26.8.2019

Official Journal of the European Union

C 287/1

Euro exchange rates (1)

23 August 2019

(2019/C 287/01)

1 euro =

	Currency	Exchange rate
USD	US dollar	1,1065
JPY	Japanese yen	117,79
DKK	Danish krone	7,4559
GBP	Pound sterling	0,90453
SEK	Swedish krona	10,7165
CHF	Swiss franc	1,0893
ISK	Iceland króna	138,10
NOK	Norwegian krone	9,9593
BGN	Bulgarian lev	1,9558
CZK	Czech koruna	25,769
HUF	Hungarian forint	328,58
PLN	Polish zloty	4,3550
RON	Romanian leu	4,7212
TRY	Turkish lira	6,3815
AUD	Australian dollar	1,6396
CAD	Canadian dollar	1,4741
HKD	Hong Kong dollar	8,6776
NZD	New Zealand dollar	1,7360
SGD	Singapore dollar	1,5360
KRW	South Korean won	1 341,19
ZAR	South African rand	16,8439
CNY	Chinese yuan renminbi	7,8439
HRK	Croatian kuna	7,3940
IDR	Indonesian rupiah	15 726,13
MYR	Malaysian ringgit	4,6362
PHP	Philippine peso	58,008
RUB	Russian rouble	72,9469
THB	Thai baht	33,997
BRL	Brazilian real	4,5224
MXN	Mexican peso	22,0041
INR	Indian rupee	79,3040

(1) Source: reference exchange rate published by the ECB.

26.8.2019

Official Journal of the European Union

C 287/2

Opinion of the Advisory Committee on mergers given at its meeting of 28 November 2018 concerning a preliminary draft decision relating to Case M.8797 — Thales/Gemalto

Rapporteur: Luxembourg

(2019/C 287/02)

Concentration

The Advisory Committee (10 Member States) agrees with the Commission that the notified transaction constitutes a concentration within the meaning of Article 3(1)(b) of the Council Regulation (EC) No 139/2004 of 20.1.2004 on the control of concentrations between undertakings (1).

The Advisory Committee (10 Member States) agrees with the Commission that the notified transaction has an EU dimension pursuant to Article 1(2) of the Merger Regulation.

Market definition

The Advisory Committee (10 Member States) agrees with the Commission’s definitions of the relevant product and geographic markets in the draft Decision.

In particular, the Advisory Committee (10 Member States) agrees that the following product markets should be distinguished:

a)	General Purpose Hardware Security Modules (‘HSMs’);

b)	Payment HSMs;

c)	Network encryptors and the narrowest possible sub-segment for data in motion at Layer 2;

d)	The manufacture and supply of SIM cards (upstream) and GSM-R integration (downstream);

e)	OTA SIM card administration platforms and GSM-R integration;

f)	Access control smart cards for use in remote HSM administration (upstream) and the downstream markets for GP HSMs and Payment HSMs (downstream).

The Advisory Committee (10 Member States) agrees with the Commission’s definitions of the relevant geographic markets in relation to:

a.	The EEA-wide or worldwide market for GP HSMs;

b.	The EEA-wide or worldwide market for Payment HSMs;

c.	The potential EEA-wide market for network encryptors and the narrowest possible sub-segment for data in motion at Layer 2;

d.	The upstream EEA-wide market for the manufacture and supply of SIM cards and the downstream national or EEA-wide market for GSM-R integration;

e.	The upstream EEA-wide market for OTA SIM card administration platforms and the downstream national or EEA-wide market for GSM-R integration;

f.	The upstream EEA-wide market for access control smart cards for use in remote HSM administration and the downstream markets for GP HSMs and Payment HSMs.

Competitive assessment

The Advisory Committee (10 Member States) agrees with the Commission's assessment that the notified transaction would to give rise to horizontal non-coordinated effects that would significantly impede effective competition on the market for General Purpose HSMs in the EEA or worldwide mainly due to the removal of the important competitive constraints that Thales and Gemalto exerted upon each other, together with the very limited number of credible alternative competitors.

The Advisory Committee (10 Member States) agrees with the Commission's assessment that the notified transaction would not significantly impede effective competition in view of its effects on the following affected markets:

a.	The EEA-wide or worldwide market for Payment HSMs;

b.	The EEA-wide or worldwide market for market for network encryptors and the narrowest possible sub-segment for data in motion at Layer 2;

c.	The upstream EEA-wide market for the manufacture and supply of SIM cards and the downstream national or EEA-wide market for GSM-R integration;

d.	The upstream EEA-wide market for OTA SIM card administration platforms and the downstream national or EEA-wide market for GSM-R integration;

e.	The upstream EEA-wide market for access control smart cards for use in remote HSM administration and the downstream markets for GP HSMs and Payment HSMs.

Remedy

The Advisory Committee (10 Member States) agrees with the Commission that the commitments offered by the Notifying Parties on 9 November 2018 pursuant to Article 8(2) of the Merger Regulation address the competition concerns identified by the Commission on the EEA-wide or worldwide market for General Purpose HSMs.

The Advisory Committee (10 Member States) agrees with the Commission's conclusion that the notified transaction, subject to the full compliance with the commitments offered by the Notifying Parties on 9 November 2018, is not likely to significantly impede effective competition in the internal market or in a substantial part of it.

10.

The Advisory Committee (10 Member States) agrees with the Commission that the notified transaction must therefore be declared compatible with the internal market in accordance with Articles 2(2) and 8(2) of the Merger Regulation and Article 57 of the EEA Agreement.

(1) OJ L 24, 29.1.2004, p. 1 (‘the Merger Regulation’).

26.8.2019

Official Journal of the European Union

C 287/5

Summary of Commission Decision

of 11 December 2018

declaring a concentration compatible with the internal market and the functioning of the EEA Agreement

(Case M.8797 — Thales/Gemalto)

(notified under document C(2018) 222)

(Only the English version is authentic)

(Text with EEA relevance)

(2019/C 287/04)

On 11 December 2018 the Commission adopted a Decision in a merger case under Council Regulation (EC) No 139/2004 of 20 January 2004 on the control of concentrations between undertakings (1) , and in particular Article 8(1) of that Regulation. A non-confidential version of the full Decision, as the case may be in the form of a provisional version, can be found in the authentic language of the case on the website of the Directorate-General for Competition, at the following address: http://ec.europa.eu/comm/competition/index_en.html

I. THE PROCEDURE

(1)

On 18 June 2018, the European Commission (‘Commission’) received notification of a concentration pursuant to Article 4 of the Merger Regulation (2) by which Thales S.A. (‘Thales’ or the ‘Notifying Party’, France) acquires within the meaning of Article 3(1)(b) of the Merger Regulation sole control of Gemalto N.V. (‘Gemalto’, Netherlands) (the ‘Transaction’) (3). Thales and Gemalto are hereinafter collectively referred to as the ‘Parties’.

(2)

After a preliminary examination of the notification and based on the first phase market investigation, the Commission concluded that the Transaction raised serious doubts as to its compatibility with the internal market as regards the market for Hardware Security Modules (‘HSM’) and adopted a decision to initiate proceedings pursuant to Article 6(1)(c) of the Merger Regulation on 23 July 2018 (the ‘Article 6(1)(c) Decision’).

(3)

On 26 July 2018, the second phase investigation period was extended by 20 working days at the request of the Notifying Party pursuant to the first sentence of the second subparagraph of Article 10(3) of the Merger Regulation.

(4)

On 21 August 2018, the Notifying Party submitted its written comments to the Article 6(1)(c) Decision (the ‘Article 6(1)(c) Response’).

(5)

On 10 October 2018, the Notifying Party submitted commitments pursuant to Article 8(2) of the Merger Regulation in order to address the competition concerns identified by the Commission.

