JUDGMENT OF THE COURT (First Chamber)

27 February 2025 ( *1 )

(Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(1)(h) – Automated decision-making, including profiling – Scoring – Assessment of the creditworthiness of a natural person – Access to meaningful information about the logic involved in profiling – Verification of the accuracy of the information provided – Directive (EU) 2016/943 – Point 1 of Article 2 – Trade secret – Personal data of third parties)

In Case C‑203/22,

REQUEST for a preliminary ruling under Article 267 TFEU from the Verwaltungsgericht Wien (Administrative Court, Vienna, Austria), made by decision of 11 February 2022, received at the Court on 16 March 2022, in the proceedings

CK

v

Magistrat der Stadt Wien

other party:

Dun & Bradstreet Austria GmbH,

THE COURT (First Chamber),

composed of K. Lenaerts, President of the Court, acting as President of the First Chamber, T. von Danwitz (Rapporteur), Vice-President of the Court, A. Kumin, N. Jääskinen and I. Ziemele, Judges,

Advocate General: J. Richard de la Tour,

Registrar: A. Calot Escobar,

having regard to the written procedure,

after considering the observations submitted on behalf of:

–

CK, by C. Wirthensohn, Rechtsanwalt,

–

Dun & Bradstreet Austria GmbH, by D. Cooper, Solicitor, A.-S. Oberschelp de Meneses, avocate, K. Van Quathem and B. Van Vooren, advocaten,

–

the Spanish Government, by A. Ballesteros Panizo, acting as Agent,

–

the Netherlands Government, by M.K. Bulterman and C.S. Schillemans, acting as Agents,

–

the Polish Government, by B. Majczyna, acting as Agent,

–

the European Commission, by A. Bouchagiar, F. Erlbacher and H. Kranenborg, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 12 September 2024,

gives the following

Judgment

1. This request for a preliminary ruling concerns the interpretation, first, of Article 15(1)(h) and Article 22 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’), and, second, of point 1 of Article 2 of Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ 2016 L 157, p. 1).
2. The request has been made in the proceedings between CK and the Magistrat der Stadt Wien (City Council of Vienna, Austria) concerning the enforcement of a court order requiring Bisnode Austria GmbH, now Dun & Bradstreet Austria GmbH (‘D & B’), an undertaking specialising in the provision of credit assessments, to provide CK with meaningful information about the logic involved in profiling relating to her personal data.

Legal context

European Union law

The GDPR

3. Recitals 4, 11, 58, 63 and 71 of the GDPR state:

‘(4)

The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the [Charter of Fundamental Rights of the European Union (“the Charter”)] as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.

…

(11)

Effective protection of personal data throughout the [European] Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States.

…

(58)

The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. …

…

(63)

A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. … That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. …

…

(71)

The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her, such as automatic refusal of an online credit application or e-recruiting practices without any human intervention. Such processing includes “profiling” that consists of any form of automated processing of personal data evaluating the personal aspects relating to a natural person, in particular to analyse or predict aspects concerning the data subject’s performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, where it produces legal effects concerning him or her or similarly significantly affects him or her. … In any case, such processing should be subject to suitable safeguards, which should include specific information to the data subject and the right to obtain human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision. …’

4. Article 4 of that regulation, entitled ‘Definitions’, provides, in point 4:

‘For the purposes of this Regulation:

…

(4)

“profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements’.

5. Article 12 of the GDPR, entitled ‘Transparent information, communication and modalities for the exercise of the rights of the data subject’, provides, in paragraph 1:

‘The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. …’

6. Article 13 of that regulation, which concerns the information to be provided where personal data are collected from the data subject, and Article 14 thereof, which concerns the information to be provided where personal data have not been obtained from the data subject, provide, in paragraph 2(f) and paragraph 2(g), respectively, that the controller, to ensure fair and transparent processing in respect of the data subject, must provide the data subject with, inter alia, information as to ‘the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject’.
7. Article 15 of the GDPR, entitled ‘Right of access by the data subject’, is worded as follows:

‘1.   The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

…

(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

…

3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.’
5. Article 22 of that regulation, entitled ‘Automated individual decision-making, including profiling’, provides:

‘1.   The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

2. Paragraph 1 shall not apply if the decision:

(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;

(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

(c) is based on the data subject’s explicit consent.

3. In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.’
5. As set out in Article 23 of the GDPR, headed ‘Restrictions’:

‘1.   Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

…

(i) the protection of the data subject or the rights and freedoms of others;

…

2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

(a) the purposes of the processing or categories of processing;

(b) the categories of personal data;

(c) the scope of the restrictions introduced;

(d) the safeguards to prevent abuse or unlawful access or transfer;

(e) the specification of the controller or categories of controllers;

(f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;

(g) the risks to the rights and freedoms of data subjects; and

(h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.’

10. Article 54 of that regulation, entitled ‘Rules on the establishment of the supervisory authority’, provides, in paragraph 2:

‘The member or members and the staff of each supervisory authority shall, in accordance with Union or Member State law, be subject to a duty of professional secrecy both during and after their term of office, with regard to any confidential information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers. During their term of office, that duty of professional secrecy shall in particular apply to reporting by natural persons of infringements of this Regulation.’

11. Article 58 of the GDPR, headed ‘Powers’, provides, in paragraph 1(e):

‘Each supervisory authority shall have all of the following investigative powers:

(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks’.

Directive 2016/943

12. Recital 35 of Directive 2016/943 states:

‘… this Directive should not affect the rights and obligations laid down in Directive 95/46/EC [of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31)], in particular the rights of the data subject to access his or her personal data being processed and to obtain the rectification, erasure or blocking of the data where it is incomplete or inaccurate …’

13. Point 1 of Article 2 of that directive provides:

‘For the purposes of this Directive, the following definitions apply:

(1)“trade secret” means information which meets all of the following requirements:

(a) it is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question;

(b) it has commercial value because it is secret;

(c) it has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret’.

14. Article 9 of the directive, entitled ‘Preservation of confidentiality of trade secrets in the course of legal proceedings’, provides:

‘1.   Member States shall ensure that the parties, their lawyers or other representatives, court officials, witnesses, experts and any other person participating in legal proceedings relating to the unlawful acquisition, use or disclosure of a trade secret, or who has access to documents which form part of those legal proceedings, are not permitted to use or disclose any trade secret or alleged trade secret which the competent judicial authorities have, in response to a duly reasoned application by an interested party, identified as confidential and of which they have become aware as a result of such participation or access. In that regard, Member States may also allow competent judicial authorities to act on their own initiative.

The obligation referred to in the first subparagraph shall remain in force after the legal proceedings have ended. However, such obligation shall cease to exist in any of the following circumstances:

(a) where the alleged trade secret is found, by a final decision, not to meet the requirements set out in point 1 of Article 2; or

(b) where[,] over time, the information in question becomes generally known among or readily accessible to persons within the circles that normally deal with that kind of information.

2. Member States shall also ensure that the competent judicial authorities may, on a duly reasoned application by a party, take specific measures necessary to preserve the confidentiality of any trade secret or alleged trade secret used or referred to in the course of legal proceedings relating to the unlawful acquisition, use or disclosure of a trade secret. Member States may also allow competent judicial authorities to take such measures on their own initiative.

The measures referred to in the first subparagraph shall at least include the possibility:

(a) of restricting access to any document containing trade secrets or alleged trade secrets submitted by the parties or third parties, in whole or in part, to a limited number of persons;

(b) of restricting access to hearings, when trade secrets or alleged trade secrets may be disclosed, and the corresponding record or transcript of those hearings to a limited number of persons;

(c) of making available to any person other than those comprised in the limited number of persons referred to in points (a) and (b) a non-confidential version of any judicial decision, in which the passages containing trade secrets have been removed or redacted.

The number of persons referred to in points (a) and (b) of the second subparagraph shall be no greater than necessary in order to ensure compliance with the right of the parties to the legal proceedings to an effective remedy and to a fair trial, and shall include, at least, one natural person from each party and the respective lawyers or other representatives of those parties to the legal proceedings.

3. When deciding on the measures referred to in paragraph 2 and assessing their proportionality, the competent judicial authorities shall take into account the need to ensure the right to an effective remedy and to a fair trial, the legitimate interests of the parties and, where appropriate, of third parties, and any potential harm for either of the parties, and, where appropriate, for third parties, resulting from the granting or rejection of such measures.
4. Any processing of personal data pursuant to paragraphs 1, 2 or 3 shall be carried out in accordance with [Directive 95/46].’

Austrian law

15. Paragraph 4(6) of the Datenschutzgesetz (Law on Data Protection) of 17 August 1999 (BGBl. I, 165/1999), in its version applicable to the main proceedings (‘the DSG’), precludes, as a rule, the data subject from having access to his or her personal data, provided for in Article 15 of the GDPR, where such access would compromise a business or trade secret of the controller or of a third party.

The dispute in the main proceedings and the questions referred for a preliminary ruling

16. CK was refused, by a mobile telephone operator, the conclusion or extension of a mobile telephone contract which would have required a monthly payment of EUR 10 on the ground that, according to an automated credit assessment, carried out by D & B, she did not have sufficient financial creditworthiness.
17. CK brought the matter before the Austrian data protection authority, which ordered D & B to disclose to CK meaningful information about the logic involved in the automated decision-making based on personal data concerning CK.
18. D & B brought an action against that decision before the Bundesverwaltungsgericht (Federal Administrative Court, Austria), claiming, in essence, that, due to a protected trade secret, it did not have to disclose to CK any information in addition to the information that had already been provided to her.
19. By decision of 23 October 2019 (‘the decision of 23 October 2019’), that court found that D & B had infringed Article 15(1)(h) of the GDPR by failing to provide CK with meaningful information about the logic involved in the automated decision-making based on personal data concerning CK, or, at the very least, by failing to give a sufficient statement of reasons as to why it was unable to provide that information.
20. In particular, in that decision, the Bundesverwaltungsgericht (Federal Administrative Court) noted that D & B had not provided CK with sufficient explanations to enable her to understand how the prognosis on the probability of her future behaviour (‘score’) had been established in relation to her, which that undertaking communicated to CK, stating that, with a view to obtaining that ‘score’, certain socio-demographic data concerning CK had been ‘given equal weighting’.
21. The decision of 23 October 2019 has become final and is enforceable under Austrian law. However, CK’s application for enforcement of that decision, lodged by CK with the City Council of Vienna, which is the enforcing authority, was rejected on the ground that D & B had met, to the requisite standard, its obligation to provide information, even though that company had not provided any additional information after that decision was adopted.
22. CK brought an action against the decision of the City Council of Vienna before the Verwaltungsgericht Wien (Administrative Court, Vienna, Austria), which is the referring court, seeking enforcement of the decision of 23 October 2019.
23. The referring court takes the view that, under Austrian law, it is required to have that decision enforced, which would mean having to determine the specific acts that D & B is required to carry out pursuant to that decision.
24. Taking the view that that determination can only be made by an expert with the requisite expertise, the referring court appointed an expert who took the view that D & B was required to provide the following minimum information in order to meet its obligations with respect to CK:

– the personal data concerning CK which have been processed in order to formulate a ‘factor’ (date of birth, address, sex, etc.);

– the mathematical formula on which the calculation that led to the score at issue in the main proceedings is based;

– the specific value attributed to CK for each of the factors concerned; and

– the precise intervals within which the same value is attributed to different data for the same factor (interval or discrete evaluation or index/land-register-based evaluation).

