12

By application lodged at the Court Registry on 28 April 2017, the applicants brought the present action.

13

By document lodged at the Court Registry on 28 July 2017, the Council of the European Union applied for leave to intervene in the present proceedings in support of the form of order sought by the Commission. By decision of 22 September 2017, the President of the Ninth Chamber of the Court granted that leave. The Council lodged its statement in intervention and the main parties lodged their observations on that statement within the prescribed periods.

14

In the application, the applicants claim that the Court should:

15

In the reply, the applicants stated, with regard to their head of claim relating to the decisions of 9 February 2017, that they sought, principally, that those decisions be declared non-existent on account of their lack of proper notification and, in the alternative, that they be annulled.

16

The Commission, supported by the Council, contends that the Court should:

…

30

It must be held that the fourth head of claim seeks the annulment, first, of the alleged Commission decision to seize and copy data relating to the private life of certain of the applicant’s employees and managers and, second, of a decision rejecting the request submitted by the applicants for those data to be returned (see the fourth indent of paragraph 14, above).

31

As the application and the reply make plain, and as the Commission’s written pleadings confirm, the first part of that head of claim may be interpreted as directed against a refusal to protect the confidentiality of the private data in question.

32

As regards the applicants’ interest in bringing proceedings against that refusal, contested by the Commission, it must be pointed out that, by virtue of the obligation of every undertaking to ensure the protection of the persons whom it employs and their private life (see, in particular, with regard to the obligation to protect the privacy of natural persons when processing personal data, Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), replaced by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1)), an inspected undertaking may decide to ask the Commission not to seize, from the undertaking’s premises, data that may infringe the privacy of its employees or managers or to request the Commission to return those data. In such circumstances, such requests are not solely limited to those members of staff concerned, as the Commission wrongly submits. For the same reason, that undertaking may be regarded as having an interest in challenging the Commission’s refusal to grant its requests before the Courts of the European Union.

33

As to whether the refusal to protect the confidentiality of the private data in question is a challengeable act, it must be recalled that, according to settled case-law, measures the legal effects of which are binding on, and capable of affecting the interests of, the applicant by bringing about a distinct change in his legal position are acts which may be the subject of an action for annulment under Article 263 TFEU. In principle, an intermediate measure intended to pave the way for the final decision is not a challengeable measure (see, to that effect, judgments of 11 November 1981, IBM v Commission, 60/81, EU:C:1981:264, paragraphs 9 and 10, and of 14 November 2012, Nexans France and Nexans v Commission, T‑135/09, EU:T:2012:596, paragraphs 115 and 116).

34

In the specific context of a Commission inspection and more generally of competition proceedings, review by the Courts of the way in which an inspection was conducted falls, as a general rule, within the scope of an action for the annulment of the final decision adopted by the Commission under that provision (see judgment of 14 November 2012, Nexans France and Nexans v Commission, T‑135/09, EU:T:2012:596, paragraph 132 and the case-law cited).

35

However, it is also apparent from the case-law that acts adopted in the course of the preparatory procedure which were themselves the culmination of a special procedure distinct from that intended to permit the Commission to take a decision on the substance of the case and which produce binding legal effects such as to affect the interests of an applicant, by bringing about a distinct change in his legal position, also constitute challengeable measures (judgments of 11 November 1981, IBM v Commission, 60/81, EU:C:1981:264, paragraphs 10 and 11, and of 14 November 2012, Nexans France and Nexans v Commission, T‑135/09, EU:T:2012:596, paragraph 116).

36

It has thus been held, in the context of competition proceedings, that a Commission decision rejecting a request for the protection of a particular document on the basis of legal professional privilege between lawyers and their clients brought to an end a special procedure distinct from that which was intended to enable the Commission to rule on the existence of an infringement of the competition rules and thus constituted an act capable of being challenged by an action for annulment (see judgment of 17 September 2007, Akzo Nobel Chemicals and Akcros Chemicals v Commission, T‑125/03 and T‑253/03, EU:T:2007:287, paragraphs 46, 48 and 49 and the case-law cited).

37

Similarly, although the Courts of the European Union have not, to date, declared such an action admissible, it may be considered that the General Court has accepted the possibility of an action being brought under the same conditions by an inspected undertaking against a decision refusing a request for protection of the privacy of members of its staff. After having referred to the judgment of 17 September 2007, Akzo Nobel Chemicals and Akcros Chemicals v Commission (T‑125/03 and T‑253/03, EU:T:2007:287 and the case-law cited), the General Court, while evoking the possibility of a ‘decision withholding … protection [of privacy]’, found that such a decision had not been adopted in that case. In order to do so, it relied on the fact that the applicants had neither claimed at the time of the adoption of the decision to copy the data in question that documents belonging to them were eligible for protection similar to that conferred on the confidentiality of communications between lawyers and their clients, nor identified the specific documents or parts of documents in question (judgment of 14 November 2012, Nexans France and Nexans v Commission, T‑135/09, EU:T:2012:596, paragraphs 129 and 130).