(6)

On 7 November 2018, the Notifying Party submitted revised commitments pursuant to Article 8(2) of the Merger Regulation in order to address the competition concerns identified by the Commission.

II. THE PARTIES AND THE TRANSACTION

(7)

Thales is an international group registered in France and listed on the Euronext Stock Exchange in Paris. Thales is active globally in five main areas: (i) aeronautics; (ii) space; (iii) ground transportation; (iv) defence; and (v) security. In 2017, it had global revenues of EUR 15,8 billion, operations in 56 countries and 64 100 employees.

(8)

Gemalto is an international digital security company registered in the Netherlands and listed on the Euronext Stock Exchange in Paris and Amsterdam. Gemalto is active globally in six main areas: (i) mobile platforms & services; (ii) mobile embedded software & products; (iii) payment; (iv) government programs; (v) machine to machine (Internet of Things or ‘IoT’); and (vi) enterprise security. Gemalto was formed in 2006 as a result of the combination of Axalto Holding N.V. and Gemplus International S.A. In 2017, Gemalto had global revenues of approximately EUR 3 billion, operations in 47 countries and 15 000 employees.

(9)

According to a merger agreement (the ‘Merger Agreement’) entered into on 17 December 2017, Thales will acquire all issued and outstanding ordinary shares and American depository shares in Gemalto by way of a recommended full public offer governed by Dutch law, which will be extended in particular to France and the U.S. The offer is subject to the satisfaction or waiver of customary conditions, including but not limited to: (i) regulatory approvals; (ii) a minimum acceptance level of at least 67 % of Gemalto shares; (iii) no material adverse effect having occurred; (iv) no material breach of the Merger Agreement having occurred; and (v) no superior offer having been made or agreed upon.

(10)

Therefore, the Transaction would result in a concentration within the meaning of Article 3(1)(b) of the Merger Regulation.

III. EU DIMENSION

(11)

The Transaction has an EU dimension within the meaning of Article 1(2) of the Merger Regulation.

IV. THE RELEVANT MARKETS

(12)

The Decision identifies the following relevant markets: General Purpose (GP) HSMs, Payment HSMs, Encryption Software, network encryptors for data in motion, SIM card manufacturing and supply, and OTA SIM cards administration platform.

a. GP HSMs and Payment HSMs

(13)

Following the results of the market investigation in Phase I and II, the Commission considers that there is a separate market for GP HSMs and Payment HSMs.

(14)

As regards demand side substitutability, there is no demand-side substitutability since (i) GP and Payment HSMs are designed and certified for different use cases, (ii) GP and Payment HSMs are technically very different, (iii) GP and Payment HSMs have different commercial propositions, (iv) differentiated pricing between GP and Payment HSMs reflect their different functionalities/propositions, (v) customers of GP and Payment HSMs have different purchasing patterns.

(15)

As regards supply side substitutability, there is no supply-side substitutability since (i) GP and Payment HSM designs involve different technologies, (ii) suppliers of GP and payment HSMs undergo different certification process, (iii) GP and Payment HSM competitors are different, (iv) competitors active in GP or Payment HSMs could not easily or quickly switch to supplying the other HSM type in response to a price increase.

(16)

The Commission’s investigation provided further confirmation that GP and Payment HSMs are designed differently, both when it comes to hardware and software. While the differences in hardware might not be as clear-cut (Securosys claims that it could start building a Payment HSM based on its GP HSM platform; similarly Futurex considers that the differences are rather with the firmware than hardware), it is the software which constitutes the significantly bigger part of the investment effort and which appears to be clearly different to serve distinct use cases. To obtain PCI certification, Payment HSMs must meet inter alia strict physical and logical security requirements. The fact that most cases of expansion from one HSM market to another in recent years took place through acquisitions supports the argument that developing the other type of HSMs when already manufacturing one of them is not easy.

(17)

As regards the geographic market definition, the Commission considers that for each of GP and Payment HSMs it is at least EEA-ide or worldwide but can be left open for the purposes of this case as the competitive assessment does not change for the different geographic levels.

b. Other relevant product markets

(18)

The Commission also assessed possible markets for encryption software (ES), Security evaluation services, SIM Cards and OTA SIM Administration, and Access control smart cards.

