“E-raids”: EGC emphasises the central role of IT in dawn raids

 

The General Court of the European Union (EGC) confirmed a fine imposed by the European Commission in 2012 on the basis of Art. 23 para. 1 Regulation 1/2003 for not submitting to a cartel investigation (judgment ECLI:EU:T:2014:995 of 26 November 2014).

Undertakings must submit to investigation

The Commission imposed a fine of 2.5 million Euros because of a number of incidents which had occurred in the course of the inspection carried out by the Commission, such as an e-mail account not being blocked as ordered and incoming e-mails being diverted to the company server. According to the Commission, the company thereby breached the obligation under Art. 20 para. 4 Regulation 1/2003. According thereto, undertakings must submit to inspections ordered by decision of the Commission. A breach of this obligation arises in the view of the Commission if the investigative measures of the Commission are delayed or prevented. These investigative measures include the blocking of e-mail accounts of specific employees during the inspection for the purpose of securing evidence.

In the actual case, the Commission ordered the blocking (i.e. the change of passwords and the issue of passwords known only to the Commission representatives) of four e-mail accounts. The external IT department complied with that order. One of the employees affected by the blockage at the time worked from home and complained that his e-mail access no longer functioned. An employee of the IT department not knowing about the ongoing investigation and the e-mail blockage, restored the password and thereby allowed access by the employee to the originally blocked account. In addition, the executive director of one of the companies on the second day of the inspection ordered the IT department to prevent the e-mails addressed to the accounts of the four persons holding key positions from arriving in their respective inboxes. The e-mails should rather be retained on the company server. He did this without consultation with the Commission representatives who noted this only 24 hours later.

Responsibility to promptly inform employees in the IT-departement about dawn raid and obligations

With regard to the “release” of the blockage, the applicants argued, that the investigative measures were not deliberately or negligently obstructed by the employees who took action. The court did not accept this, stating that the lack of knowledge of the relevant employee is irrelevant. It was the duty of the head of IT to promptly inform his subordinates of the inspection and instruct them of the associated obligations as well as to ensure that these obligations were complied with.

With regard to the diversion of incoming e-mails, it was the undertakings’ position that the data on the company server were not manipulated or deleted and that, in addition, only a few irrelevant e-mails were affected by the diversion. The court rejected this argument as unfounded because for the purposes of applying Art. 23 para. 1 Regulation 1/2003 it was sufficient for the diverted e-mails to be covered by the inspection decision - the quantity or significance of the e-mails was irrelevant.  

Dawn Raid training for both internal and external IT departments

In light of this judgment, which affects aspects similar to the well-known Breach-of-Seal-judgment against E.ON (“negligent breakage of a seal” by a cleaning company, 22 November 2012, ECLI:EU:C:2012:738), it is indicated for undertakings to account for the increasing emphasise of the cartel authorities on e-raids by comprehensively preparing the IT department for possible dawn raids. In order to avoid even negligent breaches such as in the case at hand, the employees in this sensitive area must be well trained and, in the happening of such an event, be aware of what they should do and what they should avoid. This applies also if the IT department is partially or completely outsourced.

In this regard, it is worth reading the explanatory note of the EU Commission in which the Commission explains the rights and duties of undertakings under inspection from its point of view. is stated there by reference to IT investigations:

“Theundertaking may be required to provide appropriate representatives or members of staff to assist the Inspectors, not only for explanations on the organisation of the undertaking and its IT environment, but also for specific tasks such as the temporary blocking of individual email accounts, temporarily disconnecting running computers from the network, removing and re-installing hard drives from computers and providing 'administrator access rights'-support. When such actions are taken, the undertaking must not interfere in any way with these measures and it is the undertaking's responsibility to inform the employees affected accordingly” (Emphasis added, marginal number 11).