Short Reads

Don't take the ACM's digital inspection guidelines too literally

Don't take the ACM's digital inspection guidelines too literally

Don't take the ACM's digital inspection guidelines too literally

04.04.2019 NL law

The Dutch Authority for Consumers and Markets' (ACM) digital inspection guidelines should be on every company's reading list. However, they should not be taken too literally; at least according to the recent ruling from the Court of Appeal in The Hague.

Even though the ACM, contrary to its own inspection guidelines, had not handed over the names of all the employees targeted for inspection, it should have been clear to the raided company that the ACM also wanted to collect and secure data from five former CEOs and CCOs. As a result, the ACM could use the data from these individuals, even though they were not explicitly mentioned, without it going against its own inspection guidelines.

The ACM's inspection guidelines provide that ACM officials should hand over the names of individuals targeted for inspection to the company subject to the dawn raid (Article 2.1(4)). Even though the ACM neglected to do this in respect of five former CEOs and CCOs, it nonetheless proceeded to collect data from these employees. The ACM claimed that it had selected the five former employees prior to the dawn raid, and that it had taken back-up tapes from the premises because the email boxes of these five individuals were no longer digitally available. Before taking these tapes, the ACM had verified with the company that the tapes did actually contain the email boxes of the five individuals.

The Court of Appeal found that the company had not sufficiently substantiated that the ACM had either taken the back-up tapes for other reasons, or simply taken them without any further explanation. It should therefore have been clear to the company that the five former CEOs and CCOs were part of the ACM's inspection. Different to the District Court's earlier ruling [see our November 2018 Newsletter], the Court of Appeal therefore ruled that the ACM had not violated its own inspection guidelines. Article 2.1(4) of the inspection guidelines aims to enable companies subject to dawn raids to determine the scope of their duty to cooperate and rights of defence. This determination is possible if it is clear to the company which individuals are targeted for data collection, even if these individuals were not explicitly mentioned before collecting their data.

Companies are therefore advised not only to read the ACM's inspection guidelines carefully, but also remain vigilant of other ways in which the ACM clarifies its inspection goals and factor these developments into their dawn raid response strategy.

 

 

This article was published in the Competition Law Newsletter of April 2019. Other articles in this newsletter:

Team

Related news

02.07.2020 NL law
New competition tool: something old, something new, something borrowed

Short Reads - Large online platforms may face more regulatory obligations, whilst non-dominant companies’ unilateral conduct may soon be curbed. The European Commission intends to tool up its kit by adding a new regulation to keep digital gatekeepers in check, as well as providing more clarity on how to define digital markets in its new Market Definition Notice.

Read more

02.07.2020 NL law
European Commission to pull the strings of foreign subsidies

Short Reads - The European Commission is adding powers to its toolbox to ensure a level playing field between European and foreign(-backed) companies active on the EU market. On top of merger control and Foreign Direct Investment screening obligations, companies may also need to account for future rules allowing scrutiny of subsidies granted by non-EU governments if those subsidies might distort the EU Single Market.

Read more

29.06.2020 NL law
European Banking Federation Guidance on testing of Cloud Exit Strategy

Short Reads - Financial institutions may outsource critical or important functions to cloud service providers (“CSPs”). On 25 February 2019 the European Banking Authority (“EBA”) provided guidelines (the “EBA Guidelines”) laying out the framework for outsourcing arrangements. The EBA Guidelines require institutions to have a comprehensive, documented and sufficiently tested exit strategy (including a mandatory exit plan) when they outsource critical or important functions.

Read more