Where an investor has been scammed by a company and he writes to his national financial services authority asking it to release documents about the company, when can the authority refuse that request on the ground of ‘professional secrecy’, an escape route found in Article 54 of the EU’s ‘financial instruments’ Directive 2004/39/EC?
Mr Baumeister was duped into investing in a financial scheme that turned out to be a pyramid scam. As a result, he lost money.
He wrote to the German financial services authority, the Bundesanstalt für Finanzdienstleistungsaufsicht. He asked the authority to provide him with copies of all the documents relating to the scam. In particular, he wanted access to: the authority’s special audit of the scamming company; the reports written by the accountants; the internal memos; and all the correspondence between the authority and the company.
His request for this information was turned down. Undeterred, he asked the authority to review its decision under the auspices of the authority’s own internal appeals procedure. Successive internal appeals did not lead to the information being released.
Mr Baumeister therefore turned to the first instance court in Frankfurt which deals with matters of administrative law, the Verwaltungsgericht in Frankfurt am Main.
The Frankfurt court partly allowed Mr Baumeister’s request. However, it partly found for the authority in so far as the court held that the authority was not obliged to release any information that related to the UK’s Financial Services Authority.
The Frankfurt court’s judgment pleased neither Mr Baumeister nor the authority. The judgment was appealed by both parties to the appellate court, the Verwaltungsgerichtshof in the German city of Kassel.
At the Verwaltungsgerichtshof in Kassel
The judges at the appellate court in Kassel produced a judgment that only partly allowed the parties’ various grounds of appeal. That is to say, the court held that not only did Mr Baumeister have the right to request information from the authority, the authority could not just refuse his request by relying on some general notion of confidentiality – a nebulous notion of confidentiality did not exist in the German credit legislation.
However, the court in Kassel acknowledged the fact that the German credit legislation would allow the authority to refuse Mr Baumeister’s request in so far as the authority was under a specific obligation to preserve confidentiality in respect of corporate, commercial secrets in an individual case, or third party data protection rights.
That said, in this case, the authority had failed to explain or rely on the narrower, particular obligation to maintain confidentiality. Having failed to properly reason any reliance being placed on the narrower obligation, the appellate court held that the authority had no right to refuse Mr Baumeister’s request to access the information.
The appellate court also noted that EU law would not lead to a different result. The relevant legislation was the EU’s ‘markets in financial instruments’ Directive 2004/39/EC amending Council Directives 85/611/EEC and 93/6/EEC and Directive 2000/12/EC of the European Parliament and of the Council and repealing Council Directive 93/22/EEC OJ  L145/1.
Article 54 of the Directive governs ‘Professional secrecy’ and provided:
1. Member States shall ensure that competent authorities, all persons who work or who have worked for the competent authorities or entities to whom tasks are delegated pursuant to Article 48(2), as well as auditors and experts instructed by the competent authorities, are bound by the obligation of professional secrecy. No confidential information which they may receive in the course of their duties may be divulged to any person or authority whatsoever, save in summary or aggregate form such that individual investment firms, market operators, regulated markets or any other person cannot be identified, without prejudice to cases covered by criminal law or the other provisions of this Directive.
2. Where an investment firm, market operator or regulated market has been declared bankrupt or is being compulsorily wound up, confidential information which does not concern third parties may be divulged in civil or commercial proceedings if necessary for carrying out the proceeding.
3. Without prejudice to cases covered by criminal law, the competent authorities, bodies or natural or legal persons other than competent authorities which receive confidential information pursuant to this Directive may use it only in the performance of their duties and for the exercise of their functions, in the case of the competent authorities, within the scope of this Directive or, in the case of other authorities, bodies or natural or legal persons, for the purpose for which such information was provided to them and/or in the context of administrative or judicial proceedings specifically related to the exercise of those functions. However, where the competent authority or other authority, body or person communicating information consents thereto, the authority receiving the information may use it for other purposes.
4. Any confidential information received, exchanged or transmitted pursuant to this Directive shall be subject to the conditions of professional secrecy laid down in this Article. Nevertheless, this Article shall not prevent the competent authorities from exchanging or transmitting confidential information in accordance with this Directive and with other Directives applicable to investment firms, credit institutions, pension funds, UCITS, insurance and reinsurance intermediaries, insurance undertakings regulated markets or market operators or otherwise with the consent of the competent authority or other authority or body or natural or legal person that communicated the information.
5. This Article shall not prevent the competent authorities from exchanging or transmitting in accordance with national law, confidential information that has not been received from a competent authority of another Member State.
However, the appelate court’s reasoning only generated a further appeal up to the German Federal Administrative Court, the Bundesverwaltungsgericht.
At the Bundesverwaltungsgericht
The judges at the Federal Administrative Court noted that the CJEU had already ducked the issue of professional secrecy once before back in 2014. In Case C-140/13, Altmann, the same first instance court in Frankfurt had made a preliminary reference to the CJEU in a case that also involved the same German regulatory authority. The questions at stake in the earlier case were similar too; an interpretation of the same Directive 2004/39/EC and the same Article 54; plus the obligation of professional secrecy placed on national financial supervisory authorities when there was a fraudulent investment firm that had gone into compulsory liquidation.
Confounded by the absences in the CJEU’s judgment, the German judges noted that if the dispute were decided by national law, then Mr Baumeister’s right to access information had been infringed by the authority. However, the German judges felt that there was uncertainty surrounding the operation of the law in this area, and it might be appropriate to give the secrecy obligation in the existing German credit legislation a broad interpretation so that national law could be read in conformity with the EU Directive.
The judges at the Federal Administrative Court identified the problem before them: what criteria should be used to determine whether information was covered by the professional secrecy obligation in Article 54 of the Directive? An easy solution would be to place the emphasis on the external appearance of the document.
If that easy solution was the correct approach, then the German judges thought that the CJEU should answer ‘yes’ to the German court’s Questions 1(a) and 1(b).
Admittedly, this simple approach was ostensibly based on the origin of the information rather than the informational content of a document held by the authority. However, the simplicity faced a serious legal impediment to its adoption. The German judges could find no legal support within the CJEU’s existing case law on ‘professional secrecy’ which could justify the adoption of that approach.
For example, the German court looked at the CJEU’s law on professional secrecy in the area of EU competition law. The German court recalled the approach of the General Court in its 2006 judgment in Case T-198/03 Bank Austria Creditanstalt AG. Now this case had been about interest-rate fixing between Austrian banks, and the publication of a Commission decision finding an infringement of Article 81 EC and the Austrian banks concerned being fined. The banks had requested that certain passages be omitted.
The General Court had reasoned:
71 In order that information be of the kind to fall within the ambit of the obligation of professional secrecy, it is necessary, first of all, that it be known only to a limited number of persons. It must then be information whose disclosure is liable to cause serious harm to the person who has provided it or to third parties. Finally, the interests liable to be harmed by disclosure must, objectively, be worthy of protection. The assessment as to the confidentiality of a piece of information thus requires the legitimate interests opposing disclosure of the information to be weighed against the public interest that the activities of the Community institutions take place as openly as possible.
While that seemed clear, the General Court’s reasoning hinged on the nature of the information concerned, and the limited criteria for bringing information within the scope of professional secrecy. Those criteria did not seem to cover Mr Baumeister’s situation. He was seeking access to documents containing purely internal commercial data – information which had been supplied by the company to the regulatory authority. Accordingly, those documents would not be covered by the concept of professional secrecy.
One way around this problem, the German judges mused, was whether the importance of the supervision of the markets was so great that the requirements of disclosure and harm should be dispensed with. Ignoring those limitations would in turn make it much more likely that everything which had been provided to the authority confidentially would then become covered by the concept of professional secrecy.
Indeed, the German court mused that if an authority would no longer need to conduct the assessment exercise in light of the content of the information or its importance to the supervisory institution, this would broaden the scope of professional secrecy. The practical effect though, would be to render it difficult for the authority to reason its decision.
The German judges considered another strategy to deal with the concept of ‘professional secrecy’. The alternative would place the emphasis on the notion of ‘prudential supervision’. It was an area of the law that had recently been explained by Advocate General Jääskinen in the aforementioned Case C-140/13, Altmann.
The Advocate General had explained:
38. Thirdly, there is information which is subject to a form of secrecy particular to supervising authorities, ‘prudential secrecy’, the corresponding obligation being imposed on authorities for the supervision of the financial sector and those working within them. [footnote 23] This category includes, amongst other things, the methods of supervision adopted by the competent authorities, communications and transmissions of information between the various competent authorities, and between those authorities and the supervised entities, and all other non-public information as to the state of the supervised markets and the transactions made on those markets.
From this, the German judges understood the Advocate General’s approach to bring documents within the scope of ‘prudential supervision’ depending on their origin and on their links to procedural considerations. The German judges noted that his approach did not seem to involve any other criteria being fulfilled or distinctions being made in respect of different types of information.
That would be a low threshold for a regulatory authority to clear, and it would mean that documents would quickly fall within the scope of ‘professional secrecy’. However, what should be done in respect of documents that did not even clear that low threshold?
The ‘what-then’ scenario underpinned the German court’s questions in 1(c)(i) and (ii) and related to the conditions governing the content of documents, particularly where the information concerned still deserved to be protected, and any disclosure would undermine the need for continuing the protection.
In that context, the German judges considered the CJEU’s Grand Chamber reasoning in Case C-139/07 P. Technische Glaswerke Ilmenau GmbH to be relevant. The case had involved access to documents of the EU institutions, and the interpretation of Regulation (EC) No 1049/2001. The particular documents related to state aid and the protection of the Commission’s investigations. The question was whether there was there a duty on the Commission to carry out a concrete, individual examination of the content of the documents covered by the request for for information.
In 2010, the Grand Chamber had reasoned:
53 It is true that, in order to justify refusal of access to a document the disclosure of which has been requested, it is not sufficient, in principle, for that document to fall within an activity mentioned in Article 4(2) of Regulation No 1049/2001. The institution concerned must also supply explanations as to how access to that document could specifically and effectively undermine the interest protected by an exception laid down in that article (Joined Cases C‑39/05 P and C‑52/05 P Sweden and Turco v Council  ECR I‑4723, paragraph 49).
Thus, that approach would need reasoning too.
However, there was a further scenario in the minds of the German judges to get around that problem, and this underpinned its question in 1(c)(iii). The scenario would involve writing into EU law a legal presumption that disclosure would harm an authority’s investigations and commercial interests. This would lower the burden of proof on an institution still further.
Again, there was some authority in the CJEU’s case law to support that approach. The Grand Chamber in Technische Glaswerke Ilmenau had gone on to reason:
54 However, the Court has acknowledged that it is, in principle, open to the Community institution to base its decisions in that regard on general presumptions which apply to certain categories of documents, as considerations of a generally similar kind are likely to apply to requests for disclosure relating to documents of the same nature (Sweden and Turco, paragraph 50).
61 It follows from the above considerations as a whole that, for the purposes of interpreting the exception laid down in Article 4(2), third indent, of Regulation No 1049/2001, the General Court should, in the judgment under appeal, have taken account of the fact that interested parties other than the Member State concerned in the procedures for reviewing State aid do not have the right to consult the documents in the Commission’s administrative file, and, therefore, have acknowledged the existence of a general presumption that disclosure of documents in the administrative file in principle undermines protection of the objectives of investigation activities.
Perhaps it was possible to import a general presumption of harm into this area of EU law too?
Irrespective of the aforementioned questions about how to classify a document as being covered by the concept of professional secrecy, the German judges decided to ask another two questions of the CJEU. This pair of questions concerned the temporal aspect of confidential information which had been deemed to fall within the concept of ‘professional secrecy’.
The German judges thought it was common knowledge that the confidentiality of information generally diminishes with the passing of time. Accordingly, confidentiality depends on the economic context that exists at any particular point in time, and whether the company concerned is then going to be disadvantaged by the authority allowing access to the information requested.
Thus, where information was deemed to be no longer relevant, then the information would lose its status of being confidential. Conceivably though, that might happen even before a company has ceased trading.
In that context, the German judges wondered whether in light of the peculiarities of the financial markets, secrecy should be maintained. Perhaps it would be desirable for authorities to stick with the initial indication that information which had been supplied to the authority remained a commercial secret? The relevant moment for determining secrecy was therefore the moment when the information was supplied to the authority.
If, on the contrary, when assessing secrecy account should be taken of changed circumstances and changes in the potential effects of disclosing the information in the context of an access request, then the German judges thought a different question would arise. Namely, could EU professional secrecy law be interpreted in such a way as to contain some sort of general presumption that, with the passage of time, the confidentiality of the information – and its attendant value for the purposes of ensuring competition in the marketplace – would drain away.
The German judges recognised that some support for that approach could be found in the CJEU’s case law – and the approach taken by the EU Commission – in the area of competition law. That is to say, it seemed to be the rule that any confidential information which was more than 5 years old would no longer be considered to be up to date or secret or even confidential, unless the company concerned could show objectively that the information, despite its age, still formed a real part of the company’s position in the marketplace, or it concerned the position of a third party in that market.
In that light, the German judges wondered whether these EU competition law and practices about the temporal nature of confidential information could be applied analogously to the operation of the EU’s ‘financial instruments’ Directive and Article 54’s protection of ‘professional secrecy’.
The five judges in the German court decided to make a preliminary reference to the CJEU.
