by the practices under investigation have already been rejected as being unfounded in the context of the first complaint of the first plea. As for the arguments regarding the fact that the applicant’s activities and the markets concerned by the investigation are not defined sufficiently in the contested decision, nor is the difference between anticompetitive foreclosure and foreclosure resulting from competition on the merits, they are not such as to establish a misuse of the Commission’s powers of investigation, having regard to (i) the stage of the procedure at which the contested decision was adopted and the case-law referred to in paragraph 160 above and (ii) the extent of the Commission’s obligation to state reasons for that decision, referred to in paragraphs 38 to 46 above.

173    It follows from the foregoing that the third part of the second plea and, consequently, the second plea in its entirety must be rejected.

4.      The third plea, alleging infringement of the right to privacy and the right to good administration and failure to observe the principle of proportionality

174    By its third plea, the applicant submits that, by requiring the production of numerous irrelevant documents of a private nature, the contested decision infringes the fundamental right to privacy enshrined in Article 7 of the Charter and in Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’) and the right to good administration, and fails to observe the principle of proportionality.

175    The plea comprises three parts.

(a)    The first part of the third plea, alleging infringement of the right to privacy

176    The applicant pleads infringement of its right to privacy and that of its staff and third parties, as protected by Article 7 of the Charter and Article 8 ECHR.

177    The applicant maintains that the contested decision constitutes an unjustified interference with the right to privacy, as referred to in Article 8 ECHR. First, the applicant argues that it follows from the arguments set out in support of each of the pleas in the application that that interference is not in accordance with the law, namely Article 18(3) of Regulation No 1/2003. Second, the contested decision does not pursue a legitimate aim, in that the Commission requests the production of information which it could not reasonably suppose would help it to determine whether any of the alleged infringements have taken place. Third, that decision does not comply with the principle of necessity required by Article 8 ECHR.

178    The Commission and the Federal Republic of Germany dispute the applicant’s arguments.

179    Under Article 7 of the Charter, everyone has the right to respect for his or her private and family life, home and communications.

180    According to Article 8 ECHR, everyone has the right to respect for his or her private and family life, home and correspondence.

181    Article 7 of the Charter, concerning the right to respect for private and family life, contains rights which correspond to those guaranteed by Article 8(1) ECHR. In accordance with Article 52(3) of the Charter, Article 7 thereof is thus to be given the same meaning and the same scope as Article 8(1) ECHR, as interpreted by the case-law of the European Court of Human Rights (judgment of 17 December 2015, WebMindLicenses, C‑419/14, EU:C:2015:832, paragraph 70).

182    Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.

183    It is necessary to examine whether the contested decision complies with Article 7 of the Charter and, to that end, satisfies the conditions set out in Article 52(1) of the Charter.

(1)    Whether there is a legal basis for the interference with privacy

184    The applicant submits that the contested decision constitutes an unlawful interference with the right to privacy, for the following reasons. First, it follows from the arguments set out in support of each of the pleas in the application that that interference is not provided for by law, namely Article 18(3) of Regulation No 1/2003. Second, providing the Commission with all the documents captured by the search terms in the contested decision entails communicating personal data relating to: (i) the custodians referred to in that decision, (ii) other members of the applicant’s staff and (iii) friends or family members of those persons (‘the personal data at issue’). Third, the applicant submits that it cannot be required to communicate to the Commission information which is irrelevant for the purposes of the investigation. It maintains that, if that were the case, it would contravene Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2), by unlawfully processing personal data, in so far as it is not necessary for compliance with a legal obligation, within the meaning of that provision.

185    Under the conditions set out in Article 52(1) of the Charter, the limitation on the right to respect for private life must first of all be provided for by law. The measure in question must therefore have a legal basis (see judgment of 28 May 2013, Trabelsi and Others v Council, T‑187/11, EU:T:2013:273, paragraph 79 and the case-law cited).

186    That is so in the present case. The contested decision was adopted on the basis of Article 18(3) of Regulation No 1/2003, which confers on the Commission the power to require undertakings and associations of undertakings to supply information by decision.

187    That conclusion cannot be called into question by the applicant’s arguments that the contested decision is unlawful in so far as it entails unlawful processing of personal data on its part, as referred to in Article 6(1) of Regulation 2016/679.

188    First of all, it should be noted that Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39), applies, according to Article 2(1) thereof, to the processing of personal data by all EU institutions and bodies, whereas Regulation 2016/679 applies to any other natural or legal person, except in the cases provided for in Article 2(2) of that regulation.

189    Next, Article 6(1) of Regulation 2016/679 provides that:

Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(c)      processing is necessary for compliance with a legal obligation to which the controller is subject’.

190    It should be recalled that Article 1 of the contested decision places the applicant under an obligation, pursuant to Article 18(3) of Regulation No 1/2003, to supply the documents referred to in the annexes to that decision. Therefore, that decision constitutes a legal obligation within the meaning of Article 6(1)(c) of Regulation 2016/679.

191    The other arguments raised by the applicant in paragraph 127 of the application are formulated in a general and indiscriminate manner and therefore do not comply with the requirements set out in Article 76 of the Rules of Procedure.

192    Lastly, Article 5(1)(a) of Regulation 2018/1725 provides that EU institutions may lawfully process personal data when it is ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body’.

193    In that regard, the exercise of the powers given to the Commission by Regulation No 1/2003 contributes to the maintenance of the system of competition intended by the Treaties, which undertakings have an absolute duty to comply with (see judgment of 20 June 2018, České dráhy v Commission, T‑621/16, not published, EU:T:2018:367, paragraph 105 and the case-law cited).

194    Since Regulation No 1/2003 confers on the Commission the power to adopt decisions requesting information, the applicant cannot maintain that the contested decision constitutes an interference not provided for by law, within the meaning of Article 52(1) of the Charter.

(2)    Whether objectives of general interest recognised by the European Union are pursued

195    As regards the condition that, subject to the principle of proportionality, limitations on the exercise of a right may be made only if they genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others, the applicant disputes that the contested decision meets such objectives. In that regard, it maintains that the Commission requires information to be disclosed which it cannot reasonably suppose will help it to determine whether the practices under investigation actually took place.

196    It is apparent from the case-law that the powers conferred on the Commission by Article 18 of Regulation No 1/2003 are intended to allow it to carry out its duty under the Treaties of ensuring compliance with the competition rules in the internal market. The function of those rules is to prevent competition from being distorted to the detriment of the public interest, individual undertakings and consumers (see, by analogy, judgment of 20 June 2018, České dráhy v Commission, T‑621/16, not published, EU:T:2018:367, paragraph 105 and the case-law cited).

197    Accordingly, the contested decision is an expression of the exercise of the powers conferred on the Commission by Regulation No 1/2003, which, as has been pointed out in paragraph 193 above, contributes to the maintenance of the system of competition intended by the Treaties, which undertakings have an absolute duty to comply with.

198    Therefore, contrary to the applicant’s assertions, the contested decision does meet objectives of general interest recognised by the European Union.

(3)    Whether the essence of the right to privacy has been observed

199    The applicant does not maintain that the contested decision compromises the essence of the right to privacy as referred to in Article 7 of the Charter.

(4)    Whether the interference with privacy is proportionate

200    It should be recalled that the principle of proportionality requires that the limitations which may be imposed by acts of EU law on the rights and freedoms enshrined in the Charter do not exceed the limits of what is appropriate and necessary in order to meet the legitimate objectives pursued or the need to protect the rights and freedoms of others; where there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued (see judgment of 26 April 2022, Poland v Parliament and Council, C‑401/19, EU:C:2022:297, paragraph 65 and the case-law cited).

201    Accordingly, in order to examine whether the interference with privacy caused by the contested decision is proportionate, it is necessary to ascertain whether that interference is appropriate and necessary in order to achieve the objectives of general interest pursued by the European Union before considering the balance of interests.

(i)    Whether the interference is appropriate

202    In the present case, having regard to paragraphs 110, 196 and 197 above, it must be held that a request for information such as the contested decision constitutes an appropriate measure for achieving the objectives of general interest pursued by the Commission.

(ii) Whether the interference is necessary

203    As regards whether the contested decision goes beyond what is necessary in order to achieve the objectives of general interest which it pursues, the applicant puts forward a number of arguments.

–       The insufficient level of protection under the virtual data room procedure

204    The applicant maintains that the virtual data room procedure adopted by the Commission in the amending decision does not protect adequately its right and that of the individuals concerned to respect for their privacy. In that regard, first, it maintains that that procedure enables Commission staff to carry out a cursory examination of the personal data at issue, contrary to the right to privacy of the individuals concerned and that it would be likely to cause serious harm to them. Second, that procedure has no bearing on the obligation, contrary to the right to privacy of those persons, to provide the Commission with information, such as the personal data at issue, which is irrelevant to the Commission’s investigation. In that regard, the applicant maintains that a proportionate approach capable of remedying the unlawfulness of the contested decision would be to adopt different measures or additional measures.

205    It should be recalled that, following the adoption of the order of 29 October 2020, Facebook Ireland v Commission (T‑451/20 R, not published, EU:T:2020:515), the Commission adopted the amending decision on 11 December 2020. As provided in that decision, the Commission adopted a separate procedure concerning documents required to be produced by the applicant pursuant to the contested decision but which, prima facie, were not linked with its commercial activities and which contained sensitive personal data (‘the Protected Documents’).

206    Article 3 of the amending decision provides for points (9 o) and (9 p) to be added to Annex I.A to the contested decision, worded as follows:

‘(9 o)            Protected Documents shall be transmitted to the Commission on a separate electronic medium. Those documents shall then be placed in a virtual data room which shall be accessible to as limited a number as possible of members of the team responsible for the investigation, in the presence (virtual or physical) of an equivalent number of Facebook’s lawyers. The members of the team responsible for the investigation shall examine and select the documents in question, while giving Facebook’s lawyers the opportunity to comment on them before the documents considered relevant are placed on the file. In the event of disagreement as to the classification of a document, Facebook’s lawyers shall have the right to explain the reasons for their disagreement. In the event of continuing disagreement, Facebook may ask the Director for Information, Communication and Media at the Commission’s Directorate-General for Competition to resolve the disagreement.’

‘(9 p)            Protected Documents may be transmitted to the Commission in a redacted form, by removing the names of the individuals concerned and any information allowing to identify them. Upon request by the Commission motivated by the needs of the investigation, Protected Documents which have been transmitted in a redacted form must be provided to the Commission in a full, unredacted version.’

207    It should be recalled that, pursuant to Article 6(1)(c) of Regulation 2016/679, the applicant lawfully processes personal data when it provides to the Commission documents containing such data which are requested pursuant to the contested decision.

208    In addition, as recalled in paragraph 192 above, under Article 5(1)(a) of Regulation 2018/1725, the EU institutions may lawfully process personal data when that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in those institutions.

209    Furthermore, the applicant has alleged, without being challenged by the Commission, that certain documents identified following the application of the search terms contained in the contested decision, and therefore required to be produced pursuant to that decision, contained sensitive personal data.

210    Such data are capable of falling within the scope of the data referred to in Article 9(1) of Regulation 2016/679 and Article 10(1) of Regulation 2018/1725.

211    Article 9(1) and (2)(g) of Regulation 2016/679 and Article 10(1) and (2)(g) of Regulation 2018/1725 provide, in identical terms, as follows:

‘1.      Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

2.      Paragraph 1 shall not apply if one of the following applies:

…

(g)      processing is necessary for reasons of substantial public interest, on the basis of Union … law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject …’

212    Article 9(2)(g) of Regulation 2016/679 and Article 10(2)(g) of Regulation 2018/1725 thereby make subject to three conditions the possibility of processing personal data referred to in Article 9(1) and Article 10(1) of those regulations respectively. First, the processing must pursue a significant public interest, with its basis in EU law. Second, the processing must be necessary to fulfil that public interest. Third, EU law must be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

213    The applicant does not allege that the conditions laid down by those provisions have been infringed, with the result that the Court is not required to review whether the contested decision complies with those provisions. However, those provisions are relevant for assessing whether the contested decision satisfies the third of the conditions set out in Article 52(1) of the Charter, namely whether that decision goes beyond what is necessary in order to achieve the objectives of general interest which it pursues.

214    As regards the first condition, it has been recalled in paragraph 202 above that a request for information such as the contested decision constituted an appropriate measure for achieving the objectives of general interest pursued by the Commission.

215    As regards the second condition, it is apparent from the examination of the first part of the second plea that the Commission has sufficiently established, in the light of the case-law referred to in paragraph 114 above, the required correlation between the information requested in the contested decision and the suspected infringements mentioned in that decision. Therefore, the processing of personal data entailed by the contested decision is necessary to fulfil the significant public interest pursued.

216    As regards the third condition, it should be recalled that Article 5 of Regulation 2018/1725 sets out the limits of EU institutions’ power to process personal data, by providing, inter alia, in Article 5(1)(a) thereof, that such processing is to be permitted when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in that institution. In addition, it is apparent from paragraph 74 above that, following exchanges with the applicant, the Commission withdrew an earlier request for information and adopted the contested decision, which contains a reduced number of search terms and concerns a smaller number of custodians, in order to reduce the number of results obtained and to limit the production of identified internal documents. That had the effect of reducing the number of documents containing personal data, or even Protected Documents, as provided for in the amending decision, which the applicant was required to produce. Lastly, as is apparent from recital 3 of that decision, the purpose of the virtual data room procedure is to place on the file only those Protected Documents which are found actually to be relevant to the Commission’s investigation after they have been examined in such a room. In addition, the applicant does not maintain that the contested decision compromises the essence of the right to privacy as provided for in Article 7 of the Charter.

217    Furthermore, as is apparent from points (9 o) and (9 p) of Annex I.A to the contested decision, the Protected Documents must be sent to the Commission separately from the other documents requested, on a separate electronic medium. In addition, the virtual data room in which those documents will then be placed will be accessible only to as limited a number as possible of members of the team responsible for the investigation, in the virtual or physical presence of an equivalent number of the applicant’s lawyers. Also, the applicant’s lawyers have the opportunity to comment on the documents considered relevant by the members of the team responsible for the investigation before they place them on the file. Moreover, point (9 o) of Annex I.A to the contested decision provides that, in the event of disagreement as to the classification of a document, the applicant’s lawyers will have the right to explain the reasons for their disagreement, which, if it persists, gives the applicant the right to request the Director responsible for information, communication and media in the Commission’s DG for Competition to arbitrate. Furthermore, point (9 p) of Annex I.A to the contested decision provides that the Protected Documents may be transmitted to the Commission in a redacted form, by removing the names of the individuals concerned and any information allowing them to be identified, and that it is only upon request by the Commission, motivated by the needs of the investigation, that the Protected Documents which have been transmitted in a redacted form must be provided to the Commission in their full and unredacted version.

218    Therefore, the measures provided for in points (9 o) and (9 p) of Annex I.A to the contested decision do not go beyond what is necessary for the purposes of the objectives pursued by the contested decision and their disadvantages are not disproportionate to the aims pursued, as provided for in the case-law referred to in paragraph 200 above.

219    It follows from the foregoing that the contested decision, in so far as it lays down the virtual data room procedure, does not go beyond what is necessary in order to achieve the objectives of general interest which it pursues, namely to contribute to the maintenance of the system of competition intended by the Treaties, which undertakings have an absolute duty to comply with.

220    That conclusion is not called into question by the applicant’s arguments seeking to identify a more proportionate approach which could have been adopted in the contested decision, by means of different measures or additional measures. According to the applicant, the Commission ought to have allowed its lawyers to review the relevance for the investigation of the documents requested by the Commission and to identify and describe, in a document provided to it, the documents containing sensitive personal data, without providing those documents themselves. The Commission could also, or even should, have obtained the consent of the individuals concerned before the documents in question were communicated.

221    In that regard, concerning the intervention by the applicant’s lawyers in order to assess the relevance of the documents requested, first, it is recalled in paragraph 113 above that it is for the Commission to decide whether a particular item of information is necessary to enable it to bring to light an infringement of the competition rules. Second, as the Commission and the Federal Republic of Germany correctly point out, if the undertaking under investigation, or its lawyers, could themselves establish which documents were, in their view, relevant for the Commission’s investigation, that would seriously undermine the Commission’s powers of investigation, with the risk that documents which it might regard as relevant would be omitted and never be presented to the Commission, with no possibility for verification.

222    As regards obtaining the consent of the individuals concerned for the transmission to the Commission of the Protected Documents, first, as recalled in paragraphs 189 and 190 above, Article 6(1) of Regulation 2016/679 provides that the processing of personal data is lawful where at least one of the six conditions referred to in that paragraph is met. The processing of the personal data involved in producing the documents requested by the Commission is lawful in that it is necessary for compliance with a legal obligation to which the applicant is subject, as provided for in Article 6(1)(c) of Regulation 2016/679. Therefore, the consent of persons whose personal data are processed is not required under Article 6(1)(a) of that regulation. Second, such consent is not, under Article 5(1)(a) of Regulation 2018/1725, a condition for data processing by the Commission to be lawful in the context of the performance of a task carried out in the public interest or in the exercise of official authority vested in it, which is the case for an investigation based on Regulation No 1/2003.

223    Therefore, the applicant, by its arguments, has not identified less onerous measures which the Commission ought to have adopted. It follows from the foregoing that the applicant’s arguments must be rejected.

–       The exclusion of certain categories of documents from the virtual data room procedure

224    The applicant complains that the Commission failed to include within the scope of the virtual data room procedure documents which were linked to its business activities and which also contained sensitive personal data. That is contrary to the principle that respect for privacy also applies to correspondence sent from a workplace and in the context of commercial communications. The applicant identifies eight documents capable of falling within that category.

225    The Commission disputes the applicant’s arguments and maintains that it defined the virtual data room procedure in accordance with the operative part of the order of 29 October 2020, Facebook Ireland v Commission (T‑451/20 R, not published, EU:T:2020:515).

226    As a preliminary point, it should be noted that the question whether or not a document containing sensitive personal data is connected with the applicant’s commercial activities, with the result that it is to be processed in accordance with the virtual data room procedure, is specifically assessed, in the first place, by the applicant. Indeed, the Commission is not in a position to review the applicant’s assessment in that regard before consulting the document in question, whether under the virtual data room procedure or outside of that procedure. It can impose a penalty for failure to comply with the obligations incumbent on the applicant only later.

227    According to the applicant, one of the documents in question contains personal political opinions [confidential], together with information about the applicant’s business. It should be noted that that document is an email in which a member of staff of the applicant [confidential] mentions having attended a breakfast organised by [confidential] and expresses support [confidential] in relation to a future election. However, the applicant has identified no information concerning its business contained in that document and no such information is apparent from that document. Nor is it apparent that the author participated in the event in question in his capacity as a member of staff [confidential] of the applicant. Therefore, it has not been established that that document falls outside the scope of the virtual data room procedure.

228    As regards the other documents relied on by the applicant, the following should be noted.

229    The applicant identifies four of those documents as relating to its human resources, including performance reviews, illnesses or complaints, and containing allegedly highly personal exchanges between [confidential] concerning their friends and family, together with information about its business activities.

230    The first document is an email sent by [confidential] to colleagues, in which the sender describes parental problems involving the sender’s adolescent children and contains a personal anecdote from another person regarding the same issue. The applicant has not established that that email contains data covered by Article 9(1) of Regulation 2016/679 and Article 10(1) of Regulation 2018/1725.

231    The same applies to the second document, which consists of a performance level self-assessment by a member of the applicant’s staff. The only personal information relied on by the applicant is the desire expressed by the person concerned to travel more and the expression of that person’s – by its very nature subjective – view of the private life of another person, with no reference to specific data or facts.

232    Similarly, in the third document, which is an exchange of emails [confidential], one asserts that another employee ought to express his beliefs more forcefully in relation to a matter of a professional nature connected with the applicant’s business. The applicant has not shown that that document contained data covered by Article 9(1) of Regulation 2016/679 and Article 10(1) of Regulation 2018/1725.

233    Lastly, the applicant also has not identified any such data in the fourth document, which is the curriculum vitae of a candidate in relation to a post in its business.

234    In addition, the applicant relies on two documents concerning its activities and the activities of [confidential] on political matters unrelated to the subject matter of the Commission’s investigation.

235    The first document is an exchange of emails between members of staff of the applicant [confidential] in order to discuss, inter alia, questions of a commercial nature relating to economic activities in a particular State. However, the applicant has not identified in that exchange data covered by Article 9(1) of Regulation 2016/679 and Article 10(1) of Regulation 2018/1725.

236    Nor has the applicant identified such data in the second document, drawn up by [confidential], which sets outs the latter’s activities as regards political subjects unrelated to the subject matter of the Commission’s investigation.

237    The applicant relies on a final document, referring to discussions between its representatives and politicians on issues such as counter-terrorism and crime prevention. It should be noted that that document is, as the applicant argues, an internal email containing a summary of a round table, in which some of its representatives participated, devoted to cooperation in combating the sexual exploitation of children. That email included an official press release from an organisation participating in those efforts and extracts from press releases by government bodies also involved in those efforts. The applicant has not established the existence, in that email, of data referred to in Article 9(1) of Regulation 2016/679 and Article 10(1) of Regulation 2018/1725.

238    Lastly, the applicant cannot infer from the mere adoption of the amending decision that the production of documents containing personal data which were not examined in the context of the virtual data room procedure infringed its right to privacy and that of the individuals concerned.

239    It follows that the applicant’s arguments must be rejected.

–       Disproportionate workload imposed by the virtual data room

240    The applicant maintains that the virtual data room procedure imposes on it, in view of the deadline for producing the documents in question, a workload which is disproportionate to the needs of the Commission’s investigation. The requirements of that procedure would result in it having to redact the personal data at issue contained therein from approximately [confidential] documents which are highly likely to be irrelevant.

241    The Commission disputes the applicant’s arguments.

242    It should be noted that point (9 p) of Annex I.A to the contested decision states that ‘Protected Documents may be transmitted to the Commission in a redacted form, by removing the names of the individuals concerned and any information allowing to identify them’.

243    It follows that redacting the names of the individuals concerned is an option available to the applicant, but it is not required of the applicant, with the result that it is entitled not to do so. Therefore, the applicant cannot reasonably assert that the contested decision imposes a disproportionate workload on it in that regard.

244    It follows from the foregoing that the applicant has not demonstrated any unlawfulness vitiating the virtual data room procedure set out in points (9 o) and (9 p) of Annex I.A to the contested decision.

(iii) Failure to weigh the needs of the investigation against the protection of the applicant’s rights

245    The applicant complains that the Commission did not weigh the need to collect information necessary for its investigation against the need to protect its privacy and that of the individuals concerned. According to the applicant, such a weighing exercise ought to have resulted in the Commission not requiring production of all the documents captured by applying the search terms referred to in the contested decision, even though it had demonstrated to the Commission that numerous documents were irrelevant to its investigation.

246    The Commission disputes the applicant’s arguments.

247    In the present case, it is apparent from recitals 17 to 26 of the contested decision that, following the decision of 11 November 2019 requesting information and in response to the applicant’s request of 20 November 2019 for the Commission to revise the number of search terms and custodians covered by that request for information, the applicant and the Commission discussed, inter alia, the definition of the information requested. Accordingly, on 6 December 2019, the Commission invited the applicant to communicate to it the number of hits per search term applied and per custodian, so that it could verify whether it would be appropriate to amend the search terms or the list of custodians. As is apparent from recital 27 of the contested decision, the Commission considered it appropriate to amend the decision of 11 November 2019, in particular in order to reduce the number of search terms, the list of custodians and the number of resulting hits and to limit the production of internal documents.

