The Dutch Authority for Consumers and Markets' (ACM) digital inspection guidelines should be on every company's reading list. However, they should not be taken too literally; at least according to the recent ruling from the Court of Appeal in The Hague.
Even though the ACM, contrary to its own inspection guidelines, had not handed over the names of all the employees targeted for inspection, it should have been clear to the raided company that the ACM also wanted to collect and secure data from five former CEOs and CCOs. As a result, the ACM could use the data from these individuals, even though they were not explicitly mentioned, without it going against its own inspection guidelines.
The ACM's inspection guidelines provide that ACM officials should hand over the names of individuals targeted for inspection to the company subject to the dawn raid (Article 2.1(4)). Even though the ACM neglected to do this in respect of five former CEOs and CCOs, it nonetheless proceeded to collect data from these employees. The ACM claimed that it had selected the five former employees prior to the dawn raid, and that it had taken back-up tapes from the premises because the email boxes of these five individuals were no longer digitally available. Before taking these tapes, the ACM had verified with the company that the tapes did actually contain the email boxes of the five individuals.
The Court of Appeal found that the company had not sufficiently substantiated that the ACM had either taken the back-up tapes for other reasons, or simply taken them without any further explanation. It should therefore have been clear to the company that the five former CEOs and CCOs were part of the ACM's inspection. Different to the District Court's earlier ruling [see our November 2018 Newsletter], the Court of Appeal therefore ruled that the ACM had not violated its own inspection guidelines. Article 2.1(4) of the inspection guidelines aims to enable companies subject to dawn raids to determine the scope of their duty to cooperate and rights of defence. This determination is possible if it is clear to the company which individuals are targeted for data collection, even if these individuals were not explicitly mentioned before collecting their data.
Companies are therefore advised not only to read the ACM's inspection guidelines carefully, but also remain vigilant of other ways in which the ACM clarifies its inspection goals and factor these developments into their dawn raid response strategy.
This article was published in the Competition Law Newsletter of April 2019. Other articles in this newsletter: