Case Summary and Outcome

The Court of Justice of the European Union (CJEU) held that access to an individual’s personal data in company registers can only be limited in exceptional circumstances provided by domestic law, and after the expiry of a sufficiently long period following the dissolution of the company concerned.  The case related to an Italian citizen, Mr. Salvatore Manni, who wanted to have information concerning him removed from the companies register in Italy. The information pertained to him being director and liquidator of a company that went insolvent and was later liquidated. He argued that the information in question harmed his reputation and caused his business to suffer. The CJEU concluded that there was a public interest in making information available to third parties about the constitution of companies, and the powers of persons authorized to represent them. The CJEU, however, did agree that there may be specific situations in which overriding and legitimate reasons can justify limitation of access to the personal data in the companies register.

Facts

Mr. Salvatore Manni was the sole director of Immobiliare Salentina, a company that went insolvent in 1992 and was liquidated in 2005. His relationship with Immobiliare Salentina was reflected in the companies register, which was managed by the Lecce Chamber of Commerce. This companies register complied with EU Directive 68/151, which required that Member States adopt measures to ensure compulsory disclosure of certain information relating to companies. For instance, Article 2(1) of the Directive 68/151 required the disclosure by companies of those authorized to represent the companies in dealings with third parties, those controlling the companies, and appointed liquidators of the companies.

In 2007, Mr. Manni was unable to sell property and blamed it on the fact that the companies register reflected his involvement with Immobiliare Salentina. He argued that information from the register was used to determine his risk rating by a company specialized in the collection and processing of market information and in risk assessment.

Subsequently, Mr. Manni requested to have his personal data linking him to the liquidation of Immobiliare Salentina erased, anonymized or blocked from the companies register. In August 2011, the Court of Lecce (Tribunale di Lecce) granted his request, ordering that the Lecce Chamber of Commerce anonymize the data linking him to the liquidation of Immobiliare Salentina and that they pay 2,000 EUR in damages. The Court of Lecce ruled that it was not permissible for entries in the register that linked the name of an individual to a critical phase in the life of a company to be permanent, unless there was a specific general interest in their retention and disclosure. The Court of Lecce reasoned that “after an appropriate period” from the conclusion of the liquidation of a company, and after that company had been removed from the register, stating the name of the person who was sole director of that company at the time of the liquidation ceased to be “necessary” and “useful”. It went on to say that, in such cases, the public interest in a “historical memory” of the existence of the company and the difficulties it experienced could just as well be achieved by means of anonymous data.

The Lecce Chamber of Commerce appealed to the Court of Cassation, which then stayed proceedings and put questions to the Court of Justice of the European Union (CJEU) for preliminary ruling. The CJEU later distilled these questions down to one: “whether [EU law] must be interpreted as meaning that Member States may, and indeed must, allow individuals […] to request the authority responsible for maintaining the companies register to limit, after a certain period has elapsed from the dissolution of the company concerned and on the basis of a case-by-case assessment, access to personal data concerning them and entered in that register.” [Para. 30]

Decision Overview

The Court of Justice of the European Union (CJEU) began by recognizing that the authority responsible for maintaining a Member State’s register under Directive 68/151 amounted to a “data controller” under EU data protection law (Directive 95/46). Furthermore, the disclosure of personal data contained in those registers amounted to “data processing”. The CJEU referred to the Google Spain case, explaining that Directive 95/46 “seeks to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data.” [Para. 37] The Court added that data processing under Directive 95/46, particularly when it infringes on the right to respect for private life, must be evaluated against the Charter of Fundamental Rights of the European Union.

The CJEU noted that Article 6(1)(e) of Directive 95/46 required that Member States ensure that “personal data are kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed.” [Para. 45] Referring again to the Google Spain case, the CJEU recalled that a data subject possesses “the right to obtain from the [data] controller, as appropriate, the erasure or blocking of [personal] data” where there has been a failure to comply with Article 6(1)(e) of Directive 95/46. [Para. 46] The CJEU also noted that in some cases similar orders can be obtained where the data subject has compelling legitimate grounds in relation to their particular situation against the processing of their personal data (Article 14 of Directive 68/151).

The first step in determining whether an individual had the right to erasure, block or restrict access to data in the companies register after a certain period of time, the CJEU looked to the purpose of the relevant disclosure. In this case, the disclosure was made pursuant to Directive 68/151, which was aimed at protecting “the interests of third parties in relation to joint stock companies and limited liability companies, since the only safeguards they offer to third parties are their assets.”  Furthermore, by standardising the disclosure procedure adopted across Member States, Directive 68/151 guaranteed “legal certainty in relation to dealings between companies and third parties in view of the intensification of trade between Member States.” [Para. 50] The CJEU noted that the information in the companies register may be needed by a third party long after a company has ceased to exist (e.g. to pursue legal proceedings).

The CJEU also noted that Directive 68/151 did not set a maximum time limit for disclosures in company registers. The CJEU concluded that, in light of the range of possible scenarios where the information might be necessary, it was impossible for it to identify a single limit for when information should be removed from the registers. Therefore, the CJEU could not find that a data subject could, as a matter of principle and after a certain of period of time after the dissolution of the relevant company, restrict access to their personal data on company registers.

The CJEU found that the disclosure pursuant to Directive 68/151 did not disproportionately interfere with the data subject’s right to private life and the protection of their personal data. First, the disclosure concerned very limited categories of information. Second, persons who were involved in joint-stock or limited liability companies were aware that they were required to disclose data relating to their identity and functions. Lastly, the CJEU reiterated that “the need to protect the interests of third parties in relation to joint-stock companies and limited liability companies and to ensure legal certainty, fair trading and thus the proper functioning of the internal market [took] precedence”. [Para. 60]

The CJEU did note, however, that there “may be specific situations in which the overriding and legitimate reasons relating to the specific case of the person concerned justify exceptionally that access to personal data entered in the register is limited, upon expiry of a sufficiently long period after the dissolution of the company in question, to third parties who can demonstrate a specific interest in their consultation.” [Para. 60] The final decision on whether an individual can make a request for such a limitation is a matter for the national legislatures.

Lastly, the CJEU opined, in respect to Mr. Manni’s request, that Mr. Manni’s inability to sell properties “because of the fact that potential purchasers of those properties have access to […] data in the company register, cannot be regarded as constituting [a legitimate and overriding reason exceptionally justifying limiting access to data in the companies register], in particular in view of the legitimate interest of those purchasers in having that information.” [Para. 63] The CJEU sent the case back to the national courts for final determination.