25. In order to ensure that, after it has been provided, the accuracy of that minimum information can be verified by CK, D & B should also provide a list of scoring for the period covering the six months preceding and the six months following the establishment of CK’s score, as obtained using the same calculation rule.
26. According to the referring court, only the disclosure of the minimum information specified by that expert would enable the consistency and accuracy of the information provided by a controller under Article 15(1)(h) of the GDPR to be verified.
27. In the present case, there are a number of clear indications that the information provided by D & B is contrary to the facts. While the information provided to CK, including, inter alia, the score obtained, showed CK to have very good credit standing, the actual profiling led to her being regarded as not creditworthy, including as regards the capacity to pay the amount of EUR 10 per month under a mobile telephone contract.
28. In the referring court’s view, the question therefore arises whether Article 15(1)(h) of the GDPR guarantees the data subject the possibility to verify the accuracy of the information provided by the controller.
29. In the event that Article 15(1)(h) of the GDPR does not guarantee this, the right of access to the data subject’s personal data and other information provided for therein would be rendered meaningless and useless, especially since each controller could in that case be able to provide incorrect information.
30. According to the referring court, the question also arises whether and, if so, to what extent the exception based on the existence of a trade secret is capable of restricting that right of access guaranteed by the combined provisions of Article 15(1)(h) and Article 22 of the GDPR.
31. In the light of the rules laid down in Article 9 of Directive 2016/943, it is necessary to assess whether it is conceivable that information classified as a ‘trade secret’ within the meaning of point 1 of Article 2 of that directive may be disclosed only to the authority or court seised in order for that authority or court to verify independently whether it must be found that there is in fact such a trade secret and whether that information provided by the controller, for the purposes of Article 15(1) of the GDPR, corresponds to the reality of the situation at issue.
32. Lastly, the referring court takes the view that it is necessary to examine whether a provision such as Paragraph 4(6) of the DSG, which excludes, as a rule, the data subject’s right of access, provided for in Article 15 of the GDPR, where such access would compromise a business or trade secret of the controller or of a third party, may be regarded as consistent with the combined provisions of Article 15(1) and Article 22(3) of the GDPR.
33. In those circumstances, the Verwaltungsgericht Wien (Administrative Court, Vienna) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1)

What requirements as to content does information provided need to satisfy in order to be regarded as sufficiently “meaningful” within the meaning of Article 15(1)(h) of [the GDPR]?

In the case of profiling, must the information essential for making the result of the automated decision transparent in each individual case also be disclosed by the controller – where necessary in compliance with an existing trade secret – as part of the disclosure of the “logic involved” which includes, in particular, (1) the disclosure of the data subject’s processed data, (2) the disclosure of the parts of the algorithm on which the profiling is based that are necessary to provide transparency, and (3) the information relevant to establishing the connection between the processed information and the rating arrived at?

In cases involving profiling, must the party entitled to access for the purpose of Article 15(1)(h) of the GDPR be provided, as a minimum, with the following information on the specific processing concerning him or her, even if a trade secret is involved, in order to enable him or her to protect his or her rights under Article 22(3) of the GDPR:

(a) [the] communication of all potentially pseudo-anonymised information, in particular on the manner in which the data subject’s data is being processed, which allows the data subject to check compliance with the GDPR,

(b) … the input data used for profiling,

(c) the parameters and input variables used in the determination of the rating,

(d) the influence of these parameters and input variables on the calculated rating,

(e) information on the origin of the parameters or input variables,

(f) an explanation as to why the party entitled to access for the purpose of Article 15(1)(h) of the GDPR has been assigned a specific rating and clarification of the implications of such rating,

(g) [the] listing [of] the profile categories and [the] explanation as to what rating implication is associated with each of the profile categories?

(2) Is the right of access granted by Article 15(1)(h) of the GDPR related to the rights guaranteed by Article 22(3) of the GDPR to express one’s point of view and to challenge an automated decision taken within the meaning of Article 22 of the GDPR in so far as the scope of the information to be provided on the basis of an access request within the meaning of Article 15(1)(h) of the GDPR is only sufficiently “meaningful” if the party requesting access and the data subject for the purpose of Article 15(1)(h) of the GDPR is enabled to exercise the rights guaranteed by Article 22(3) of the GDPR to express his or her own point of view and to challenge the automated decision for the purpose of Article 22 of the GDPR concerning him or her in a real, profound and promising way?

(3)

(a) Must Article 15(1)(h) of the GDPR be interpreted as meaning that information constitutes “meaningful information” for the purposes of this provision only if it is so broad that the party entitled to access for the purpose of Article 15(1)(h) of the GDPR is able to determine whether this information is accurate, i.e. whether the automatic decision specifically requested was actually based on the information provided?

(b) If the above question is answered in the affirmative: what is the procedure if the accuracy of the information provided by a controller can only be verified if third-party data protected by the GDPR must also be brought to the attention of the party entitled to access for the purpose of Article 15(1)(h) of the GDPR (black box)?

Can this tension between the right of access within the meaning of Article 15(1) of the GDPR and the data protection rights of third parties also be resolved by disclosing the data of third parties (which have also been subjected to the same profiling process) required for the accuracy check only to the authority or the court for the authority or the court to check independently whether the disclosed data of these third parties is accurate?

(c) If the above question is answered in the affirmative: which rights must be granted to the party entitled to access for the purpose of Article 15(1)(h) of the GDPR in the event that it is necessary to ensure the protection of third party rights within the meaning of Article 15(4) of the GDPR by creating the black box referred to in [Question 3(b)]?

Must the data of other persons to be disclosed by the controller for the purpose of Article 15(1) of the GDPR to the party entitled to access for the purpose of Article 15(1)(h) of the GDPR be disclosed in pseudo-anonymised form in order to ensure that the accuracy can be verified?

(4)

(a) What is the procedure if the information to be provided in accordance with Article 15(1)(h) of the GDPR also meets the requirements of a trade secret within the meaning of [point 1 of Article 2 of Directive 2016/943]?

Can the tension between the right of access guaranteed by Article 15(1)(h) of the GDPR and the right to non-disclosure of a trade secret protected by [Directive 2016/943] be resolved by allowing the information to be disclosed as a trade secret within the meaning of [point 1 of Article 2 of Directive 2016/943] be disclosed to the authority or the court only, so that the authority or the court must independently verify whether it must be assumed that a trade secret within the meaning of [point 1 of Article 2 of Directive 2016/943] exists and whether the information provided by the controller within the meaning of Article 15(1) of the GDPR is accurate?

(b)

If the above question is answered in the affirmative: which rights must be granted to the party entitled to access for the purpose of Article 15(1)(h) of the GDPR in the event that it is necessary to ensure the protection of third party rights within the meaning of Article 15(4) of the GDPR by creating the black box referred to in [Question 4(a)]?

In [the] case of discrepancy between the information to be disclosed to the authority or the court and the information to be disclosed to the person entitled to access within the meaning of Article 15(1)(h) of the GDPR, in cases involving profiling, must the party entitled to access for the purpose of Article 15(1)(h) of the GDPR also be provided, as a minimum, with the following information on the specific processing concerning him or her in order to enable him or her to protect his or her rights under Article 22(3) of the GDPR in their entirety:

–

[the] communication of all potentially pseudo-anonymised information, in particular on the manner in which the data subject’s data is being processed, which allows the data subject to check compliance with the GDPR,

– … the input data used for profiling,

– the parameters and input variables used in the determination of the rating,

– the influence of these parameters and input variables on the calculated rating,

– information on the origin of the parameters or input variables,

– an explanation as to why the party entitled to access for the purpose of Article 15(1)(h) of the GDPR has been assigned a specific rating and clarification of the implications of such rating,

– [the] listing [of] the profile categories and [the] explanation as to what rating implication is associated with each of the profile categories?

(5) Does the provision of Article 15(4) of the GDPR in any way limit the scope of the information to be provided pursuant to Article 15(1)(h) of the GDPR?

If this question is answered in the affirmative, is this right of access limited by Article 15(4) of the GDPR, and how is the extent of the limitation to be determined in each individual case?

(6) Is the provision of [Paragraph] 4(6) of the [DSG], according to which “the right of access of the data subject pursuant to Article 15 of the GDPR, as a rule, does not [exist] vis-à-vis the controller if the provision of such information would violate a business or trade secret of the controller or third parties” compatible with the requirements of Article 15(1) in conjunction with Article 22(3) of the GDPR? If the above question is answered in the affirmative, what are the conditions for such compatibility?’

Procedure before the Court

34. By decision of 8 December 2022, the President of the Court suspended the present proceedings pending final judgment in Case C‑634/21, SCHUFA Holding and Others (Scoring).
35. In accordance with the decision of the President of the Court of 13 December 2023, the Registry of the Court of Justice notified the referring court of the judgment of 7 December 2023, SCHUFA Holding and Others (Scoring) (C‑634/21, EU:C:2023:957), by inviting it to indicate whether, in the light of that judgment, it wished to maintain its request for a preliminary ruling.
36. By letter received at the Court Registry on 29 January 2024, the referring court stated that it was maintaining its request for a preliminary ruling, since the judgment of 7 December 2023, SCHUFA Holding and Others (Scoring) (C‑634/21, EU:C:2023:957), did not provide an answer to the questions which it had referred in the present case.
37. By decision of 14 February 2024, the President of the Court therefore ordered that the proceedings in the present case be resumed.

Consideration of the questions referred

Questions 1 and 2 and Question 3(a)

38. By Questions 1 and 2 and Question 3(a), which it is appropriate to examine together, the referring court asks, in essence, whether Article 15(1)(h) of the GDPR must be interpreted as meaning that, in the case of automated decision-making, including profiling, within the meaning of Article 22(1) of that regulation, the data subject may require the controller to provide, as ‘meaningful information about the logic involved’, an exhaustive explanation of the procedure and principles actually applied in order to use, by automated means, the personal data concerning that person with a view to obtaining a specific result, such as a credit profile.
39. In accordance with settled case-law of the Court, in interpreting a provision of EU law, it is necessary to consider not only its wording, but also the context in which it occurs and the objectives pursued by the rules of which it is part (judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C‑487/21, EU:C:2023:369, paragraph 19 and the case-law cited).
40. As regards, first of all, the wording of Article 15(1)(h) of the GDPR, it should be noted, first, that the generally accepted meanings of the concept of ‘meaningful information’ under that provision, in the various language versions of that provision, differ; some, like the French-language version, favour the functionality (‘nuttige’ in Dutch, ‘úteis’ in Portuguese) or the relevance (‘pertinente’ in Romanian) of the information to be provided, while others place greater emphasis on the importance of that information (‘significativa’ in Spanish and ‘istotne’ in Polish). Lastly, in both the German- and the English-language versions of that provision, the term used (‘aussagekräftig’ and ‘meaningful’, respectively) may be understood both as relating to the good intelligibility of that information and as referring to that information being of a certain value.
41. The diversity of generally accepted meanings in the various language versions must be understood in such a way that the various meanings set out in the preceding paragraph are complementary, which it is appropriate to take into account when interpreting the concept of ‘meaningful information about the logic involved’ under Article 15(1)(h) of the GDPR, as the Advocate General observed, in essence, in point 65 of his Opinion.
42. Second, in the light of its general wording, the reference, in that provision, to the ‘logic involved’ in automated decision-making, which constitutes the subject matter of that ‘meaningful information’, is capable of covering a wide range of ‘logics’ concerning the use of personal data and other data with a view to obtaining a specific result by automated means. That interpretation is supported by certain language versions of that provision which use terms referring, in a complementary manner, to various aspects of the generally accepted meaning of the concept of ‘logic’. Thus, for example, in the Czech- and Polish-language versions, reference is made to the terms ‘postupu’ and ‘zasady’, respectively, which may be translated as ‘procedure’ and ‘principles’.
43. It must therefore be held that the wording of Article 15(1)(h) of the GDPR covers all relevant information concerning the procedure and principles relating to the use, by automated means, of personal data with a view to obtaining a specific result.
44. As regards, next, the context in which the concept of ‘meaningful information about the logic involved’, within the meaning of Article 15(1)(h) of the GDPR, occurs, it must be pointed out, in the first place, that that information is only part of the information covered by the right of access provided for in that article, which also concerns information concerning the importance and the envisaged consequences of the processing at issue for the data subject.
45. Although that information, which, according to the Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679 adopted on 3 October 2017 by the Working Party set up under Article 29 of Directive 95/46, as revised and adopted on 6 February 2018, in order to be meaningful and understandable, should be accompanied by ‘real, tangible examples’, is not the subject of the questions referred by the national court, it must nevertheless be taken into account as part of the context in which the concept of ‘meaningful information about the logic involved’ occurs.
46. In the second place, having regard to the fact that the concept of ‘meaningful information about the logic involved’ also appears in Article 13(2)(f) and Article 14(2)(g) of the GDPR, the Court has already held that, in the case of automated decision-making, within the meaning of Article 22(1) of that regulation, the right of access to such information enshrined in Article 15(1)(h) thereof forms a whole with the additional information obligations imposed on the controller under Article 13(2)(f) and Article 14(2)(g) of the GDPR (see, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others (Scoring), C‑634/21, EU:C:2023:957, paragraph 56).
47. In the third place, as the Advocate General stated, in essence, in points 58 to 60 of his Opinion, in the contextual interpretation of the rights of access provided for in the case of automated decision-making, account must be taken of the case-law of the Court relating to the requirements to be met by the controller under Article 15(3) of the GDPR.
48. Thus, account must be taken, inter alia, of the fact that the requirement of transparency of the information provided, laid down in Article 12(1) of the GDPR, applies to all the data and information referred to in Article 15, including those relating to automated decision-making.
49. In order to ensure that the data subject is able fully to understand the information provided to him or her by the controller, Article 12(1) requires the controller to take appropriate measures, inter alia, to provide the data subject with those data and information in a concise, transparent, intelligible and easily accessible form, using plain and clear language (see, to that effect, judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C‑487/21, EU:C:2023:369, paragraph 38).
50. The examination of the context of which Article 15(1)(h) of the GDPR forms part thus supports the interpretation that emerges from the analysis of the wording of that provision, according to which ‘meaningful information about the logic involved’ in automated decision-making, within the meaning of that provision, covers all relevant information concerning the procedure and principles relating to the use of personal data with a view to obtaining, by automated means, a specific result, the obligation of transparency also requiring that that information be provided in a concise, transparent, intelligible and easily accessible form.
51. As regards, lastly, the purposes of the GDPR, it should be recalled that the objective of that regulation consists, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data, enshrined in Article 16 TFEU and guaranteed as a fundamental right in Article 8 of the Charter, which supplements the right to private life guaranteed in Article 7 thereof (see, to that effect, judgment of 4 October 2024, Schrems (Communication of data to the general public), C‑446/21, EU:C:2024:834, paragraph 45 and the case-law cited).
52. Thus, as stated moreover in recital 11, the purpose of the GDPR is to strengthen and set out in detail the rights of data subjects (judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C‑487/21, EU:C:2023:369, paragraph 33 and the case-law cited).
53. As regards, specifically, the right of access provided for in Article 15 of the GDPR, it is apparent from the case-law of the Court that that right must enable the data subject to ensure that the personal data concerning him or her are correct and that they are processed in a lawful manner (judgments of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C‑487/21, EU:C:2023:369, paragraph 34, and of 26 October 2023, FT (Copies of medical records), C‑307/22, EU:C:2023:811, paragraph 73).
54. That right of access is necessary to enable the data subject to exercise, depending on the circumstances, his or her right to rectification, right to erasure (‘right to be forgotten’) or right to restriction of processing, conferred, respectively, by Articles 16, 17 and 18 of the GDPR, as well as the data subject’s right to object to his or her personal data being processed, laid down in Article 21 of the GDPR, right of action and right to compensation, laid down in Articles 79 and 82 of the GDPR, respectively (see, to that effect, judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C‑487/21, EU:C:2023:369, paragraph 35).
55. In particular, in the specific context of the adoption of a decision based solely on automated processing, the main purpose of the data subject’s right to obtain the information provided for in Article 15(1)(h) of the GDPR is to enable him or her effectively to exercise the rights conferred on him or her by Article 22(3) of that regulation, namely the right to express his or her point of view on that decision and to contest it.
56. If the individuals affected by an automated decision, including profiling, were not in a position to understand the reasons which led to that decision before expressing their point of view or contesting the decision, those rights would not, accordingly, satisfy in full their purpose of protecting those individuals against the particular risks to their rights and freedoms represented by the automated processing of their personal data (see, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others (Scoring), C‑634/21, EU:C:2023:957, paragraph 57).
57. In that regard, it is apparent from recital 71 of the GDPR that, where the data subject is the subject of a decision which is based solely on automated processing and which significantly affects him or her, that data subject must have the right to obtain an explanation of that decision. As the Advocate General observed in point 67 of his Opinion, it must therefore be held that Article 15(1)(h) of the GDPR affords the data subject a genuine right to an explanation as to the functioning of the mechanism involved in automated decision-making of which that person was the subject and of the result of that decision.
58. It is apparent from the examination of the purposes of the GDPR and, in particular, those of Article 15(1)(h) thereof that the right to obtain ‘meaningful information about the logic involved’ in automated decision-making, within the meaning of that provision, must be understood as a right to an explanation of the procedure and principles actually applied in order to use, by automated means, the personal data of the data subject with a view to obtaining a specific result, such as a credit profile. In order to enable the data subject effectively to exercise the rights conferred on him or her by the GDPR and, in particular, Article 22(3) thereof, that explanation must be provided by means of relevant information and in a concise, transparent, intelligible and easily accessible form.
59. Those requirements cannot be satisfied either by the mere communication of a complex mathematical formula, such as an algorithm, or by the detailed description of all the steps in automated decision-making, since none of those would constitute a sufficiently concise and intelligible explanation.
60. As is apparent from page 25 of the Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679, referred to in paragraph 45 of the present judgment, first, the controller should find simple ways to tell the data subject about the rationale behind, or the criteria relied on in reaching the automated decision. Second, the GDPR requires the controller to provide meaningful information about the logic involved in that decision, but ‘not necessarily a complex explanation of the algorithms used or disclosure of the full algorithm’.
61. Thus, the ‘meaningful information about the logic involved’ in automated decision-making, within the meaning of Article 15(1)(h) of the GDPR, must describe the procedure and principles actually applied in such a way that the data subject can understand which of his or her personal data have been used in what way in the automated decision-making at issue, with the complexity of the operations to be carried out in the context of automated decision-making not being capable of relieving the controller of the duty to provide an explanation.
62. As regards, specifically, profiling such as that at issue in the main proceedings, the referring court could, inter alia, find that it is sufficiently transparent and intelligible to inform the data subject of the extent to which a variation in the personal data taken into account would have led to a different result.
63. That said, it should also be stated that, as regards the question whether the information provided must allow the data subject to be able to verify the accuracy of the personal data concerning him or her and on which automated decision-making is based, the right of access to those data is covered not by Article 15(1)(h) of the GDPR, but by the introductory sentence of that paragraph, which guarantees the data subject the possibility to ensure that the data are correct, as is apparent from the case-law cited in paragraph 53 above.
64. Lastly, as regards the referring court’s assertion that the information provided by D & B to CK, pursuant to Article 15(1)(h) of the GDPR, is contrary to the facts, since the ‘actual’ profiling led to her being regarded as not creditworthy although that information suggested the contrary, it should be noted that, if, according to that court, the non-compliance thus established results from D & B’s failure to provide to CK the profiling carried out in respect of her on behalf of the mobile telephone undertaking which, on that basis, refused to conclude or renew a contract with her, it should be remedied by means of the right of access to the credit profile thus established. In that regard, it is apparent from the Court’s case-law that personal data generated by the controller itself fall within the scope of Article 14 of the GDPR (see, to that effect, judgment of 28 November 2024, Másdi, C‑169/23, EU:C:2024:988, paragraph 48).
65. By contrast, an explanation of the differences between the result of such ‘actual’ profiling, assuming it to be established, and the result communicated by D & B to CK and obtained, according to that company, by means of ‘equal weighting’ of the data relating to CK, would indeed fall within the scope of ‘meaningful information about the logic involved’ in the profiling thus carried out. In accordance with what has been stated in paragraph 58 above, D & B is therefore required to explain in a concise, transparent, intelligible and easily accessible form the procedure and principles pursuant to which the result of the ‘actual’ profiling was obtained.
66. It follows from all of the foregoing that the answer to Questions 1 and 2 and to Question 3(a) is that Article 15(1)(h) of the GDPR must be interpreted as meaning that, in the case of automated decision-making, including profiling, within the meaning of Article 22(1) of that regulation, the data subject may require the controller, as ‘meaningful information about the logic involved’, to explain, by means of relevant information and in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied in order to use, by automated means, the personal data concerning that person with a view to obtaining a specific result, such as a credit profile.

Question 3(b) and (c), Question 4(a) and (b), and Questions 5 and 6

67. By Question 3(b) and (c), Question 4(a) and (b), and Questions 5 and 6, which it is appropriate to examine together, the referring court asks, in essence, whether Article 15(1)(h) of the GDPR must be interpreted as meaning that, where the controller takes the view that the information to be provided to the data subject in accordance with that provision contains data of third parties protected by that regulation or trade secrets, within the meaning of point 1 of Article 2 of Directive 2016/943, that controller is required to provide the allegedly protected information to the competent supervisory authority or court, which must balance the rights and interests at issue with a view to determining the extent of the data subject’s right of access provided for in Article 15 of the GDPR.
68. In that regard, it should be recalled that, pursuant to recital 4 of the GDPR, the right to the protection of personal data is not an absolute right and must be balanced against other fundamental rights, in accordance with the principle of proportionality. Thus, the GDPR respects all the fundamental rights and observes the freedoms and principles recognised by the Charter, as enshrined by the Treaties (judgment of 26 October 2023, FT (Copies of medical records), C‑307/22, EU:C:2023:811, paragraph 59 and the case-law cited).
69. Moreover, recital 63 of that regulation states that the right for any data subject to have access to personal data which have been collected concerning him or her should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software.
70. However, the result of those considerations should not be a refusal to provide all information to the data subject. Thus, Article 23(1)(i) of that regulation provides, in essence, that a restriction of the scope of the obligations and rights provided for in, inter alia, Article 15 of the GDPR is possible only when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard the protection of the rights and freedoms of others.
71. In the light of the related right to obtain a copy, enshrined in Article 15(4) of the GDPR, the Court has already held that its application must not adversely affect the rights and freedoms of others, including trade secrets or intellectual property, and in particular the copyright protecting the software (see, to that effect, judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C‑487/21, EU:C:2023:369, paragraph 43).
72. In that context, the Court has noted that, in the event of conflict between, on the one hand, exercising the right of full and complete access to personal data and, on the other hand, the rights or freedoms of others, a balance will have to be struck between the rights and freedoms in question. Wherever possible, means of communicating personal data that do not infringe the rights or freedoms of others should be chosen, bearing in mind that, as follows from recital 63 of the GDPR, ‘the result of those considerations should not be a refusal to provide all information to the data subject’ (judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C‑487/21, EU:C:2023:369, paragraph 44).
73. As to how the right of access enshrined in Article 15(1)(h) of the GDPR may be implemented in such a way as to respect the rights and freedoms of others, it should be recalled that, according to the case-law, a national court may take the view that the personal data of the parties or of third parties must be disclosed to it in order to be able to balance, in full knowledge of the facts and in accordance with the principle of proportionality, the interests involved. That assessment may, depending on the case, lead it to authorise the full or partial disclosure to the opposing party of the personal data thus communicated to it, if it finds that such disclosure does not go beyond what is necessary for the purpose of guaranteeing the effective enjoyment of the rights which individuals derive from Article 47 of the Charter (judgment of 2 March 2023, Norra Stockholm Bygg, C‑268/21, EU:C:2023:145, paragraph 58).
74. As the Advocate General observed in point 94 of his Opinion, that case-law can be fully transposed to the situation in which the information to be provided to the data subject under the right of access guaranteed by Article 15(1)(h) of the GDPR is likely to result in an infringement of the rights and freedoms of others, in particular in so far as it contains personal data of third parties protected by that regulation or trade secrets, within the meaning of point 1 of Article 2 of Directive 2016/943. In that case too, that information must be disclosed to the competent supervisory authority or court, which must balance the rights and interests at issue with a view to determining the extent of the data subject’s right of access to personal data concerning him or her.
75. Having regard to the need to make that determination on a case-by-case basis, Article 15(1)(h) of the GDPR precludes inter alia the application of a provision such as Paragraph 4(6) of the DSG which excludes, as a rule, the data subject’s right of access, provided for in Article 15 of the GDPR, where such access would compromise a business or trade secret of the controller or of a third party. In that regard, it should be borne in mind that a Member State cannot definitively prescribe the result of a case-by-case balancing of the rights and interests at issue imposed by EU law (see, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others (Scoring), C‑634/21, EU:C:2023:957, paragraph 70 and the case-law cited).
76. In the light of all of the foregoing, the answer to Question 3(b) and (c), Question 4(a) and (b), and Questions 5 and 6 is that Article 15(1)(h) of the GDPR must be interpreted as meaning that, where the controller takes the view that the information to be provided to the data subject in accordance with that provision contains data of third parties protected by that regulation or trade secrets, within the meaning of point 1 of Article 2 of Directive 2016/943, that controller is required to provide the allegedly protected information to the competent supervisory authority or court, which must balance the rights and interests at issue with a view to determining the extent of the data subject’s right of access provided for in Article 15 of the GDPR.

Costs

77. Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (First Chamber) hereby rules:

1. Article 15(1)(h) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that, in the case of automated decision-making, including profiling, within the meaning of Article 22(1) of that regulation, the data subject may require the controller, as ‘meaningful information about the logic involved’, to explain, by means of relevant information and in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied in order to use, by automated means, the personal data concerning that person with a view to obtaining a specific result, such as a credit profile.         

2. Article 15(1)(h) of Regulation 2016/679

must be interpreted as meaning that, where the controller takes the view that the information to be provided to the data subject in accordance with that provision contains data of third parties protected by that regulation or trade secrets, within the meaning of point 1 of Article 2 of Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure, that controller is required to provide the allegedly protected information to the competent supervisory authority or court, which must balance the rights and interests at issue with a view to determining the extent of the data subject’s right of access provided for in Article 15 of that regulation.

[Signatures]

( *1 ) Language of the case: German.

JUDGMENT OF THE COURT (Fourth Chamber)

22 January 2020 ( *1 )

(Appeal — Access to documents of EU institutions, bodies, offices or agencies — Regulation (EC) No 1049/2001 — First indent of Article 4(2) — Exception relating to the protection of commercial interests — Article 4(3) — Protection of the decision-making process — Documents submitted to the European Medicines Agency in the context of a marketing authorisation application for a medicinal product for human use — Decision to grant a third party access to the documents — General presumption of confidentiality — No obligation for an EU institution, body, office or agency to apply a general presumption of confidentiality)

In Case C‑175/18 P,

APPEAL under Article 56 of the Statute of the Court of Justice of the European Union, brought on 6 March 2018,

PTC Therapeutics International Ltd, established in Dublin (Ireland), represented by G. Castle, B. Kelly, and K. Ewert, Solicitors, and by C. Thomas, Barrister, and M. Demetriou QC,

appellant,

the other parties to the proceedings being:

European Medicines Agency (EMA), initially represented by T. Jabłoński, S. Marino, S. Drosos, A. Spina and A. Rusanov, and subsequently by T. Jabłoński, S. Marino and S. Drosos, acting as Agents,

defendant at first instance,

European Confederation of Pharmaceutical Entrepreneurs (Eucope), established in Brussels (Belgium), represented by S. Cowlishaw, Solicitor, and D. Scannell, Barrister,

intervener at first instance,

THE COURT (Fourth Chamber),

composed of M. Vilaras (Rapporteur), President of the Chamber, K. Lenaerts, President of the Court, acting as Judge of the Fourth Chamber, S. Rodin, D. Šváby and N. Piçarra, Judges,

Advocate General: G. Hogan,

Registrar: M. Longar, Administrator,

having regard to the written procedure and further to the hearing on 16 May 2019,

after hearing the Opinion of the Advocate General at the sitting on 11 September 2019,

gives the following

Judgment

1. By its appeal, PTC Therapeutics International Ltd seeks to have set aside the judgment of the General Court of the European Union of 5 February 2018, PTC Therapeutics International v EMA (T‑718/15, EU:T:2018:66) (‘the judgment under appeal’) by which that court dismissed the appellant’s action seeking annulment of Decision EMA/722323/2015 of the European Medicines Agency (EMA) of 25 November 2015 granting a third party, on the basis of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43) access to a document containing data submitted in the context of a marketing authorisation application for the medicinal product Translarna (‘the decision at issue’).

Legal context

International law

2. Under Article 39(3) of the Agreement on Trade-Related Aspects of Intellectual Property Rights, as set out in Annex 1C to the Marrakesh Agreement establishing the World Trade Organisation, which was approved on behalf of the European Community by Council Decision 94/800/EC of 22 December 1994 concerning the conclusion on behalf of the European Community, as regards matters within its competence, of the agreements reached in the Uruguay Round multilateral negotiations (1986-1994) (OJ 1994 L 336, p. 1) (‘the TRIPS Agreement’):

‘Members, when requiring, as a condition of approving the marketing of pharmaceutical or of agricultural chemical products which utilise new chemical entities, the submission of undisclosed test or other data, the origination of which involves a considerable effort, shall protect such data against unfair commercial use. In addition, Members shall protect such data against disclosure, except where necessary to protect the public, or unless steps are taken to ensure that the data are protected against unfair commercial use.’

EU law

3. Article 8(1) of Regulation (EC) No 141/2000 of the European Parliament and of the Council of 16 December 1999 on orphan medicinal products (OJ 2000 L 18, p. 1) provides:

‘Where a marketing authorisation in respect of an orphan medicinal product is granted pursuant to Regulation (EEC) No 2309/93 or where all the Member States have granted marketing authorisations in accordance with the procedures for mutual recognition laid down in Articles 7 and 7a of Directive 65/65/EEC or Article 9(4) of Council Directive 75/319/EEC of 20 May 1975 on the approximation of provisions laid down by law, regulation or administrative action relating to medicinal products ..., and without prejudice to intellectual property law or any other provision of [EU] law, the [European Union] and the Member States shall not, for a period of 10 years, accept another application for a marketing authorisation, or grant a marketing authorisation or accept an application to extend an existing marketing authorisation, for the same therapeutic indication, in respect of a similar medicinal product.’

