The Commission is concerned that the merger could lead to higher prices and reduce choice and innovation for customers of hardware security modules.

Commissioner Margrethe Vestager, in charge of competition policy, said: "Our society is increasingly dependent on data security solutions to secure all sorts of social, commercial or personal information. We are opening this in-depth investigation to ensure that the proposed transaction between Thales and Gemalto would not lead to higher prices or less choice in hardware security modules for customers looking to safely encrypt their data".

The proposed transaction would combine the two largest suppliers of hardware security modules used for enterprise key management solutions, both in the European Economic Area (EEA) and at global level. A hardware security modules (HSM) is a dedicated hardware appliance running on encryption software to generate, protect, and manage encryption keys used to protect data in a secure tamper-resistant module. The combined entity would become by far the largest player in the market for HSMs in Europe and worldwide.

The Commission's competition concerns

Thales and Gemalto currently closely compete against each other in the market for hardware security modules at the European and global level. At this stage, the Commission is concerned that the proposed transaction would eliminate the competitive constraint that Thales and Gemalto exercise on each other and on the other few players that would remain in the market and would risk creating a dominant player at the European and global level.

The Commission is also concerned that by reducing the number of players in the market and by lowering the merged entity's incentives to compete effectively, the transaction could lead to higher prices and reduce innovation.

The Commission will now carry out an in-depth investigation into the effects of the transaction to determine whether its initial competition concerns are confirmed. The Commission will in particular further assess: (i) the extent to which the parties are close competitors, (ii) the potential response of the merged entity's competitors, and (iii) the ability of software-based solutions to reach the same security level as hardware security modules, and therefore compete with the latter.

The transaction was notified to the Commission on 18 June 2018. The Commission now has 90 working days, until 29 November 2018, to take a decision. The opening of an in-depth investigation does not prejudge the outcome of the investigation.

Companies and products

Thales, based in France, is a global group active in aeronautics, space, ground transportation, defence and security.

Gemalto, based in the Netherlands, is an international digital security company active in mobile platforms and services, mobile embedded software & products, smart cards, identification documents, government programmes, machine to machine communication (Internet of Things), and enterprise security.

Merger control rules and procedures

The Commission has the duty to assess mergers and acquisitions involving companies with a turnover above certain thresholds (see Article 1 of the Merger Regulation) and to prevent concentrations that would significantly impede effective competition in the EEA or any substantial part of it.

The vast majority of notified mergers do not pose competition problems and are cleared after a routine review. From the moment a transaction is notified, the Commission generally has a total of 25 working days to decide whether to grant approval (Phase I) or to start an in-depth investigation (Phase II).

There are currently five other on-going Phase II merger investigations: the proposed acquisition of MKM by KME, the proposed acquisition of Alstom by Siemens, the proposed acquisition of Solvay's nylon business by BASF, the proposed acquisition of Tele2 NL by T-Mobile NL, the proposed acquisition of Shazam by Apple and the proposed merger of Praxair and Linde.

More information will be available on the Commission's competition website, in the public case register under the case number M.8797.