My unofficial translation of the questions asked by the Bundesverwaltungsgericht reads:
1. (a) Does the phrase ‘confidential information’ in Article 54(1) cover all corporate information that a company under supervision has supplied to the supervisory authority, thereby bringing that inforamtion within the scope of ‘professional secrecy’ in Article 54(1)(first sentence) without there being a need to satisfy any further requirements?
(b) Does the phrase ‘prudential secrecy’ form a part of ‘professional secrecy’ and bring within the scope of Article 54(1) (first sentence) all of the supervisory authority’s statements contained within the correspondence, including the authority’s correspondence with other authorities, without the need for other requirements to be satisfied?
In the event that the question in either (a) or (b) is answered in the negative:
(c) Should the provision on ‘professional secrecy’ in Article 54(1) of the Directive be interpreted to mean that information is ‘confidential’ when
i) what is decisive is whether the information according to its nature falls within the scope of professional secrecy or whether the access to the information could pose real and actual harm to the purpose of preserving the secrecy
ii) or should account be taken of other circumstances which would mean that information would fall within the scope of professional secrecy
iii) whether it depends on the supervisory authority and its assessment of the corporate information about a company that is under its supervision and the information that is contained in its documents and, in respect of the authority’s documentation about the company, the authority can rely on a rebuttable assumption where commercial or prudential secrets are at stake?
2. Should the concept of ‘confidential information’ in Article 54(1)(second sentence) of the Directive be interpreted to mean that the corporate information supplied to the supervisory authority can be deemed to be corporate information or as a commercial secret worthy of protection or as information otherwise deserving of protection, depends solely on the time when the information was supplied to the supervisory authority?
In the event that Question 2 is answered in the negative:
3. Irrespective of changes in the economic environment, when considering the question of whether corporate information deserves protection as a commercial secret and thus information within the scope of professional secrecy within the scope of of 54(1)(second sentence) of the Directive, is there a general time limit – of for example five years – after the expiry of which, there is a rebuttable presumption that this information has lost its economic value? Equally would that apply to secrecy in respect of prudential supervision?
In the lower German courts, there was some discussion of the duty on the national judiciary to interpret national law in conformity with EU law. The CJEU’s case law which was cited in the German courts, was case law that was amended relatively recently by the CJEU in Ryanair. For a brief discussion on the potentially radical revision to the duty of conforming interpretation, see further, “Autonomy, Comparison Websites and Ryanair” (2015) Intellectual Property Quarterly 386-406.
The doctrine of conforming interpretation is currently at stake in a number of other references currently pending before the CJEU; see further, Case C-566/15, Erzberger – the extra-territorial application of German worker representation law.
The present German reference about the scope of ‘professional secrecy’ is also interesting because it comes at a time when the CJEU is dealing with another case about the public’s right to confidential corporate and technical information held by a public authority, this time it is in the context of environmental data; see further, Case C-442/14, Bayer CropScience – Bee deaths? Buzz Off! The data requested is confidential. Advocate General Kokott’s Opinion is due to be given to the Fifth Chamber on 7 April 2016.
Update – 16 April 2016
According to the Curia website, there is another case pending before the CJEU which concerns an alleged pyramid selling structure, and this time it involves lotteries in Belgium. The case has been docketed as Case C-667/15, Loterie Nationale — Nationale Loterij NV v Paul Adriaensen and Others. The Antwerp Court of Appeal has asked:
1. Does the application of paragraph 14 of Annex I to Directive 2005/29/EC […] of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market and amending Council Directive 84/450/EEC, Directives 97/7/EC, 98/27/EC and 2002/65/EC of the European Parliament and of the Council and Regulation (EC) No 2006/2004 of the European Parliament and of the Council require that a prohibited pyramid promotional scheme exists only if the realisation of the financial promise to existing members:
depends primarily or mostly on the direct transfer of the contributions of the new members (‘direct link’),
does it suffice that the realisation of the financial promise to existing members depends primarily or mostly on an indirect payment through the contributions of existing members, i.e. existing members do not obtain their compensation primarily or mostly from their own sale or their own consumption of goods or services, but depend for the realisation of the financial promise primarily or mostly on the subscription and contributions of new members (‘indirect link’)?
Update – 10 August 2016
The Altmann judgment is at stake in a new preliminary reference from a Luxembourg court; see further, Case C-358/16, UBS – stopping a lawyer from seeking access to documents that could establish his innocence.
Update – 10 January 2017
There is a preliminary reference from the Italian Council of State concerning a person who lost a lot of his savings when the bank he was with was forced into administration, and that person is now seeking access to documents held by the Italy’s Central Bank; see further, Case C-594/16, Buccioni – Dear Central Bank, Documents please. Regards, Mr E. Swindled.