4. Article 1(a) of Regulation No 1049/2001 states:

‘The purpose of this Regulation is:

• to define the principles, conditions and limits on grounds of public or private interest governing the right of access to European Parliament, Council and Commission (hereinafter referred to as “the institutions”) documents provided for in Article 255 [EC] in such a way as to ensure the widest possible access to documents.’

5. Article 4 of that regulation, entitled ‘Exceptions’, provides, in paragraph 2 and the first subparagraph of paragraph 3 thereof:

‘2.   The institutions shall refuse access to a document where disclosure would undermine the protection of:

– commercial interests of a natural or legal person, including intellectual property,

...

3. Access to a document, drawn up by an institution for internal use or received by an institution, which relates to a matter where the decision has not been taken by the institution, shall be refused if disclosure of the document would seriously undermine the institution’s decision-making process, unless there is an overriding public interest in disclosure.’
4. Article 14(11) of Regulation (EC) No 726/2004 of the European Parliament and of the Council of 31 March 2004 laying down Community procedures for the authorisation and supervision of medicinal products for human and veterinary use and establishing a European Medicines Agency (OJ 2004 L 136, p. 1) is worded as follows:

‘Without prejudice to the law on the protection of industrial and commercial property, medicinal products for human use which have been authorised in accordance with the provisions of this Regulation shall benefit from an eight-year period of data protection and a 10-year period of marketing protection, in which connection the latter period shall be extended to a maximum of 11 years if, during the first eight years of those 10 years, the marketing authorisation holder obtains an authorisation for one or more new therapeutic indications which, during the scientific evaluation prior to their authorisation, are held to bring a significant clinical benefit in comparison with existing therapies.’

Background to the dispute

7. The background to the dispute and the content of the decision at issue are set out in paragraphs 1 to 13 of the judgment under appeal. For the purposes of the present proceedings, they may be summarised as follows.
8. The appellant designed the medicinal product Translarna for the treatment of Duchenne Muscular Dystrophy.
9. In October 2012, the appellant submitted to the EMA a marketing authorisation (‘MA’) application for Translarna. Having initially rejected that application, on 31 July 2014 the EMA decided to grant the appellant a conditional MA.
10. On 13 October 2015, the EMA informed the appellant that a pharmaceutical company was seeking access to a clinical study report included in the MA application file for Translarna (‘the report at issue’).
11. The appellant requested the EMA to treat the report at issue as confidential in its entirety. That request was rejected by the decision at issue.
12. By that decision, the EMA granted access to the full report, subject to certain redactions. The EMA considered that not all of the content of that report could be covered by the exceptions to the right of access laid down in Article 4 of Regulation No 1049/2001, as the appellant had failed to establish that each of the elements of the report constituted commercially confidential information.
13. The EMA considered that disclosure of the report at issue was consistent with Regulation No 1049/2001, the EMA’s transparency policy and the TRIPS Agreement.
14. It stated that the decision to grant a conditional MA had already been made and that, therefore, Article 4(3) of Regulation No 1049/2001 did not apply.
15. The EMA noted that it had, of its own initiative, redacted the references to protocol design discussions with the Food and Drug Administration, batch numbers, materials and equipment, exploratory assays, the quantitative and qualitative description of the method for drug concentration measurement, and the start and end dates of treatment and further dates that could lead to the identification of the patients.

The procedure before the General Court and the judgment under appeal

16. By application lodged at the Registry of the General Court on 9 December 2015, the appellant brought an action for the annulment of the decision at issue. By a separate document of the same date, it submitted an application for interim measures pursuant to Article 278 TFEU for the suspension of operation of the decision at issue.
17. By order of 20 July 2016, PTC Therapeutics International v EMA (T‑718/15 R, not published, EU:T:2016:425), the President of the General Court ordered the suspension of operation of the decision at issue. An appeal against that order was dismissed by an order of the Vice-President of the Court of Justice of 1 March 2017, PTC Therapeutics International v EMA (C‑513/16 P(R), not published, EU:C:2017:148).
18. By document lodged at the Registry of the General Court on 29 March 2016, the European Confederation of Pharmaceutical Entrepreneurs (Eucope) applied for leave to intervene in the proceedings in support of the form of order sought by the appellant. By order of 17 June 2016, the President of the Fourth Chamber of the General Court granted leave to intervene.
19. The appellant raised five pleas in law in support of its action.
20. In the first place, the General Court examined, in paragraphs 27 to 75 of the judgment under appeal, the first plea which alleged breach of the general presumption of confidentiality applicable to the report at issue and based on the exception relating to the protection of the appellant’s commercial interests.
21. In paragraph 45 of that judgment, the General Court noted that the report at issue did not relate to an ongoing administrative procedure, because the conditional MA for the medicinal product Translarna had been issued before the date of the request for access to that report. The General Court concluded that the disclosure of that report could not alter the MA procedure.
22. In paragraphs 46 to 52 of that judgment, the General Court noted that EU legislation regulating marketing authorisations did not restrict the use of documents included in the file relating to an MA procedure for a medicinal product and that that legislation did not limit access to that file to the ‘parties concerned’ or to ‘complainants’.
23. The General Court concluded, in paragraphs 53 to 57 of that judgment, that there was no general presumption of confidentiality in respect of the documents included in a file submitted in the context of an MA application, and in particular of clinical study reports on medicinal products for human use.
24. Lastly, in paragraphs 58 to 75 of that judgment, the General Court rejected the appellant’s arguments claiming the existence of a general presumption of confidentiality with respect to the report at issue.
25. In the second place, in paragraphs 76 to 95 of the judgment under appeal, the General Court addressed the second plea which alleged failure to comply with Article 4(2) of Regulation No 1049/2001 and was based on the premiss that the report at issue should have been regarded in its entirety as confidential commercial information protected by that provision.
26. In paragraphs 81 to 83 of that judgment, the General Court recalled that the risk of a protected interest being undermined had to be reasonably foreseeable and not purely hypothetical, and that application of one of the exceptions laid down in Article 4 of Regulation No 1049/2001 required the institution concerned to weigh the particular interest to be protected through non-disclosure of the document concerned against the public interest in the document being made accessible.
27. The General Court recalled that, according to its case-law, it is not possible to regard all information concerning a company and its business relations as requiring the protection which must be guaranteed to commercial interests.
28. In paragraph 89 of that judgment, the General Court held that the appellant had failed to show ‘that the assembly of the publicly accessible data together with the data which is not publicly accessible [constituted] a commercially sensitive item of data’, forming an ‘inseparable whole with economic value’, whose disclosure would undermine the commercial interests of the appellant.
29. In paragraph 90 of the judgment under appeal, the General Court rejected the argument that disclosure of the report at issue would provide competitors with a ‘road map’ on how to file an MA application. It held that the disclosure of the report at issue would not provide the applicant’s competitors with any valuable insight regarding the long-term clinical development strategy and ‘study design’ in addition to the data already available to the public for the medicinal product Translarna, given that the models and methodologies used in the clinical study concerned were based on know-how that is widely available in the scientific community.
30. In paragraphs 91 to 93 of that judgment, the General Court pointed out that the appellant had not adduced any evidence to explain why the EMA’s redactions were insufficient. The General Court recalled that, according to the EMA’s own policy, the EMA did not disclose commercially confidential information, such as detailed information on the quality and manufacturing of medicinal products. Therefore, even if another undertaking were to use the data contained in the report at issue, that undertaking would still have to carry out its own relevant studies and trials and successfully develop its own medicinal product. The General Court noted that Translarna has market exclusivity for a period of 10 years following the issuance of the MA, during which time no similar medicinal product may be marketed.
31. Lastly, the General Court rejected, in paragraph 94 of that judgment, the argument that disclosure of the report at issue would enable the appellant’s competitors to obtain an MA from the authorities of third countries.
32. In the third place, the General Court addressed, in paragraphs 96 to 103 of the judgment under appeal, the third plea which alleged that disclosure of the report at issue would undermine the EMA’s decision-making process.
33. The General Court found that the procedure for granting the MA was closed on the date that the request for access to the report at issue was submitted by a third party.
34. In the fourth place, the General Court rejected, in paragraphs 104 to 109 of that judgment, the fourth plea which alleged that the EMA had failed to weigh up the interests at stake.
35. In the fifth place, the General Court rejected, in paragraphs 110 to 113 of the judgment under appeal, the fifth plea which alleged that a proper balancing exercise would have resulted in a decision not to disclose any part of the report at issue.
36. Consequently, in point 1 of the operative part of the judgment under appeal, the General Court dismissed the action.

Forms of order sought

37. The appellant claims that the Court should:

– set aside the judgment under appeal;

– annul the decision at issue;

– remit the decision to the EMA in order that the EMA may adopt a new decision in consultation with the appellant; and

– order the EMA to pay the costs and other expenses relating to the present matter.

38. The EMA contends that the Court should:

– dismiss the appeal as in part inadmissible in so far as the Court is requested to ‘remit the said decision back to the EMA for further consideration regarding redaction of confidential passages for consultation with [the appellant];

– dismiss the appeal as unfounded in its entirety; and

– order the appellant to pay the costs of the current proceedings.

39. Eucope contends that the Court should:

– set aside the judgment under appeal, and

– annul the decision at issue.

The appeal

40. In support of its appeal, the appellant raises five grounds of appeal. By its first ground of appeal, it claims that the General Court erred in law in finding that the report at issue was not protected by a general presumption of confidentiality. By its second ground of appeal, it claims that the General Court erred in law by not finding that that report constituted commercially confidential information, the disclosure of which had to be refused by virtue of application of the exception to the right of access to documents laid down in the first indent of Article 4(2) of Regulation No 1049/2001. By its third ground of appeal, it claims that the General Court also infringed Article 4(3) of that regulation by finding that that report was not protected by the exception to the right of access to documents laid down in that provision. By its fourth and fifth grounds of appeal, which it submits together, it claims that the EMA erred in law by failing to weigh up the interests at stake.