(19)

Encryption Software: the Commission considered whether (i) encryption software can be further split into segments for data in use, data at rest, and data in motion, as well as further possible sub-segmentations based on the level and layers of encryption, and (ii) network encryptors for data in motion could form a separate market. For the purposes of the present Decision, the exact product market definition can be left open as the Transaction would not significantly impede effective competition under any plausible market definition, including the narrowest possible markets for (i) ES for data at rest/in use and possible further sub-segments by level of encryption (at the storage/disk, file/folder, database or application level, tokenisation and data masking etc.) and (ii) network encryptors for data in motion and possible sub-segments based on the layer on which the network encryption takes place. Regarding the relevant geographic market for ES and network encryptors, the Commission considered that the market is global or at least EEA-wide.

(20)

Security evaluation services: the Commission considered the question whether the product market consists of all (cyber) security evaluation services or whether separate markets exist for any segmentation of these services based on the certification for which the lab was accredited, and concluded that the market can be left open as the Transaction would not significantly impede effective competition under any plausible market definition, including the narrowest possible market for CSPN security evaluation services. The question whether the geographic market for (cyber) security evaluation services is global or EEA-wide can be left open.

(21)

SIM Cards and OTA SIM Administration: the Commission in line with its decisional practice confirms that the relevant product market is the market for the provision of OTA SIM card administration and services platforms. The Commission leaves open the question whether the market for the manufacture and supply of SIM cards constitutes a separate market and whether GSM-R integration constitutes a separate market as the Transaction would not significantly impede effective competition under any plausible market definition, including the narrowest possible market for the manufacture and supply of SIM cards and GSM-R integration. The relevant geographic market for (i) the manufacture and supply of SIM cards, (ii) OTA SIM card administration and services platform is at least EEA-wide, if not global. Regarding GSM-R integration, the Commission considers that the market is EEA-wide or global in scope.

(22)

Access control smart cards: the exact product market definition can be left open as the Transaction would not significantly impede effective competition under any plausible market definition, including the narrowest possible market including for (i) physical and (ii) logical access control microprocessor chip cards. The exact geographic market definition can be left open.

V. COMPETITIVE ASSESSMENT

(23)

The Commission’s competitive assessment is based on all qualitative and quantitative evidence on the case file, in particular the results of the market investigation, the Parties’ own internal documents, the market reconstruction, as well as targeted interviews with market participants.

(24)

The Transaction gives rise to the following horizontally affected markets:

(1)	The market for GP HSMs

(2)	The market for Payment HSMs

(3)	The potential market for network encryptors and the narrowest possible sub-segment for data in motion at Layer 2 at the EEA-wide market

(25)

The Transaction gives rise to vertically affected markets in relation to the links between the following markets:

(1)	The upstream EEA market for the manufacture and supply of SIM cards (where Gemalto’s market share is [30-40] %) and the downstream national or EEA-wide market for GSM-R integration.

(2)	The upstream EEA market for OTA SIM card administration platforms (where Gemalto’s market share is around [40-50] %) and the downstream national or EEA-wide market for GSM-R integration.

a. GP HSMs

(26)

According to the Commission’s market reconstruction, Thales and Gemalto have a combined market share for 2017 of [70-80] % for GP HSMs (Thales: [30-40] %; Gemalto: [30-40] %). This figure of 70-80 % is confirmed by other market participants.

(27)

The market investigation confirmed that Thales and Gemalto are each other’s closest competitor. Both Parties appear to play a role as an important competitive force in the market. Both Thales and Gemalto offer product with very similar features, most importantly both Thales’ and Gemalto’s GP HSMs are programmable. Both Parties significantly invest in R&D. There is only a limited number of alternative GP HSM providers whose role and market shares are significantly lower than those of the Parties. Apart from Gemalto, only one other player is seen as a legitimate competitor to Thales.

(28)

Regarding the constraint exerted by Cloud Service Providers (CSPs), the Commission considers that demand for on-premise HSMs will remain. The market investigation in Phase I and Phase II has shown that, despite the expected growth of the cloud, cloud-based solutions are still in their infancy and only affect new applications as legacy applications remain tied to the existing on-premise HSM-based infrastructure. Demand for on-premise HSMs will remain both due to legacy issues as well as due to reasons of trust and the need to ensure maximum security for the keys and the encrypted data.

(29)

Traditional HSM manufacturers such as Thales, Gemalto and Utimaco appear to be the leaders in developing one-stop shop solutions suitable for customers who wish to share data (and therefore access to encryption keys) across on-premise and cloud environments. According to the Parties, Thales and Gemalto pursued complementary paths, whereby Gemalto introduced its Data Protection on Demand (DPoD) offering focused on HSM/KMS aaS and Thales focused on key portability with Bring Your Own Key (BYOK). Both solutions are meant to facilitate customers’ operations across multiple clouds.

(30)

The Commission considers that the Transaction would give rise to a significant impediment of effective competition in relation to the at least EEA-wide market for GP HSMs.

b. Payment HSMs

(31)

Gemalto’s market share in the EEA market for Payment HSMs is [5-10] % for 2017. Thales is the main player in this market whereas Gemalto holds a significantly lower market share and has generated very low revenues in the EEA which have been steady in the last three years.

(32)

The Commission considers that Thales and Gemalto are not close competitors in this market.

(33)

The Commission considers that post-Transaction the merged entity would continue to face strong competition from the remaining Payment HSMs manufacturers such as Atos, DocuSign, Futurex, MicroFocus, Prism, Realsec, Ultra Electronics, and Utimaco.

(34)

In view of the above, the Commission considers that the Transaction would not give rise to non-coordinated horizontal effects on the at least EEA-wide market for Payment HSMs.

c. Network Encryptors

(35)

The Parties’ combined market share is [20-30] % (Thales [0-5] %) in the EEA and [30-40] % worldwide (Thales [0-5] %). Thales’ and Gemalto’s current activities on the market for network encryptors and the narrowest hypothetical market for Layer 2 network encryptors are very limited. The network encryption space at Layer 2 represents a very small portion of the network encryption market which is very competitive, including many players offering stand-alone network encryptor products. The market investigation strongly indicated that respondents are neutral as regards the impact on the market for ES, irrespective of the exact product and geographic market definition. In view of the above, the Commission takes the view that the Transaction would not significantly impede effective competition in relation to this market.

d. Non-horizontal overlaps

(36)

With regard to (i) Gemalto’s activities in the upstream market for manufacturing and supply of SIM cards and Thales’ activities on the downstream market for GSM-R integration and (ii) Gemalto’s activities in the upstream market for the supply of OTA SIM cards administration platforms and Thales’ activities on the downstream market for GSM-R integration, the Commission considers that the Transaction would not significantly impede effective competition.

e. Conclusion

(37)

The Decision, therefore, concludes that the Transaction would give rise to a significant impediment of effective competition in relation to the at least EEA-wide market for GP HSMs.

VI. UNDERTAKINGS SUBMITTED BY THE PARTIES

(38)

In order to address the aforementioned competition concerns in the market for GP HSMs, the Parties have submitted the undertakings described below.

(39)

Commitments consist of the divestment of Thales’ global GP HSM business, marketed under the nShield brand (the ‘Divestment Business’). The Divestment Business is currently integrated into Thales eSecurity, a business unit operating activities in data protection, including GP HSMs, Payment HSMs, Key Management, and Encryption Software.

(40)

The main tangible assets forming part of the transfer are: sites (in the form of lease agreements), as well as all finished goods inventory, supplies tooling, test equipment, sales and promotional material, product documentation, and user manuals relating to the Divestment Business.

(41)

As regards intangible assets, the Divestment Business will include a transfer, or license (as appropriate), of the following main intangible assets: (i) all registered nShield trademarks and patents; (ii) all additional unregistered intellectual property including know-how, testing procedures, manufacturing procedures, product design, trade secrets, source code, and associated utilities and libraries (including product specifications and quality control standards); (iii) all nShield product SKUs listed in the nShield price list; (iv) an assignment of the section of any and all inbound licenses that are necessary for the operation (or otherwise used by) the Divestment Business; (v) all documentation associated with R&D for products currently marketed (or intended to be marketed) under the nShield brand.

(42)

With regard to the purchaser criteria, the standard purchaser criteria text is supplemented by an additional criterion that the ‘Purchaser shall be a player with significant experience in the HSM, or a closely related field, such as data security, enjoying a high level of trust and a good reputation in these areas among EEA-based customers. The Purchaser shall show by way of a business plan, at the Purchaser approval stage, that it has the ability and expertise, in using its own and the Divestment Business’ assets, to reliably provide the relevant products and services to EEA customers, even for enterprise grade security applications and that it has sufficiently concrete plans to undertake (i) all necessary steps to achieve and continue achieving all certifications, and their updates, necessary to supply GP HSMs in the EEA; and (ii) the required R&D for the further development of the Divestment Business.’

(43)

The Commission considers that the scope of the Divestment Business is sufficiently comprehensive as the Commitments would remove the entire overlap between the Parties in relation to the worldwide market for GP HSM. In principle, they are therefore suitable to remove the competition concerns identified. The Divestment Business comprises all assets and most of the staff that today contribute to the operations of the GP HSM business and so it is sufficiently comprehensive as it includes all the assets necessary for its viability and competitiveness.

(44)

In the Decision, the Commission considers that the Commitments are capable of removing serious doubts as to the compatibility of the Transaction with the internal market in a clear-cut manner.

VII. CONCLUSION AND PROPOSAL

(45)

The Decision concludes that, subject to full compliance with the undertakings given by the Parties, the Transaction will not significantly impede effective competition in the internal market or in a substantial part of it.

(46)

Consequently, the Decision declares the Transaction compatible with the internal market, in accordance with Articles 2(2) and Article 8(2) of the Merger Regulation.

(1) OJ L 24, 29.1.2004, p. 1.

(2) OJ L 24, 29.1.2004, p. 1. With effect from 1 December 2009, the Treaty on the Functioning of the European Union (‘TFEU’) has introduced certain changes, such as the replacement of ‘Community’ by ‘Union’ and ‘common market’ by ‘internal market’. The terminology of the TFEU will be used throughout this summary.

(3) OJ C 222, 26.6.2018, p. 19.

		ISSN 1977-091X
Official Journal of the European Union		C 287

English edition	Information and Notices	Volume 62 26 August 2019

Contents		page
	IV Notices
	NOTICES FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES
	European Commission
2019/C 287/01	Euro exchange rates	1
2019/C 287/02	Opinion of the Advisory Committee on mergers given at its meeting of 28 November 2018 concerning a preliminary draft decision relating to Case M.8797 — Thales/Gemalto — Rapporteur: Luxembourg	2
2019/C 287/03	Final Report of the Hearing Officer — Thales/Gemalto (M.8797)	4
2019/C 287/04	Summary of Commission Decision of 11 December 2018 declaring a concentration compatible with the internal market and the functioning of the EEA Agreement (Case M.8797 — Thales/Gemalto) (notified under document C(2018) 222) ( 1 )	5

	V Announcements
	PROCEDURES RELATING TO THE IMPLEMENTATION OF COMPETITION POLICY
	European Commission
2019/C 287/05	Prior notification of a concentration (Case M.9471 — Clearlake/TA/DigiCert) — Candidate case for simplified procedure ( 1 )	10
2019/C 287/06	Prior notification of a concentration (Case M.9518 — CPPIB/EQT/BNVC Group Holdings) — Candidate case for simplified procedure ( 1 )	12