248    It must be stated that, in the contested decision, the Commission reduced considerably the number of search terms which it sought to have applied as well as the number of custodians concerned, from 58 in the decision of 11 November 2019 to 3, a number which the applicant itself describes in the contested decision as ‘small’. That reduction, which is not disputed by the applicant, necessarily had the effect of reducing the number of documents having, as appropriate, to be communicated to the Commission. The fact that the number of custodians was reduced as well as the number of custodians ultimately concerned by the contested decision constitute evidence that the Commission weighed the needs of its investigation and the rights of the applicant and of the individuals whose personal data might appear in the information requested pursuant to the contested decision.

249    In addition, in the light of the Commission’s discretion, referred to in paragraphs 43 and 112 to 114 above, regarding the information which it may seek to be produced by means of a request, the fact that documents may ultimately prove to be irrelevant to the investigation is not sufficient to establish that a request for information is disproportionate or unjustified, or that the needs of the investigation have not been weighed against the rights of the applicant and the individuals whose personal data might appear in the information requested pursuant to the contested decision.

250    Lastly, in so far as the applicant relies on the judgment of the European Court of Human Rights of 2 April 2015, Vinci Construction and GTM Génie Civil et Services v. France (CE:ECHR:2015:0402JUD006362910), it is sufficient to state that that case dealt with the possibility of requesting an effective review of whether legal professional privilege had been observed during inspections. In the present case, the contested decision does not prescribe that the content of communications between the applicant, or any other person, and its lawyers are to be produced to the Commission.

251    It must therefore be held that the applicant has not demonstrated that the contested decision was based on a failure to weigh the needs of the Commission’s investigation against the protection of the applicant’s right to respect for its privacy and that of the individuals concerned.

(5)    Whether the obligation of professional secrecy is inadequate

252    The applicant maintains that the obligation of professional secrecy imposed on Commission staff under Article 339 TFEU and Article 28(1) of Regulation No 1/2003, first, does not confer on them an unfettered right of access to the personal data at issue and, second, does not, in itself, offer sufficient guarantees to protect effectively the privacy of the individuals concerned and their personal data.

253    The applicant also maintains that documents not relevant to the investigation could be used for illegitimate purposes, such as broadening the scope of the current investigation or initiating another investigation, or could even be disclosed beyond the restricted circle of Commission staff responsible for the investigation. The documents could be provided to third parties in response to possible requests for access to the file or they could become automatically disclosable in other jurisdictions. The applicant could also be obliged to provide those documents to persons bringing legal proceedings against it in the United States of America. The personal data at issue could thus be provided to numerous individuals outside the Commission, in breach of the right to privacy of the individuals concerned.

254    The Commission, supported by the Federal Republic of Germany, disputes the applicant’s arguments.

255    It should be recalled that Commission officials and servants are subject to strict obligations of professional secrecy under Article 339 TFEU and Article 28 of Regulation No 1/2003. Those provisions prohibit Commission officials from disclosing information covered by the obligation of professional secrecy obtained in response to a request for information or using it for purposes other than those for which it was obtained. In addition, Commission officials and servants are bound by Article 17 of the Staff Regulations of Officials of the European Union, which prohibits their making, including after leaving the service, ‘any unauthorised disclosure of information received in the line of duty, unless such information has already been made public or is accessible to the public’.

256    Neither Article 339 TFEU nor Article 28 of Regulation No 1/2003 explicitly indicates what information, apart from business secrets, is covered by the obligation of professional secrecy. It cannot be inferred from Article 28(2) of Regulation No 1/2003 that such would be the case as regards all information acquired under that regulation other than information whose publication is mandatory under Article 30 thereof. Like Article 339 TFEU, Article 28(2) of Regulation No 1/2003 – which supplements and applies that provision of the Treaty to the field of competition rules applicable to undertakings – prevents only the disclosure of information of the kind covered by the obligation of professional secrecy (see judgment of 28 January 2015, Akzo Nobel and Others v Commission, T‑345/12, EU:T:2015:50, paragraph 61 and the case-law cited).

257    The obligation of professional secrecy extends beyond business secrets to information which is known to only a limited number of persons and the disclosure of which is liable to cause serious harm to the person who has provided it or to third parties. Last, the interests liable to be harmed by disclosure of the information concerned must, objectively, be worthy of protection (see judgment of 15 July 2015, Pilkington Group v Commission, T‑462/12, EU:T:2015:508, paragraph 45 and the case-law cited).

258    As regards, in the first place, the applicant’s argument that the obligation of professional secrecy which is imposed on Commission staff does not confer on them an unfettered right of access to the personal data at issue, it is recalled in paragraph 192 above that, under Article 5(1)(a) of Regulation 2018/1725, the EU institutions may lawfully process personal data when that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the EU institution or body.

259    As regards, in the second place, the argument that the obligations relating to professional secrecy do not constitute sufficient guarantees of effective protection of the privacy of the individuals concerned and of their personal data, it must be stated that that argument is not substantiated and there is nothing to justify the assumption that the Commission will fail to ensure, when the time comes, that its obligations and those of its staff under Article 339 TFEU, Article 28 of Regulation No 1/2003 and Article 17 of the Staff Regulations of Officials are complied with (see, to that effect and by analogy, judgment of 12 December 1991, SEP v Commission, T‑39/90, EU:T:1991:71, paragraph 58).

260    As regards, in the third place, the argument alleging a risk that the documents obtained would be used for allegedly illegitimate purposes, such as broadening the scope of the current investigation or initiating another investigation, the following two principles should be recalled. First, the obligations on Commission staff under Article 339 TFEU and Article 28 of Regulation No 1/2003 preclude the use of information obtained in response to a request for information for purposes other than those for which it was acquired. Second, the purpose of a request for information is to enable the Commission to obtain the information and documentation necessary to check the actual existence and scope of a given factual and legal situation (see, to that effect, judgment of 10 March 2016, HeidelbergCement v Commission, C‑247/14 P, EU:C:2016:149, paragraph 37), without prejudice to the possibility for the Commission to develop the scope of its investigation following the information gathered.

261    The Court has confirmed, in relation to a decision requesting information adopted after a statement of objections, that in the administrative procedure applying the competition rules of the Treaty the Commission must logically be able to send supplementary requests for information after issuing the statement of objections in order to be able, if necessary, to withdraw complaints or add new ones (judgments of 30 September 2003, Atlantic Container Line and Others v Commission, T‑191/98 and T‑212/98 to T‑214/98, EU:T:2003:245, paragraph 121, and of 9 April 2019, Qualcomm and Qualcomm Europe v Commission, T‑371/17, not published, EU:T:2019:232, paragraph 76).

262    In the light of the subdivision into two distinct and successive stages of the administrative procedure under Regulation No 1/2003, referred to in paragraph 159 above, the foregoing considerations apply all the more to the adoption, as in the present case, of a decision requesting information during the preliminary investigation stage, before the adoption of a statement of objections. In that regard, it should be recalled that the preliminary stage is intended to enable the Commission to gather all the relevant evidence confirming that there has or has not been an infringement of the competition rules and to adopt an initial position on the course which the procedure is to follow.

263    Therefore, the applicant cannot reasonably rely on an alleged risk that certain documents produced in response to the contested decision will be used by the Commission in order to broaden the scope of the current investigation or to initiate another investigation.

264    As regards, in the fourth place, the applicant’s arguments that documents not relevant to the investigation or containing data such as the personal data at issue could be disseminated more widely outside the Commission, it must be stated that those arguments concern hypothetical situations, such as possible requests for access to the file by third parties and the disclosure, on an allegedly automatic basis, of documents to courts, and that they are not substantiated.

265    It follows from the considerations set out in paragraphs 200 to 264 above that the applicant has not established that the contested decision constituted an unjustified interference with its privacy or that of members of its staff or of other persons. In those circumstances, the first part of the third plea must be rejected.

(b)    The second part of the third plea, alleging failure to observe the principle of proportionality

266    The applicant complains that the Commission failed to observe the principle of proportionality. It maintains that the failure to observe that principle is apparent from, first, the obligation on it to produce, in the context of the virtual data room, documents containing sensitive personal data, second, the obligation to produce, in the same context, documents containing both commercial and personal data, third, the existence of methods better protecting the privacy of individuals than the virtual data room in order to assess the relevance of the Protected Documents and, fourth, the inadequacy and ineffectiveness of the possibility of anonymising the documents at issue.

267    The Commission disputes the applicant’s arguments.

268    It must be observed that the principle of proportionality, which is one of the general principles of EU law, requires that measures adopted by EU institutions should not exceed the limits of what is appropriate and necessary in order to attain the objective pursued, and where there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued (see, to that effect, judgments of 13 November 1990, Fedesa and Others, C‑331/88, EU:C:1990:391, paragraph 13, and of 14 July 2005, Netherlands v Commission, C‑180/00, EU:C:2005:451, paragraph 103).

269    It is settled case-law that requests for information made by the Commission to an undertaking must comply with the principle of proportionality and that the obligation imposed on an undertaking to supply information should not be a burden on that undertaking which is disproportionate to the needs of the inquiry (judgments of 12 December 1991, SEP v Commission, T‑39/90, EU:T:1991:71, paragraph 51; of 14 March 2014, Cementos Portland Valderrivas v Commission, T‑296/11, EU:T:2014:121, paragraph 86; and of 9 April 2019, Qualcomm and Qualcomm Europe v Commission, T‑371/17, not published, EU:T:2019:232, paragraphs 120 and 121).