The first ground of appeal

Arguments of the parties

41. By its first ground of appeal, the appellant claims, in the first place, that the General Court erred in law in finding that the report at issue was not protected by a general presumption of confidentiality.
42. It submits that, in paragraph 64 of that judgment, the General Court incorrectly interpreted its line of argument in so far as recognition of the application of a general presumption of confidentiality does not, in the appellant’s view, entail giving the protection of confidentiality absolute precedence, as such a presumption could always be rebutted in a particular case.
43. In the second place, the appellant submits that, in paragraphs 37 to 57 of the judgment under appeal, the General Court misapplied the criteria for recognising the existence of a general presumption of confidentiality in the present case.
44. First, it notes that, while Article 73 of Regulation No 726/2004 provides that Regulation No 1049/2001 applies to documents held by the EMA, this does not mean that the documents included in a file submitted in the context of an MA application are presumed to be disclosable.
45. The appellant highlights the fact that Regulation No 726/2004 contains a series of disclosure requirements which ensure that the EMA’s decision-making process is suitably transparent and which constitute specific and detailed provisions regarding the information that is to be made publicly available, given that that regulation provides for no general right of access to the file for anyone at all.
46. Secondly, the appellant submits that the General Court erred in law in paragraphs 39 to 45 of the judgment under appeal by failing to consider whether the procedure in question would be harmed by the prospect of commercially sensitive information being released after its closure, given that commercially sensitive information remains commercially sensitive even where a procedure has closed.
47. Thirdly, it claims that the General Court erred in law in paragraphs 54 and 55 of that judgment in so far as it relied on the EMA’s own policy on access to documents as a source of law to justify the EMA’s conduct in that regard.
48. Fourthly, the appellant alleges that the General Court failed to interpret Regulation No 1049/2001 in accordance with the TRIPS Agreement. It argues that that agreement applies to documents submitted by MA applicants and allows disclosure of confidential information only where this is necessary to protect the public.
49. Fifthly, the appellant submits that the General Court incorrectly assessed, in paragraphs 67 to 74 of the judgment under appeal, the justifications submitted by the EMA.
50. The EMA contends that the appellant’s arguments should be rejected.

Findings of the Court

51. It should be borne in mind that, in accordance with recital 1 thereof, Regulation No 1049/2001 reflects the intention expressed in the second paragraph of Article 1 TEU to mark a new stage in the process of creating an ever closer union among the peoples of Europe, in which decisions are taken as openly as possible and as closely as possible to the citizen (judgments of 1 July 2008, Sweden and Turco v Council, C‑39/05 P and C‑52/05 P, EU:C:2008:374, paragraph 34, and of 4 September 2018, ClientEarth v Commission, C‑57/16 P, EU:C:2018:660, paragraph 73).
52. That core EU objective is also reflected in Article 15(1) TFEU, which provides that the institutions, bodies, offices and agencies of the European Union are to conduct their work as openly as possible, that principle of openness also being expressed in Article 10(3) TEU and in Article 298(1) TFEU, and in the enshrining of the right of access to documents in Article 42 of the Charter of Fundamental Rights of the European Union (judgment of 4 September 2018, ClientEarth v Commission, C‑57/16 P, EU:C:2018:660, paragraph 74 and the case-law cited).
53. It can be seen from recital 2 of Regulation No 1049/2001 that openness enables the EU institutions to have greater legitimacy and to be more effective and more accountable to EU citizens in a democratic system (see, to that effect, judgments of 1 July 2008, Sweden and Turco v Council, C‑39/05 P and C‑52/05 P, EU:C:2008:374, paragraphs 45 and 59, and of 4 September 2018, ClientEarth v Commission, C‑57/16 P, EU:C:2018:660, paragraph 75).
54. To those ends, Article 1 of Regulation No 1049/2001 provides that the purpose of that regulation is to confer on the public as wide a right of access as possible to documents of the EU institutions (judgment of 4 September 2018, ClientEarth v Commission, C‑57/16 P, EU:C:2018:660, paragraph 76 and the case-law cited).
55. It is also apparent from Article 4 of that regulation, which introduces a system of exceptions in that regard, that that right is, nevertheless, subject to certain limits based on reasons of public or private interest (judgments of 16 July 2015, ClientEarth v Commission, C‑612/13 P, EU:C:2015:486, paragraph 57, and of 4 September 2018, ClientEarth v Commission, C‑57/16 P, EU:C:2018:660, paragraph 77).
56. As such exceptions depart from the principle of the widest possible public access to documents, they must be interpreted and applied strictly (judgment of 4 September 2018, ClientEarth v Commission, C‑57/16 P, EU:C:2018:660, paragraph 78 and the case-law cited).
57. In that regard, it should be borne in mind that where an EU institution, body, office or agency that has received a request for access to a document decides to refuse to grant that request on the basis of one of the exceptions laid down in Article 4 of Regulation No 1049/2001, it must, in principle, explain how access to that document could specifically and actually undermine the interest protected by that exception, and the risk of the interest being undermined must be reasonably foreseeable and must not be purely hypothetical (judgment of 4 September 2018, ClientEarth v Commission, C‑57/16 P, EU:C:2018:660, paragraph 51 and the case-law cited).
58. In certain cases, the Court has acknowledged that it is however open to that institution, body, office or agency to base its decisions in that regard on general presumptions which apply to certain categories of documents, as considerations of a generally similar kind are likely to apply to requests for disclosure relating to documents of the same nature (judgment of 4 September 2018, ClientEarth v Commission, C‑57/16 P, EU:C:2018:660, paragraph 51 and the case-law cited).
59. The objective of such presumptions is thus the possibility, for the EU institution, body, office or agency concerned, to consider that the disclosure of certain categories of documents undermines, in principle, the interest protected by the exception which it is invoking, by relying on such general considerations, without being required to examine specifically and individually each of the documents requested (judgment of 4 September 2018, ClientEarth v Commission, C‑57/16 P, EU:C:2018:660, paragraph 52 and the case-law cited).
60. However, an EU institution, body, office or agency is not required to base its decision on such a general presumption, but may always carry out a specific examination of the documents covered by a request for access and provide reasons stemming from that specific examination (judgment of 14 November 2013, LPN and Finland v Commission, C‑514/11 P and C‑605/11 P, EU:C:2013:738, paragraph 67).
61. It follows that recourse to a general presumption of confidentiality is merely an option for the EU institution, body, office or agency concerned and the latter always retains the possibility of carrying out a specific and individual examination of the documents in question to determine whether they are protected, in whole or in part, by one or more of the exceptions laid down in Article 4 of Regulation No 1049/2001.
62. Thus, the premiss on which the first ground of appeal is based is wrong as a matter of law. By arguing that ‘the application of the general presumption of confidentiality is not optional, in the sense that it applies as a matter of law where it is engaged and must be taken into account by the EMA when it takes its decision’, the appellant misconstrues the scope to be given to the rule on the examination of requests for access to documents, as set out in the judgment of the Court of Justice of 14 November 2013, LPN and Finland v Commission (C‑514/11 P and C‑605/11 P, EU:C:2013:738, paragraph 67), according to which, on the contrary, the application of a general presumption of confidentiality is always optional for the EU institution, body, office or agency to which such a request is addressed.
63. In addition, the specific and individual examination is appropriate to ensure that the EU institution, body, office or agency has verified whether the disclosure of all the documents or parts of documents to which access was requested could specifically and actually undermine one or more of the interests protected by the exceptions mentioned in Article 4 of Regulation No 1049/2001.
64. In the present case, it is common ground that the EMA carried out a specific and individual examination of the whole of the report at issue, as a result of which it redacted certain passages containing references to protocol design discussions with the US Food and Drug Administration, batch numbers, materials and equipment, exploratory assays, the quantitative and qualitative description of the method for drug concentration measurement, and the start and end dates of treatment and additional dates that could lead to the identification of patients.
65. It is apparent from the foregoing considerations that, in so far as, by the first ground of appeal, the appellant alleges, in essence, that the General Court erred in law by considering that the report at issue was not protected by a general presumption of confidentiality, that ground of appeal cannot succeed and must be rejected as unfounded.
66. As to the remainder, in so far as, by the first ground of appeal, the appellant contests the grounds set out in the judgment under appeal on which the General Court held that a presumption analogous to those recognised in the case-law of the Court of Justice in relation to other categories of documents cannot be recognised with regard to documents held by the EMA, such as the report at issue, that ground of appeal must be rejected as ineffective.
67. Indeed, that part of the judgment under appeal in fact sets out grounds that were included for the sake of completeness, since it concerns a question that had no bearing on the outcome of the dispute before the General Court. Even if, contrary to what the General Court held, a general presumption of confidentiality were also recognised with regard to the documents held by the EMA, such as the report at issue, it follows from paragraph 61 above that the EMA was not required to base its decision on such a presumption and was entitled, as it did, to carry out a specific and individual examination of the document concerned in order to determine whether and to what extent it could be disclosed.
68. In the light of all of the foregoing, the first ground of appeal must be rejected.

The second ground of appeal

Arguments of the parties

69. By its second ground of appeal, the appellant submits that, in the present case, the General Court failed to apply the protection of commercial interests conferred by the first indent of Article 4(2) of Regulation No 1049/2001.
70. In the first place, it claims that the General Court erred in law by finding that the report at issue was not composed, in its entirety, of commercially confidential information protected by that provision.
71. In the second place, it submits that paragraph 83 of the judgment under appeal is vitiated by an error of law in so far as it is apparent from that paragraph that the General Court assumed that the EMA had weighed up the interests of commercial confidentiality against the overriding public interest in disclosure of the report at issue. However, the EMA based its finding that it was possible to disclose the report at issue solely on the non-confidential nature of that report, without carrying out a balancing exercise.
72. In the third place, the appellant claims that the General Court erred in law in finding, in paragraph 85 of that judgment, that application of the exception laid down in the first indent of Article 4(2) of Regulation No 1049/2001 depended on how seriously the commercial interests would be undermined.
73. In the fourth place, the appellant submits that the General Court failed to take account of the value of the report at issue and of the risk of misuse of that report by a competitor when assessing whether the risk of its commercial interests being undermined was reasonably foreseeable. It submits that the General Court should have examined whether such a competitor could use that report to gain a competitive advantage, especially outside the European Union.
74. In the fifth place, the appellant claims that the General Court, in paragraph 90 of that judgment, made an error in respect of the applicable standard of proof by requiring it to establish that the report at issue contained innovative or novel information. It claims that the General Court did not take into consideration the witness evidence it had submitted, from which it is apparent that it was reasonably foreseeable that disclosure of the full report would make it easier for its competitors to obtain MAs, especially outside the European Union.
75. In the sixth place, it criticises the General Court for failing to take into account the fact that the EMA wrongly considered that it has discretionary power when assessing the confidential nature of commercial information contained in a document which it has been asked to disclose.
76. Eucope contends, in essence, that, pursuant to Article 39(3) of the TRIPS Agreement, States who are signatories to that agreement are required to protect undisclosed data and that, therefore, the party who submitted those data may not bear the burden of proving ‘with absolute certainty’ that its data will be put to unfair commercial use.
77. The EMA contends that the appellant’s arguments should be rejected.

