EUROPEAN COMMISSION DG Competition CASE M.8797 THALES/ GEMALTO (Only the English text is authentic) MERGER PROCEDURE REGULATION (EC) 139/2004 Article 8(2) Regulation (EC) 139/2004 Date: 11/12/2018 This text is made available for information purposes only. A summary of this decision is published in all EU languages in the Official Journal of the European Union. Parts of this text have been edited to ensure that confidential information is not disclosed; those parts are enclosed in square brackets. EUROPEAN COMMISSION Brussels, 11.12.2018 C(2018) 8401 final PUBLIC VERSION COMMISSION DECISION of 11.12.2018 declaring a concentration to be compatible with the internal market and the EEA agreement (Case M.8797 Thales / Gemalto) (Only the English text is authentic) TABLE OF CONTENTS 1. Introduction .................................................................................................................. 8 2. The Parties and the Transaction ................................................................................... 9 3. Union dimension .......................................................................................................... 9 4. The procedure ............................................................................................................... 9 5. The investigation ........................................................................................................ 10 6. The enterprise key management solution sector ........................................................ 10 6.1. Introduction ................................................................................................................ 11 6.1.1. HSMs.......................................................................................................................... 11 6.1.2. HSMs aaS and cloud-based key management solutions offered aaS ......................... 11 6.2. Manufacturers of HSMs ............................................................................................. 12 6.3. Distribution channels ................................................................................................. 13 6.4. Cloud service providers .............................................................................................. 14 6.5. Standards and certification ......................................................................................... 15 6.6. Regulatory developments ........................................................................................... 16 7. Relevant markets ........................................................................................................ 17 7.1. Introduction ................................................................................................................ 17 7.2. Hardware Security Modules ....................................................................................... 17 7.2.1. Product market definition ........................................................................................... 17 7.2.1.1. Commission precedents ............................................................................................. 17 7.2.1.2. Notifying Party's views .............................................................................................. 17 A. Overall market for KMS ............................................................................................ 17 B. GP and Payment HSMs .............................................................................................. 19 7.2.1.3. Commission's assessment .......................................................................................... 19 A. HSMs and other cloud-based KMS ............................................................................ 19 B. HSMs and other KMS (TPM or microprocessors) .................................................... 20 C. HSMs and HSM aaS .................................................................................................. 20 D. GP HSMs and Payment HSMs .................................................................................. 21 7.2.1.4. Conclusion on the product market definition ............................................................. 22 7.2.2. Geographic market definition .................................................................................... 22 7.2.2.1. Commission precedents ............................................................................................. 22 7.2.2.2. Notifying Party's views .............................................................................................. 23 7.2.2.3. Commission's assessment .......................................................................................... 23 7.2.2.4. Conclusion on the geographic market definition ....................................................... 23 7.2.3. Overall conclusion on market definition .................................................................... 24 7.3. Enterprise Encryption Software ................................................................................. 24 2 7.3.1. Product market definition ........................................................................................... 25 7.3.1.1. Commission precedents ............................................................................................. 25 7.3.1.2. Notifying Party's views .............................................................................................. 26 7.3.1.3. Commission's assessment .......................................................................................... 27 7.3.1.4. Conclusion on the product market definition ............................................................. 28 7.3.2. Geographic market definition .................................................................................... 28 7.3.2.1. Notifying Party's views .............................................................................................. 28 7.3.2.2. Commission's assessment .......................................................................................... 29 7.3.2.3. Conclusion on the geographic market definition ....................................................... 29 7.3.3. Overall conclusion on market definition .................................................................... 30 7.4. Security evaluation services ....................................................................................... 30 7.4.1. Product market definition ........................................................................................... 30 7.4.1.1. Notifying Party's views .............................................................................................. 30 7.4.1.2. Commission's assessment .......................................................................................... 31 7.4.1.3. Conclusion on the product market definition ............................................................. 31 7.4.2. Geographic market definition .................................................................................... 31 7.4.2.1. Notifying Party's views .............................................................................................. 31 7.4.2.2. Commission's assessment .......................................................................................... 31 7.4.2.3. Conclusion on the geographic market definition ....................................................... 32 7.4.3. Overall conclusion on market definition .................................................................... 32 7.5. SIM Cards, OTA SIM Card Administration and GSM-R integration ....................... 32 7.5.1. Product market definition ........................................................................................... 32 7.5.1.1. Notifying Party's views .............................................................................................. 32 7.5.1.2. Commission's assessment .......................................................................................... 33 7.5.1.3. Conclusion on the product market definition ............................................................. 33 7.5.2. Geographic market definition .................................................................................... 33 7.5.2.1. Notifying Party's views .............................................................................................. 33 7.5.2.2. Commission's assessment .......................................................................................... 34 7.5.2.3. Conclusion on the geographic market definition ....................................................... 34 7.5.3. Overall conclusion on market definition .................................................................... 34 7.6. Access control smart cards ......................................................................................... 35 7.6.1. Product market definition ........................................................................................... 35 7.6.1.1. Notifying Party's views .............................................................................................. 35 7.6.1.2. Commission's assessment .......................................................................................... 35 7.6.1.3. Conclusion on the product market definition ............................................................. 36 7.6.2. Geographic market definition .................................................................................... 36 7.6.2.1. Notifying Party's