What's Happening In Dawn Raids Across Europe? Edition 3

Competition authorities across Europe continue developing their approaches to digital evidence, including remotely stored data. With reforms on the table, proportionality and fundamental rights remain key considerations. Recent decisions confirm broad investigative powers where sufficient procedural safeguards apply, while highlighting risks of significant interference with fundamental rights from accessing private information on personal and professional devices. This two-pager summarises key developments from the past six months.

1 MODERNISATION OF POWERS: SOME USEFUL CLARIFICATIONS, BUT CONCERNS REMAIN

The Commission continues to reassess its inspection toolkit for the digital age. It is working on a legislative proposal for a new regulation, with a draft expected in H1 2027.

• Furtherpublicconsultation: The Commission has consulted only on high-level questions. It is unclear whether further consultation on concrete legislative proposals will follow. This is concerning, given stakeholders have had no opportunity to comment on specific proposals.
• Cloudstorage: The Commission is likely to assert a right to access any data accessible from inspected premises. However, technical accessibility should not equate to automatic access rights.
• Preservationorders: The same kind of preservation orders the Commission can already issue under the Digital Markets Act and Digital Services Act are likely to be introduced in the new regulation. However, preserving all data may impose disproportionate burdens on businesses, particularly where data volumes are vast and systems complex, risking paralysis of day-to-day operations.
• Remote/continuedinspections: The Commission will only consider “remote” inspections to review data secured at company premises or obtained via preservation orders − essentially the current continued inspection model. Continued inspections look set to become the norm, with inspected businesses bearing the costs they would incur with an on-site inspection (Red Bull and Others v Commission, T-682/24).

KEY TAKEAWAYS

Prepare for modern inspection methods: cloud data access, preservation orders, and continued inspections (mostly at the business’s cost). Review device/app usage and retention policies and create IT standard operating procedures for dawn raid situations to help businesses articulate technical, legal, or proportionality objections where relevant. IT experts are needed from the outset of an inspection.

2 PRIVILEGE DEVELOPMENTS: TIME TO REVISIT AKZO?

EU privilege reform remains absent from the modernisation agenda. However, tensions are growing with the principles in Akzo, C-550/07 P (over 15 years ago), which require privileged documents to (i) relate to defence rights and

(ii) involve external counsel only.

• In France, in January 2026, the Cour de Cassation confirmed that privilege requires documents to relate to defence rights (Pourvoi n° 24-82.390, ECLI:FR:CCASS:2026:CR00001). External lawyers’ advice may therefore be seized and taken if not tied to defence of a specific investigation.
• Adding to a growing number of Member States, the French Parliament recently passed legislation extending confidentiality protections to legal consultations by in-house counsel. However, the French Competition Authority has indicated it may resist applying these protections, on the basis that EU law does not recognise in-house privilege.

Across Europe, there is growing recognition that in-house counsel could more efficiently promote compliance if their advice was legally privileged. It remains to be seen when the General Court and the Court of Justice (the “European Courts”) may have the opportunity to revisit this question, knowing that the General Court is already set to decide whether the Commission can require production of American law advice prepared by US in-house lawyers, with Broadcom arguing these communications should be shielded by legal professional privilege (Broadcom and VMware International v. Commission, T-280/26).

KEY TAKEAWAYS

Consider engaging external EU-qualified counsel for sensitive competition advice and ensure your business understands in-house advice might need disclosing. Review document handling and retention protocols.

Ensure privileged materials are identified and segregated. Raise privilege issues early during inspections.

3 PRIVACY UNDER PRESSURE

In Vivendi, T-1097/23 and Lagardère, T-1119/23, the General Court acknowledged that collecting information stored on professional and private devices during an investigation is likely to interfere seriously with privacy rights under Article 7 of the Charter of Fundamental Rights of the European Union. However, such access can be justified to protect undistorted competition where sufficient guarantees exist. The General Court found the process proportionate where a formal decision required parties to search for and collect data including deleted items recoverable from IT systems or backups across multiple platforms and devices (including executives’ professional and personal phones), using approximately 100 search terms. Though the companies had obtained interim measures citing a prima facie risk of violating French criminal rules regarding employees’ private messages, the General Court ultimately found the Commission’s guarantees sufficient: separation and encryption of non-relevant and personal information (including Article 9 GDPR private data) to be examined via a virtual data room accessible only to the parties’ counsel and a limited number of inspectors. These rulings are under appeal.

In the United Kingdom (“UK”), in a recent judgment (Case No: 1755/13/12/25 (W)), the Competition Appeal Tribunal (“CAT”) granted a warrant for a dawn raid at a director’s home. The CAT was satisfied there were reasonable grounds to suspect data concealment, particularly given evidence the director had claimed personal devices were irrelevant during an earlier business premises raid. The CAT emphasised it granted the warrant “takingaccountoftherightsundertheECHR” and “thesensitivewayinwhichtheinitialentrytothepremiseswillbesought”. The CAT was satisfied the intrusion was justified, though amendments were required to reduce execution risk when school-age children might be present.

In some Member States, national competition authorities (“NCAs”) for the time being can take full copies of data on personal devices without any protection or safeguard being imposed. In France, recent rulings have even denied companies the right to recover non-relevant private employee data from the French authority following a raid, insisting that the individual employee concerned is the right one to lodge any claim in court (see, for example, Pourvoi n° 24-82.422,ECLI:FR: CCASS:2026:CR00002).

4 EX-ANTE CONTROL BACK ON THE AGENDA?

Reflecting on these decisions, the difference

between regimes is striking:

• In the UK and in most national regimes within the EU, judicial review of applications for the most intrusive dawn raids is carried out exante, with judges reviewing limitations and safeguards before any inspection is allowed to start.
• In contrast, under EU rules, companies must raise claims on the spot to obtain appropriate safeguards and bring appeals expost, or seek interim measures if they consider the protections agreed by inspectors insufficient.

President of the General Court Marc van der Woude recently commented publicly on ex-ante control of competition inspections. Although the General Court and Court of Justice have found that the absence of ex-ante judicial review does not raise Charter concerns, this position is increasingly challenged as inspections give rise to growing proportionality and privacy issues. Under the EU regime, ex-ante judicial review is non-existent and ex-post control is limited to challenging the legality of inspection decisions and fundamental protections being denied during the inspection. This situation cannot hold indefinitely and the European Court of Justice is expected to deliver a ruling precisely on the same question in relation to the Portuguese inspection provisions on 16 July 2026 (Imagens Médicas Integradas, Joined Cases C-258/23, C-259/23, and C-260/23).

KEY TAKEAWAYS

Recent court decisions have strengthened protections for sensitive personal data under Article 9 GDPR and private information.

When responding to information requests or inspections involving private data, businesses should insist on targeted search terms, limited time periods, and safeguards such as virtual data rooms. If inspection powers expand without corresponding safeguards, pressure for reform will grow.

Visit us at mayerbrown.com

Mayer Brown is a global services provider comprising associated legal practices that are separate entities, including Mayer Brown LLP (Illinois, USA), Mayer Brown International LLP (England & Wales), Mayer Brown (a Hong Kong partnership) and Tauil & Chequer Advogados (a Brazilian law partnership) and non-legal service providers, which provide consultancy services (collectively, the "Mayer Brown Practices"). The Mayer Brown Practices are established in various jurisdictions and may be a legal person or a partnership. PK Wong & Nair LLC ("PKWN") is the constituent Singapore law practice of our licensed joint law venture in Singapore, Mayer Brown PK Wong & Nair Pte. Ltd. Details of the individual Mayer Brown Practices and PKWN can be found in the Legal Notices section of our website. "Mayer Brown" and the Mayer Brown logo are the trademarks of Mayer Brown.

© Copyright 2026. The Mayer Brown Practices. All rights reserved.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.