Findings of the Court

78. It should be noted that, in its second ground of appeal, the appellant submits, in the first place, that the General Court erred in law by not finding that the whole of the report at issue should be regarded as composed, in its entirety, of commercially confidential data.
79. It should be borne in mind that, by the decision at issue, the EMA granted partial access to the report at issue, redacting the data specified in paragraphs 15 and 64 above.
80. For the purpose of challenging the grounds on the basis of which the General Court ruled on the merits of disclosing the other passages of the report at issue, the appellant merely submits, in essence, first, that the General Court adopted an erroneous approach when determining whether the report contained confidential data, in so far as it failed to take into account the reasonably foreseeable prospect that it would be misused by a competitor and, secondly, that the General Court should have determined whether the assembly of the data contained in the whole of that report had commercial value.
81. It is true that the EMA cannot rule out from the outset the possibility that certain passages of a clinical study report, specifically identified by an undertaking, may contain data which, if disclosed, would harm the commercial interests of that undertaking within the meaning of the first indent of Article 4(2) of Regulation No 1049/2001. Where such an undertaking identifies a concrete and reasonably foreseeable risk that certain unpublished data contained in a report such as the report at issue, which cannot be regarded as being a matter of common knowledge within the pharmaceutical industry, could be used in one or more third States by a competitor of that undertaking for the purpose of obtaining an MA, thereby unfairly benefiting from the work done by that undertaking, it may be possible to establish such harm.
82. However, by its arguments, the appellant does not explain why the General Court erred in law when it found that the passages of the report at issue that had been disclosed did not constitute data capable of falling within the scope of the exception relating to the protection of commercial interests, laid down in the first indent of Article 4(2) of Regulation No 1049/2001, without the appellant having specifically and precisely identified before the EMA or in the application submitted to the General Court which of those passages, if disclosed, could harm its commercial interests.
83. Moreover, the appellant’s line of argument is tantamount to invoking a general presumption of confidentiality in relation to the whole of the report at issue in the context of a ground of appeal contesting the General Court’s assessment of the result of the specific and individual examination on the basis of which the EMA decided to grant partial access to that report. In the light of what has been held in paragraphs 64 and 65 above, that line of argument must be rejected.
84. In the second place, the appellant submits that paragraph 83 of the judgment under appeal is vitiated by an error of law in so far as the General Court suggests that the EMA has weighed the appellant’s confidential commercial interests against the overriding public interest in transparency, whereas in the decision at issue the EMA relied solely on the non-confidential nature of the report at issue.
85. In that regard, it is apparent from reading paragraphs 78 to 95 of the judgment under appeal in their entirety, in which the General Court addressed the second plea in law in the action for annulment, that that court recalled, in paragraphs 78 to 85 of that judgment, the case-law on the principles and rules for examining requests for access to documents under Regulation No 1049/2001, including the rule on balancing interests, in paragraph 83 thereof, before concluding, following an examination in paragraphs 87 to 95 of that judgment, in the context of which that rule was not applied, that the appellant had failed to establish that the EMA had erred in considering that the data contained in the report at issue were not confidential.
86. Moreover, it should be noted that the General Court specified, in paragraph 83 of the judgment under appeal, that the balancing of interests is carried out only ‘if an institution applies one of the exceptions provided for in Article 4 of Regulation No 1049/2001’. As the General Court rightly held in paragraph 108 of the judgment under appeal, since the EMA had not concluded that the report at issue should be protected by one or more of those exceptions, it was not obliged to determine or assess the public interest in the disclosure of that report, nor to weigh it against the appellant’s interest in keeping that report confidential.
87. The appellant’s argument must therefore be rejected.
88. In the third place, the appellant submits, in essence, that the General Court erred in law, in paragraph 85 of the judgment under appeal, by holding that the application of the exception laid down in the first indent of Article 4(2) of Regulation No 1049/2001 required the commercial interests to be undermined to a serious extent.
89. When paragraphs 78 to 95 of the judgment under appeal, by which the General Court addressed the second plea in law in the action for annulment, are read as a whole, it is apparent that paragraph 85 is included in the part of that judgment constituted by its paragraphs 78 to 85, in which the General Court merely recalled the case-law on the principles and rules governing the examination of requests for access to documents formulated on the basis of Regulation No 1049/2001.
90. In so far as English is the language of the case in Case T‑718/15 and the English version of the judgment under appeal includes the word ‘seriously’, which is not contained in Article 4(2) of Regulation No 1049/2001, it must be held that that judgment is vitiated by an error of law. It is apparent from the very wording of that provision that any undermining of the interests concerned is capable of justifying the application, as the case may be, of one of the exceptions listed therein, without it being necessary for that interference to reach a particular threshold of seriousness.
91. However, it is apparent from paragraphs 87 to 95 of that judgment that, for the purposes of ruling on the second plea in law in the action for annulment, the General Court did not rely in any way on the seriousness of the harm done to the appellant’s commercial interests when concluding that the exception laid down in that regard by the first indent of Article 4(2) of Regulation No 1049/2001 was not applicable in the present instance. In those circumstances, the error of law on the part of the General Court referred to in paragraph 90 above has no impact on the assessment made by the General Court and cannot therefore lead to the setting aside of the judgment under appeal.
92. In the fourth place, the appellant submits that, for the purpose of determining whether there was a risk that disclosure of the report at issue could harm its commercial interests, the General Court erred in its assessment of the value of the report and the risk of misuse of that report by its competitors, especially in the context of procedures for issuing MAs outside the European Union.
93. In paragraph 91 of the judgment under appeal, the General Court held that the risk of misuse of the report at issue by a competitor did not in itself constitute grounds for considering that information to be commercially confidential. The General Court also pointed out that the appellant had failed to establish that the redactions of the report carried out by the EMA were insufficient.
94. In that regard, it should be borne in mind that, where an EU institution, body, office or agency that has received a request for access to a document decides to refuse to grant that request on the basis of one of the exceptions laid down in Article 4 of Regulation No 1049/2001 to the fundamental principle of openness recalled in paragraph 52 above, it must, in principle, explain how access to that document could specifically and actually undermine the interest protected by that exception. Moreover, the risk of that undermining must be reasonably foreseeable and not purely hypothetical (judgment of 4 September 2018, ClientEarth v Commission, C‑57/16 P, EU:C:2018:660, paragraph 51 and the case-law cited).
95. Likewise, it is for a person who is seeking the application of one of those exceptions by an institution, body, office or agency to which that regulation applies to provide, in due time, equivalent explanations to the EU institution, body, office or agency in question.
96. It is true that, as held in paragraph 81 above, the risk of misuse of data contained in a document to which access is requested may undermine the commercial interests of an undertaking in certain circumstances. Nevertheless, in view of the requirement to provide explanations of the sort referred to in paragraph 95 above, the existence of such a risk must be established. In that regard, a mere unsubstantiated claim relating to a general risk of misuse cannot lead to those data being regarded as falling within the scope of the exception laid down in the first indent of Article 4(2) of Regulation No 1049/2001 where the person seeking the application of that exception by the institution, body, office or agency in question has not adduced, prior to it taking a decision in that respect, additional details, concerning the nature, purpose and scope of the data, that are capable of enabling the Courts of the European Union to understand how disclosure of those data would be likely concretely and reasonably foreseeably to undermine the commercial interests of the persons concerned thereby.
97. As is apparent from paragraph 82 above, the appellant failed to establish, in its application before the General Court, that it had provided the EMA, prior to the adoption of the decision at issue, and notwithstanding the fact that it had the opportunity to express its views on the possible confidentiality of certain information contained in the report at issue, with explanations on the nature, purpose and scope of the data in question that is capable of establishing that the alleged risk exists, having regard, in particular, to the considerations set out in paragraphs 89 to 92 of the judgment under appeal, from which it is apparent that disclosure of such data was not likely to undermine the appellant’s legitimate interests. In particular, the appellant’s argument is not capable of establishing that the General Court erred in law when it considered, in paragraph 89 of the judgment under appeal, that the appellant had failed to demonstrate that the assembly of the publicly accessible data together with the data which are not publicly accessible constitutes a commercially sensitive item of data whose disclosure would undermine its commercial interests.
98. The appellant’s argument must therefore be rejected.
99. In the fifth place, the appellant criticises the standard of proof required by the General Court in paragraph 90 of the judgment under appeal and the fact that the General Court did not take into account the witness evidence from which it is apparent that it was reasonably foreseeable that disclosure of the full report would make it easier for its competitors to obtain MAs, especially outside the European Union.
100. It is certainly true that the General Court found, in paragraph 90 of the judgment under appeal, that the appellant had failed to show any novelty in the models, assays or methodologies included in the report at issue. In so doing, it confirmed the EMA’s assessment that the models and methodologies used in the clinical study in question were based on know-how that is ‘widely available in the scientific community’.
101. The General Court then pointed out that the report at issue did not, however, contain any information on the composition or manufacturing of the medicinal product Translarna, given that the EMA had redacted such data and the data relating to the long-term clinical development strategy and study design. Accordingly, the General Court did not err in law in rejecting the appellant’s argument that disclosure of the report at issue would provide the appellant’s competitors with a ‘road map’ on how to file an MA application for a product competing with that of the appellant.
102. As regards the witness evidence adduced by the appellant for the purpose of establishing the risk of misuse to which disclosure of the full report would expose the appellant by making it easier for its competitors to obtain MAs, especially outside the European Union, it should be borne in mind that, according to the settled case-law of the Court of Justice, the General Court is not required to provide an account that follows exhaustively and one by one all the arguments put forward by the parties to the case. Consequently, the reasoning may be implicit on condition that it enables the persons concerned to know why the General Court has not upheld their arguments and provides the Court of Justice with sufficient material for it to exercise its power of review. In particular, the General Court is not required to respond to the arguments of a party which are not sufficiently clear and precise, in that they have not been expanded upon or accompanied by a specific line of argument intended to support them (see, to that effect, judgments of 9 September 2008, FIAMM and Others v Council and Commission, C‑120/06 P and C‑121/06 P, EU:C:2008:476, paragraphs 91 and 96, and of 5 July 2011, Edwin v OHIM, C‑263/09 P, EU:C:2011:452, paragraph 64).
103. The witness evidence in question is in fact intended to support the appellant’s line of argument regarding the application of a general presumption of confidentiality. As is apparent from paragraphs 64, 65 and 83 above, that line of argument cannot succeed in the light of, inter alia, the fact that the EMA carried out a specific and individual examination of the whole of the report at issue. For the same reason, the General Court rejected a plea alleging a failure to state reasons on the part of the EMA on the ground that the latter had not explained the reasons why such a presumption was not applicable, in paragraphs 67 to 70 of the judgment under appeal.
104. In those circumstances, it must be held that the General Court, having rejected that plea, was not required to examine the witness evidence at issue in relation to the application of a general presumption of confidentiality. Moreover, that witness evidence does not identify any specific passage of the report at issue whose disclosure would be detrimental to the appellant’s commercial interests for specific reasons. Accordingly, the General Court had no reason to take that evidence into consideration when examining a more specific argument regarding the possible confidentiality of such passages.
105. In any event, in accordance with the findings in paragraphs 96 and 97 above, it was for the appellant to submit to the EMA, during the administrative procedure before that agency, explanations on the nature, purpose and scope of the data whose disclosure would undermine its commercial interests. It must be noted that the witness evidence in question was not submitted to the EMA before the adoption of the decision at issue on 25 November 2015, given that it is dated 8 and 9 December 2015. Thus, the General Court was entitled to hold, implicitly but necessarily, that those documents were not relevant for its assessment of the legality of the decision at issue.
106. Consequently, those arguments must be rejected.
107. In the sixth place, although the appellant criticises the General Court for not taking account of the fact that the EMA wrongly considered that it has discretionary power when assessing the confidential nature of commercial information contained in a document which it has been asked to disclose, that argument is based on an incorrect premiss. It is apparent from the judgment under appeal that the EMA, far from exercising discretionary power in relation to the request for access to the report at issue, carried out a specific and individual examination of that report in order to determine which of the data contained therein fell, in its view, within the exception laid down in the first indent of Article 4(2) of Regulation No 1049/2001 and that the EMA then refused access to those data.
108. In that regard, it should also be pointed out that the appellant had been invited by the EMA to submit its observations on the confidentiality of the various data contained in that report and that it refrained from cooperating in that respect.
109. The appellant’s argument must therefore be rejected.
110. In the seventh place, Eucope argues that under Article 39(3) of the TRIPS Agreement, members of the TRIPS Agreement are required to protect undisclosed data and that, therefore, the party that submitted such data may not bear the burden of proving ‘with absolute certainty’ that its data will be put to unfair commercial use.
111. In that regard, it must be noted, as was correctly recalled by the General Court in paragraph 62 of the judgment under appeal, and as the Advocate General emphasised in point 87 of his Opinion, that, while Article 39 of the TRIPS Agreement may not be invoked directly, the rules of EU law, and in particular Article 4 of Regulation No 1049/2001 in the present context, must nevertheless be interpreted in a manner consistent with that agreement in so far as it is possible to do so (see, to that effect, judgment of 11 September 2007, Merck Genéricos — Produtos Farmacêuticos, C‑431/05, EU:C:2007:496, paragraph 35).
112. Although it is true that Article 39(3) of the TRIPS Agreement requires members of the TRIPS Agreement to protect undisclosed test or other data, the origination of which involves a considerable effort, against unfair commercial use, that fact does not, in itself, mean that the data contained in a clinical study report, such as the report at issue, must be viewed as data whose disclosure is likely to undermine the commercial interests of the person who produced them.
113. As is apparent from paragraph 95 above, it is for a person who is seeking the application, by an EU institution, body, office or agency, of one of the exceptions laid down in Article 4 of Regulation No 1049/2001 to provide, in due time, explanations to that institution, body, office or agency as to how access to that document could specifically and actually undermine the interest protected by that exception. Such a requirement is not incompatible with Article 39(3) of the TRIPS Agreement, taking into account, inter alia, the period of data exclusivity provided for in Article 14(11) of Regulation No 726/2004.
114. Furthermore, Article 39(3) of the TRIPS Agreement has neither the objective nor the effect of defining ‘commercial interests’ within the meaning of the first indent of Article 4(2) of Regulation No 1049/2001.
115. Moreover, it is not apparent from the judgment under appeal that the General Court placed the burden of proof on the appellant to prove ‘with absolute certainty’ that its data would be put to unfair commercial use.
116. Consequently, that argument and, therefore, the second ground of appeal must be rejected.

