The CJEU has given judgment in a case where an applicant sought to have information in a companies register held by a Chamber of Commerce anonymised
In Case C-398/15 Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni, the Court of Justice of the European Union has ruled that there is no general ‘right to be forgotten’ in respect of personal data in a companies register. However, upon expiry of a sufficiently long period after dissolution of the company concerned, Member States may provide for restricted access to such data by third parties in exceptional cases.
In 2007, Mr Salvatore Manni, a director of a company which was awarded a contract for the construction of a tourist complex in Italy, brought an action against the Lecce Chamber of Commerce. In his view, the properties in the complex were not sold because it was clear from the companies register that he had been the administrator of another company that went bankrupt in 1992 and was wound up in 2005.
The Court of Lecce ordered the Lecce Chamber of Commerce to anonymise the data linking Mr Manni to the liquidation of the first company and to pay compensation for the damage suffered by Mr Manni. The Lecce Chamber of Commerce brought an appeal against that judgment before the Corte suprema di cassazione, which decided to refer several questions to the Court of Justice for a preliminary ruling. The Italian Court asked whether the Data Protection Directive and the Directive on disclosure of company documents (First Council Directive 68/151/EEC of 9 March 1968) preclude any person from accessing, without any time limit, data relating to natural persons set out in the companies register.
In its judgment, the CJEU notes first of all that the public nature of company registers is intended to ensure legal certainty in dealings between companies and third parties and to protect, in particular, the interests of third parties in relation to joint stock companies and limited liability companies, since the only safeguards they offer to third parties are their assets. The Court further notes that matters requiring the availability of personal data in the companies register may arise for many years after a company has ceased to exist. Having regard to (1) the range of legal rights and relations which may involve a company with actors in several Member States (even after its dissolution), and (2) the diversity of limitation periods provided for by the various national laws, it seems impossible to identify a single period after which the entry of the data in the register and their disclosure would no longer be necessary. In those circumstances, Member States cannot guarantee that natural persons whose data are included in the company register have the right to obtain, after a certain period of time from the dissolution of the company, the erasure of personal data concerning them.
The Court considers that this interference with the fundamental rights of the persons concerned (in particular the right to respect for private life and the right to protection of personal data guaranteed by the Charter of Fundamental Rights of the Union) is not disproportionate in so far as (1) only a limited number of personal data items are entered in the company register and (2) it is justified that natural persons who choose to participate in trade through such a joint stock company or limited liability company, whose only safeguards for third parties are the assets of that company, should be required to disclose data relating to their identity and functions within that company. Nevertheless, the Court does not exclude the possibility that, in specific situations, overriding and legitimate reasons relating to the specific case of the person concerned may justify, exceptionally, that access to personal data concerning him should be limited, upon expiry of a sufficiently long period after the dissolution of the company in question, to third parties who can demonstrate a specific interest in consulting that data. Such limitation of access to personal data must be based on a case-by-case assessment. It is for each Member State to decide if it wants such a limitation of access in its national legal system. In the present case, the Court considers that the mere fact that the properties of the tourist complex do not sell because potential purchasers have access to the data of Mr Manni in the companies register cannot justify a limitation of access by third parties to that data, in particular given the legitimate interest of those purchasers in availing of that information.
The official ruling is as follows:
Article 6(1)(e), Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, read in conjunction with Article 3 of the First Council Directive 68/151/EEC of 9 March 1968 on co-ordination of safeguards which, for the protection of the interests of members and others, are required by Member States of companies within the meaning of the second paragraph of Article 58 of the Treaty, with a view to making such safeguards equivalent throughout the Community, as amended by Directive 2003/58/EC of the European Parliament and of the Council of 15 July 2003, must be interpreted as meaning that, as EU law currently stands, it is for the Member States to determine whether the natural persons referred to in Article 2(1)(d) and (j) of that directive may apply to the authority responsible for keeping, respectively, the central register, commercial register or companies register to determine, on the basis of a case-by-case assessment, if it is exceptionally justified, on compelling legitimate grounds relating to their particular situation, to limit, on the expiry of a sufficiently long period after the dissolution of the company concerned, access to personal data relating to them, entered in that register, to third parties who can demonstrate a specific interest in consulting that data.