38

In the present case, the applicants allege that the refusal referred to in the first part of the fourth head of claim of their application could be treated in the same way as the refusal which was regarded as constituting a challengeable act under that case-law.

39

It is true that where an undertaking objects to the seizure of computer hardware or communication devices and the copying of data held thereon during an inspection on the basis of the right to privacy of its employees and managers, a decision by the Commission refusing that request produces legal effects on that undertaking which bring about a distinct change in its legal position (see paragraph 37 above). That decision affects the conditions in which it ensures the protection of the persons it employs and their privacy. Furthermore, such a decision denies it the benefit of the restriction of the inspection to ‘the books and other records related to the business’, which is required both by Article 20(2)(b) of Regulation No 1/2003 and the case-law (see judgment of 6 September 2013, Deutsche Bahn and Others v Commission, T‑289/11, T‑290/11 and T‑521/11, EU:T:2013:404, paragraph 80 and the case-law cited).

40

In that regard, it should be noted that, in paragraphs 51 and 52 of the judgment of 17 September 2007, Akzo Nobel Chemicals and Akcros Chemicals v Commission (T‑125/03 and T‑253/03, EU:T:2007:287), the Court found that, in a situation where the Commission had received a claim for protection pursuant to a right provided for under EU law before it copied certain documents, a tacit rejection decision was expressed through the physical act of copying and placing those documents on file.

41

However, in the present case, the applicants did not claim, prior to the adoption of the contested decisions, that the devices seized and the data copied by the Commission should benefit from protection under the right to privacy of their employees and managers. It was after those data had been copied and the devices likely to contain such data had been returned – that is to say, on 24 February and then 13 April 2017 – that the applicants claimed that the data in question should be protected under the right to privacy of their employees and managers.

42

In that respect, it may be noted that the right to effective judicial protection is not prejudiced by requiring the undertaking addressed by an inspection decision to take certain steps to preserve its rights and its access to remedies to ensure compliance with those rights, in particular the step of requesting the Commission for protection (see paragraphs 36, 37, 40 above). This is all the more so as the Commission is bound to grant the undertaking a short period to consult its lawyers for the purposes of submitting such requests before copies are made (see, to that effect, judgment of 6 September 2013, Deutsche Bahn and Others v Commission, T‑289/11, T‑290/11 and T‑521/11, EU:T:2013:404, paragraph 89).

43

It follows, in the present case, that the Commission was not in a position to adopt a decision rejecting such a demand for protection by the applicants when it seized the devices in question and copied the data which they contained.

44

The present case can therefore be distinguished from the case which gave rise to the judgment of 17 September 2007, Akzo Nobel Chemicals and Akcros Chemicals v Commission (T‑125/03 and T‑253/03, EU:T:2007:287). In the absence of a prior request for protection by the applicants, the seizure of the devices at issue and the copying of the data held on those devices could not result in a challengeable decision by which the Commission rejected, even implicitly, such a request for protection (see, to that effect, judgment of 14 November 2012, Nexans France and Nexans v Commission, T‑135/09, EU:T:2012:596, paragraphs 120 to 125).

45

Consequently, the applicants cannot claim, in the circumstances of this case, that, on the date on which the present action was brought, the Commission had, explicitly or implicitly, in the course of the inspection, adopted an act producing legal effects capable of affecting their interests by bringing about a distinct change in their legal situation.

46

It may be added that the same would be true if the first part of the fourth head of claim were to be interpreted as referring merely to a decision by the Commission to seize and copy data relating to the private life of certain employees and managers of the applicants. As is apparent from paragraph 44 above, in the absence of a prior request for protection from the applicants, the physical acts of seizure and copying performed in the present case during the inspection at issue could not, as such, give rise to challengeable measures.

47

As regards the second part of the fourth head of claim, directed against the alleged rejection of the request for return of the private data in question, it should be noted that that request, whether dated 24 February 2017 (as the applicants have submitted in their written pleadings) or 13 April 2017 (as stated at the hearing) was not couched in sufficiently precise terms to enable the Commission to state its views effectively, with the result that on the date when the present action was filed – which should be taken into account when determining its admissibility (see, to that effect, judgments of 3 December 2014, Castelnou Energía v Commission, T‑57/11, EU:T:2014:1021, paragraph 34, and of 22 June 2016, Whirlpool Europe v Commission, T‑118/13, EU:T:2016:365, paragraph 49) – the applicants had not received a response from the Commission capable of constituting a challengeable measure. The applicants have merely mentioned ‘numerous documents infringing the privacy of their authors’, referring in general terms to ‘personal messages, address books, telephone calls, etc.’ and admitting in their application of 13 April 2017 that they were ‘currently analysing the many documents copied by the Commission’s staff’ so as to determine which had been affected by that infringement.

48

Both parts of the fourth head of claim must therefore be rejected as inadmissible.

…

On those grounds,

THE GENERAL COURT (Ninth Chamber, Extended Composition)

hereby: