Trade secrets and transparency: how far does the public interest extend?

Background

In December 2020, the European Commission granted a conditional marketing authorisation for Comirnaty®, which required the marketing authorisation holder (BioNTech) to provide additional data on the characterisation of the active substance and the finished product.

In 2021, a citizen requested access to this information from the European Medicines Agency (EMA). The EMA granted partial access, but withheld certain technical data to protect BioNTech’s commercial interests.

The applicant challenged this decision before the General Court of the European Union (GCEU), which was called upon to determine whether there was an overriding public interest justifying disclosure of the redacted information.

Nature of the redacted information

Before examining whether an overriding public interest existed, the GCEU first analysed the nature of the redacted information. It consisted of trial results relating to the characterisation of the active ingredient and the finished product, as well as the technical parameters used to conduct those trials. This was therefore highly technical information, derived from BioNTech’s specific scientific know-how.

The EMA argued that, given the innovative nature of the technology, its disclosure would enable competitors operating in the same therapeutic field to save scientific effort and human and economic resources.

The GCEU accepts this reasoning and concludes that the redacted data constitutes commercially sensitive information, the disclosure of which could harm BioNTech’s commercial interests. Furthermore, the Court recalls that Regulation (EC) No 1049/2001 on public access to documents does not require the harm to be quantified, nor does it require a detailed market analysis to assess it. It is sufficient that the risk of harm be reasonably foreseeable and not merely hypothetical, unless an overriding public interest justifies disclosure.

What about the public interest?

Having confirmed the commercially sensitive nature of the information, the GCEU turned to the question of whether an overriding public interest nevertheless justified disclosure.

The Court is clear on this point: where access to documents is refused by the public authority, it is for the applicant to demonstrate the existence of such an overriding public interest. A general invocation is insufficient. The applicant must demonstrate, in concrete terms, that disclosure specifically contributes to protecting the public interest. Accordingly, public authorities are not required to assess ex officio whether such an overriding public interest exists.

In the present case, the Court agrees with the EMA that the redacted information was limited in scope, and strictly technical, and likely to benefit BioNTech’s competitors if disclosed. Granting access would therefore upset the balance struck by the European legislation between companies’ obligation to provide sensitive information to the EMA and the strong protection given to that information under professional and commercial secrecy.

What happens if the information has already been leaked?

Directive (EU) 2016/943 and Spanish Law 1/2019 on Trade Secrets define a trade secret as information that is secret, that has commercial value precisely because it is secret, and that has been subject to reasonable measures by its owner to keep it secret.

This classification allows access to be refused where disclosure would cause economic harm to its owner.

In this context, the question arises as to what happens if such secret information is leaked.

In this case, part of the redacted information had been disseminated online following a cyberattack on the EMA. The Court examines whether such a leak altered the legal assessment.

The Court’s response is unequivocal: unauthorised disclosure does not automatically render that information publicly accessible for the purposes of the rules on freedom of information and access to public documents.

Conclusions

Three main conclusions can be drawn from this Judgment:

First, no quantification of harm is required. It is sufficient that the risk to commercial interests be reasonably foreseeable. This issue remains controversial at national level, for example in relation to access to pricing and reimbursement decisions.
Second, public authorities are not required to assess ex officio whether an overriding public interest exists. The burden of proof lies with the applicant who has been denied access to specific information.

Third, a leak or unauthorised disclosure of part of the requested information does not prevent the remaining information from continuing to merit protection.