The protection of confidential information is an issue of increasing importance in today’s business relationships, as well as in cases of litigation before the courts. Indeed, the issue not only arises in connection with modern business contracts, where the parties may exchange in real time and via an array of technological means large volumes of all sorts of data and information – commercial, financial, and technical data and information related to the personal data of clients or employees – that may be characterized as sensitive for competition, inherently confidential, or otherwise personal in nature. The same issue is becoming particularly and increasingly sensitive for private businesses involved in litigation proceedings, since in that situation a third party (a judge or court) may take control over the matter of who may see their confidential information.
When a business relationship escalates into litigation before a court, be it for a contractual claim or tort, the parties may need to rely on certain confidential information to discharge their respective burdens of proof. Such information may be subject to mandatory disclosure by court order, and as a result the confidentiality or secrecy of that information may be compromised. A balance needs to be struck between the right to protection of confidential information by public institutions, which is a general principle of EU law (enshrined in Article 339 of the Treaty on the Functioning of the European Union), and the right of defense, on the one hand, and the right to full compensation of damages, on the other. National courts of Member States should therefore be compelled to ensure that this goal is met by setting forth appropriate safeguards and procedures across the board.
For this purpose, the European Commission (“Commission”) recently issued a communication setting out specific best practices and recommendations for national courts to protect confidential information in private litigation proceedings (the “Communication”).[1] The Communication addresses the issue in the context of proceedings for the private enforcement of competition law, in particular actions seeking compensation of antitrust damages, because the Damages Directive[2] expressly requires Member States to ensure that national courts have at their disposal effective measures to protect confidential information, while at the same time ensuring the exercise of the right to full compensation for victims of antitrust infringement.
The objective of the Communication is to facilitate the work of national courts and of the parties to actions for antitrust damages by providing them with non-binding and non-exclusive guidance on what organizational and practical measures may be deemed appropriate to protect confidential information. Actions for antitrust damages are characterized by the fact the decisive evidence of the contested infringement or the magnitude of the damages is often constituted by confidential information in the sole possession of one or the other of the parties. The volume and complexity of that information may be significant and the degree of relevance unclear. In addition, pursuant to the Damages Directive, national courts can order the parties (and even third parties or authorities) to disclose relevant “categories” of documents and data under certain conditions, and thus potentially large amounts of them.
However, limiting the scope of the Communication to antitrust damage actions does not seem sensible. Most of the abovementioned characteristics of antirust actions are common to a broad range of commercial disputes on matters other than antitrust issues (IP, unfair competition, labor, M&A). Hence, the Communication should serve as a benchmark and offer guidance with respect to the protection of confidential information in non-antitrust litigation proceedings as well.
Protection of confidential information in Italian court proceedings
In Italy, there are currently no structured rules or general guidelines to protect confidential information in court proceedings. While some rules exist – as in the case of trade secrets or personal data or in antitrust litigation proceedings – they remain very open-ended and fragmentary.
The law that implemented the Damages Directive in Italy (Legislative Decree No. 3/2017) lists possible measures that the court shall impose to protect such information if it is the object of a disclosure order (see Sec. 3, par. 4), namely the obligation of secrecy; the possibility to redact parts of a document; conducting closed-door (in camera) hearings; limiting the number of people authorized to view the evidence (confidentiality rings); and the appointment of experts to draw up summaries of the data and information in aggregated or other non-confidential form.
In addition, the Code of Industrial Property (Legislative Decree No. 30 of February 10, 2005) provides for the protection of confidential information in court proceedings with regard to a specific category of confidential information, namely “trade secrets” (defined as confidential information relating to methods or processes for the creation of industrial products, or relating to the organizational structure or strategy of a company). Section 121-ter of the Code of Industrial Property provides that the court may adopt the “measures which, in compliance with the regulatory principles of due process, appear to be most appropriate to protect the confidentiality of the trade secrets that are the subject of the case.”
With respect to personal information, Section 9 of the GDPR provides that, even the processing of “sensitive” data cannot be prohibited when it is “necessary for the establishment, exercise, or defense of legal claims or whenever courts are acting in their judicial capacity.” In addition, the new Italian Privacy Code (Legislative Decree No. 196 of 2003, as amended by Legislative Decree No. 101/2018 to implement the GDPR) allows restrictions of data subjects’ rights whenever the exercise thereof “may result in a real and concrete prejudice […] to the conduct of defensive investigations or the exercise of rights in court” (Sec. 2-undecies, par. 1, let (e)).
Overall, this body of rules and the related case-law in Italy support the prevalence of the right of defense over the right to confidentiality. However, as an exception to this principle, the Damages Directive (and Legislative Decree No. 3/2017) provides a “black list” of documents created for the purpose of antitrust proceedings (namely, leniency statements and settlement submissions) that can never be disclosed – not even by court order – in private litigation trials.
The content of the Communication
To complement the provisions of the Damages Directive, the Commission drafted the Communication, which references EU case-law and practice to provide specific criteria and elements that can be used to assess whether and how confidential information should be subject to disclosure in the course of proceedings. The Communication also offers some practical examples of substantive and organizational measures that can help preserve the confidentiality of information.
Firstly, the Communication provides a general definition of confidential information according to EU courts (par. 20). According to this definition, EU courts deem confidential information that meets the following conditions: (i) it is known only to a limited number of persons; (ii) its disclosure is liable to cause serious harm to the disclosing person or to third parties; and (iii) the interests liable to be harmed by the disclosure of the confidential information are objectively worthy of protection. The Communication also reiterates the general principle that Information older than five five years is presumed to be historical and no longer confidential.
Secondly, it reiterates that the Damages Directive requires disclosure requests to identify specific items of evidence or at least relevant categories of evidence “as precisely and as narrowly as possible on the basis of reasonably available facts” (Recital 16).
Thirdly, the Communication sets forth the following measures that national courts may consider employing with an eye to protecting confidential information when authorizing or ordering the disclosure of evidence effectively and appropriately in proceedings:
- Redacting confidential information from documents. This involves removing each piece of confidential information from a document and replacing it with anonymized data, aggregated figures, or non-confidential summaries, or even blacking-out entire sections of a document. Redaction may be an effective measure in cases where once confidential text has been replaced, the remaining information is still suitable for the exercise of rights. This may happen especially with confidential information concerning markets or figures (revenues, profits, market share, and so on), which, for instance, may be replaced by ranges of values.
- Organizing confidentiality rings. Under this method, specified categories of information are disclosed only to a limited group of individuals, which may include external advisers only or in-house legal counsel/representatives or specific employees of the opposing party, depending on the situation. After establishing the confidentiality ring and setting up the different levels of access, the court may request that all members of the confidentiality ring submit written undertakings to the court. Such undertakings may concern the duty not to disclose the confidential information, the obligation to use such information only for the purpose of the civil proceeding at-issue, the obligation to adopt any measure required to prevent unauthorized access, and so on.
- Appointing experts from a specific field (e.g., accounting, finance, competition law, audit, and so on). When the information to be disclosed involves accounting books, customer data, or manufacturing processes, experts may summarize and/or aggregate confidential information in a non-confidential report to be made available to the parties. For highly sensitive information, the appointment of experts may be combined with organization of a confidentiality ring. When a confidential version of the expert report is produced, the court may decide that the report is to be shared only with the external advisers of the parties, while the parties receive access only to a non-confidential version of the report.
The Communication also clarifies that, pursuant to the Damages Directive, national courts may order disclosure of documents in the files of the European Commission or other national competition authorities (except for the black-listed documents). However, according to the principle of loyal cooperation between judicial and administrative bodies, such a request can only be a measure of last resort (Article 6.10 of the Damages Directive), i.e., the court can order disclosure to competition authorities (or other public bodies) only if the same information cannot be obtained elsewhere.
Finally, the Communication warns that once confidential information has been disclosed, national courts should take appropriate measures and implement appropriate safeguards to protect the confidential information throughout the proceedings. For example, if the parties wish to refer to disclosed confidential information in their pleadings or during courts hearings or intend to hear an appointed expert in court on such evidence, the judge may ask the parties to refer to such information in separate annexes or schedule an in camera hearing to protect confidential information. Furthermore, at the time the judgment or decision is notified or published, and during any subsequent appeal proceedings or in response to requests for access to court records, the judge may consider anonymizing or redacting any information or part of the judgement that could identify the source of or reference confidential information. To this end, the court may ask the parties to identify the confidential information contained in the original version of the judgement.
Concluding remarks
Protecting confidential information in the context of in-court litigation requires a delicate balancing act between the effectiveness of investigations, the parties’ fundamental rights (of full compensation of damages and of defense), and the parties’ interest in maintaining the confidentiality of the information. The task of evaluating these is left to the cautious assessment of the judge, who decides on a case-by-case basis if and which information should be made available and under which organizational measures and safeguards. However, current Italian law does not provide specific procedures to guarantee that the disclosure of confidential information will be accompanied by appropriate measures and safeguards for effective protection thereof. This could irreparably prejudice the value of the information and the rights of its owners, thus undermining trust in the justice system and discouraging recourse to effective judicial redress.
It is worth noting once again that the Communication only refers to civil proceedings concerning compensation of antitrust damages within the scope of the Damages Directive. Moreover, the Communication is not binding on national courts and is not intended to amend existing laws: it only works as a source of inspiration and guidance. As the Commission has made clear, measures proposed in the Communication may be used to the extent that they are available and compatible with national rules, and only if they do not limit the rights of the parties in judicial proceedings.
Selecting measures to protect confidential information requires that national courts conduct comprehensive evaluation of multiple factors. No other institution (save perhaps for arbitration courts) can replace national courts in this duty, nor can they impose, at this date, specific measures for assessing the elements required for proper disclosure. Nonetheless, in the absence of similar rules in the Italian judicial system, the Communication provides an example of good practice regarding measures to protect confidential information without hindering the parties’ effective access to justice.
[1] Communication from the Commission on the protection of confidential information by national courts in proceedings for the private enforcement of EU competition law, in OJEU C 242, 22.7.2020.
[2] Directive 2014/104/EU of the European Parliament and of the Council of November 26, 2014 on certain rules governing actions for damages under national law or infringements of the competition law provisions of the Member States and of the European Union, in OJEU L 349, 5.12.2014.