The third ground of appeal

Arguments of the parties

117. By its third ground of appeal, the appellant submits that the General Court erred in law by finding that, as it holds a conditional MA and must regularly submit applications for renewal of that MA, in the context of which it must submit updated studies relating to the report at issue, that report is not protected by Article 4(3) of Regulation No 1049/2001. Thus, the disclosure of sensitive information could compromise the EMA’s decision-making process as regards those applications for renewal.
118. It notes that a subsequent decision to grant a ‘full’ MA must take account of all the studies produced by the MA applicant and that the disclosure of sensitive information could compromise the procedure for granting such an MA.
119. It states that the disclosure of the report at issue during the period of data exclusivity would seriously undermine the EMA’s decision-making process in respect of generic medicinal product MA applications received during that period, which could be based on the data in that report.
120. Lastly, the appellant claims that the General Court based its reasoning regarding whether the report at issue would be used in the decision-making process for issuing a full MA on an incorrect factual basis in paragraphs 101 and 102 of the judgment under appeal.
121. The EMA contends that the appellant’s arguments should be rejected.

Findings of the Court

122. By the line of argument used in support of its third ground of appeal, the appellant submits that the EMA’s decision-making process to which the report at issue relates has not yet been completed. The appellant thus claims that the General Court has infringed the first subparagraph of Article 4(3) of Regulation No 1049/2001, which concerns access to a document relating to a matter on which an EU institution, body, office or agency has not yet taken a decision.
123. The General Court rightly found, in paragraph 100 of the judgment under appeal, that the report at issue had been submitted by the appellant to the EMA in the context of an MA application for the medicinal product Translarna which had already been closed at the date of the request for access to that report.
124. Although the appellant claims that the General Court did not take account of the fact that the report at issue was relevant in the decision-making process relating to applications for the annual renewal of the conditional MA, it did not raise that issue in its action at first instance. Therefore, that argument, put forward for the first time in the appeal before the Court of Justice, must be rejected as inadmissible.
125. As regards the error of law allegedly committed by the General Court through its reliance on substantially inaccurate facts for the purpose of rejecting, in paragraphs 101 and 102 of the judgment under appeal, the argument based on the report at issue being relevant in the context of a ‘full’ MA procedure, it should be borne in mind that the Court of Justice has no jurisdiction to establish the facts and that, save where the facts are distorted, the assessment of those facts does not constitute a point of law open, as such, to review by the Court of Justice on appeal (see, to that effect, judgment of 4 June 2015, Stichting Corporate Europe Observatory v Commission, C‑399/13 P, not published, EU:C:2015:360, paragraph 26).
126. In its third ground of appeal, the appellant does not identify any specific fact that has allegedly been distorted by the General Court. In so far as it invokes the fact that the data in the report at issue were combined with data from a subsequent trial as evidence in support of maintaining the conditional MA during the renewal process, it is sufficient to note that that fact does not in any way establish that the report at issue will be used in the separate decision-making process for issuing a full MA.
127. The appellant also claims that the General Court was wrong not to take into account the need to protect the data contained in the report at issue throughout the period of data exclusivity, as provided for in Article 8 of Regulation No 141/2000. However, such an argument is not capable of demonstrating that the General Court infringed the provisions of the first subparagraph of Article 4(3) of Regulation No 1049/2001, under which disclosure to third parties of documents forming part of a decision-making process still pending at the date on which the decision on the request for access is adopted must be refused. The view cannot be taken that a decision-making process, within the meaning of the latter provision, is pending throughout the entire period of exclusivity provided for in Article 8 of Regulation No 141/2000.
128. Lastly, although the appellant criticises the General Court for not assessing the argument that disclosure of the report at issue during the period of data exclusivity would seriously undermine the decision-making process relating to potential MA applications for generic medicinal products during that period, it must be noted that in doing so it refers to decision-making processes that are separate from the decision-making process in relation to which that report was submitted, which is not such as to call into question the General Court’s finding, in paragraph 100 of the judgment under appeal, that the latter decision-making process, namely the procedure for grant of Translarna’s conditional MA, was closed on the date of the request for access to that report.
129. Consequently, the third ground of appeal must be rejected.

The fourth and fifth grounds of appeal

Arguments of the parties

130. By its fourth and fifth grounds of appeal, the appellant criticises the General Court for not addressing its arguments to the effect that, since Article 4(2) and (3) of Regulation No 1049/2001 was applicable to the report at issue, the EMA should have weighed up the interests at stake to determine whether there was an overriding public interest in the disclosure of that report, which would take precedence over the confidential nature of that report, before concluding that there was no such public interest.
131. The appellant notes that, in the decision at issue, the EMA relied on grounds that may not lawfully be covered by the concept of overriding public interest, such as general public health concerns and almost full paralysis of the access to documents held by that agency.
132. The EMA contends that the appellant’s arguments should be rejected.

Findings of the Court

133. In so far as, by its arguments, the appellant claims that the EMA relied on considerations that may not lawfully be covered by the concept of overriding public interest, it does not criticise any aspect of the reasoning of the judgment under appeal, but merely challenges the content of the decision at issue. Therefore, these claims must be rejected as inadmissible.
134. As to the remainder, it is sufficient, in order to reject those grounds of appeal, to hold that the General Court did not err in law, in paragraph 108 of the judgment under appeal, in finding that, as the EMA did not conclude that the report at issue should be protected by the exceptions referred to in Article 4(2) and (3) of Regulation No 1049/2001, it was under no obligation to determine or assess the public interest in the disclosure of that report, nor to weigh it against the appellant’s interest in keeping that report confidential.
135. Consequently, the fourth and fifth grounds of appeal must be rejected.
136. It follows from all of the foregoing that, without it being necessary to rule on the plea of inadmissibility directed against the head of claim that the EMA should be ordered to reconsider the decision at issue, the present appeal must be dismissed.

Costs

137. In accordance with Article 184(2) of the Rules of Procedure of the Court of Justice, where the appeal is unfounded, the Court is to make a decision as to costs.
138. Under Article 138(1) of those rules, applicable to appeal proceedings by virtue of Article 184(1) thereof, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings.
139. Since the EMA has applied for costs and the appellant has been unsuccessful, the latter must be ordered to bear its own costs and to pay those incurred by the EMA.
140. In accordance with Article 140(3) of the Rules of Procedure, applicable to appeal proceedings by virtue of Article 184(1) thereof, Eucope is to bear its own costs.

On those grounds, the Court (Fourth Chamber) hereby:

1.Dismisses the appeal;

2.Orders PTC Therapeutics International Ltd to bear its own costs and to pay those incurred by the European Medicines Agency (EMA);

3.Orders the European Confederation of Pharmaceutical Entrepreneurs to bear its own costs.

Vilaras

Lenaerts

Rodin

Šváby

Piçarra

Delivered in open court in Luxembourg on 22 January 2020.

1. Calot Escobar

Registrar

1. Vilaras

President of the Fourth Chamber

( *1 ) Language of the case: English.