270    In the present case, first, the applicant relied on the workload entailed by a response to the contested decision being manifestly disproportionate only in relation to the redaction of the documents to which the virtual data room procedure applied. As has been pointed out in paragraph 243 above, redacting the names of the individuals concerned is an option available to the applicant, but it is not required of the applicant, with the result that it is entitled not to do so and that it is not justified in relying on a failure to observe the principle of proportionality in that regard. As regards anonymisation allegedly being inadequate, due to the low number of custodians concerned, which would make it simple to identify them in a given document, it should be recalled that the small number of custodians concerned constitutes evidence of observance of the principle of necessity of the information requested, in accordance with Article 18(1) of Regulation No 1/2003, and evidence of the needs of the investigation having been weighed against the protection of the applicant’s rights.

271    Second, the applicant relies on the possibility, which may constitute an alternative to the virtual data room provided for in the contested decision, that the documents containing sensitive personal data be identified and described in a document to be provided to the Commission, but without providing those documents themselves. According to the applicant, that practice makes it possible to avoid, first, Commission staff having access to the personal data in question by consulting documents in the virtual data room and, second, those documents having to undergo redaction of sensitive personal data contained in them before they are provided to the Commission.

272    As has been stated in paragraph 219 above, the virtual data room procedure established in the present case does not go beyond what is necessary in order to achieve the objectives of general interest which it pursues, in the light of the right to privacy of the applicant and the individuals concerned, as protected by Article 7 of the Charter.

273    Moreover, as is apparent from paragraph 238 above, the production of documents containing personal data which were not examined in the virtual data room procedure does not constitute an infringement of the right to privacy of the applicant and the individuals concerned.

274    It follows that the applicant has not established a failure to observe the principle of proportionality, with the result that the second part of the third plea must be rejected.

(c)    The third part of the third plea, alleging infringement of the right to good administration

275    The applicant maintains that the failure to review the relevance of the documents requested pursuant to the contested decision constitutes a manifest infringement of its right to good administration. In that regard, it recalls that the contested decision requires it to provide the Commission with many documents which are irrelevant to the investigation or contain personal data, including sensitive data.

276    The Commission disputes those arguments.

277    It should be pointed out that recital 37 of Regulation No 1/2003 states that the regulation ‘respects the fundamental rights and observes the principles recognised in particular by the Charter’ and that it ‘should be interpreted and applied with respect to those rights and principles’.

278    Article 41 of the Charter – which, under the first subparagraph of Article 6(1) TEU, has the same legal value as the Treaties – is entitled ‘Right to good administration’ and states, in paragraph 1, that ‘every person has the right to have his or her affairs handled impartially, fairly and within a reasonable time by the institutions, bodies, offices and agencies of the Union’.

279    According to the case-law on the principle of good administration, the guarantees afforded by the EU legal order in administrative procedures include, in particular, the duty of the competent institution to examine carefully and impartially all the relevant aspects of the individual case (judgments of 21 November 1991, Technische Universität München, C‑269/90, EU:C:1991:438, paragraph 14, and of 30 September 2003, Atlantic Container Line and Others v Commission, T‑191/98, T‑212/98 to T‑214/98, EU:T:2003:245, paragraph 404).

280    It must be held that, contrary to the applicant’s assertions in its reply to a question put by the Court, the arguments put forward in support of that part of the plea overlap in substance with those put forward in support of the second part of that plea, which themselves partly overlap with the arguments relied on in support of the second plea, alleging failure to observe the principle of necessity, and in support of the first part of the present plea.

281    Since all those arguments have already been rejected, it must be held that the applicant has not demonstrated that the Commission failed to carry out a diligent and impartial examination of the present case. Therefore, the applicant has failed to establish that the contested decision was vitiated by a failure to observe the principle of good administration.

282    Accordingly, the third part of the third plea must be rejected, as must, consequently, the third plea in its entirety.

283    It follows from all of the foregoing that the action must be dismissed in its entirety.

V.      Costs

284    Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. As the applicant has been unsuccessful, it must be ordered to bear its own costs and to pay those incurred by the Commission, including those incurred in the proceedings for interim relief.

285    Under Article 138(1) of the Rules of Procedure, the Member States which intervened in the proceedings are to bear their own costs. The Federal Republic of Germany must therefore bear its own costs.

On those grounds,

THE GENERAL COURT (Fifth Chamber, Extended Composition)

hereby:

1.      Dismisses the action;

2.      Orders Meta Platforms Ireland Ltd to bear its own costs and to pay those incurred by the European Commission, including those incurred in the proceedings for interim relief;

3.      Orders the Federal Republic of Germany to bear its own costs.

Papasavvas Spielmann Mastroianni

Brkan Gâlea

Delivered in open court in Luxembourg on 24 May 2023.

T. Henze S. Papasavvas

Acting Registrar President

*      Language of the case: English.

1 Confidential data omitted.