Case Summary and Outcome

The Italian Supreme Court, relying on the preliminary ruling of the European Court of Justice (hereinafter, “ECJ”), held that as Italian law provides no right to be forgotten relating to information published in companies’ register neither the authority responsible for maintaining the register nor the courts could erase, block or anonymize personal data in the register.  Mr. Salvatore Manni, director of a company which was awarded a contract for the construction of a tourist complex in Italy, brought an action against the Lecce Chamber of Commerce. In his view, the properties in the complex were not sold because of information in the companies register that he had been the administrator of another company that went bankrupt in 1992 and was wound up in 2005.  The Italian Supreme Court reasoned that the establishment of the companies register and the lack of a national rule allowing retention of data only for a certain time were the result of a balancing exercise carried out by the Italian legislator between individual needs and those of the community, and that the interest of the individual to prevent the availability of data relating to his or her management history could not prevail over the public interest in maintaining the certainty and transparency necessary to promote economic and social relationships.

Facts

In December 2007, Mr. Salvatore Manni, a director of a company which was awarded a contract to build a tourist complex in Italy, brought an action against the Lecce Chamber of Commerce. In his view, he was unable to sell the properties in his new complex because information in the companies register documented that he had been the administrator of another company that went bankrupt in 1992 and was liquidated in 2005.

On August 1, 2011, the Court of Lecce upheld the claims and ordered the Lecce Chamber of Commerce to anonymize – but not remove – the data related to Mr. Manni, and also to pay him compensation for the damage suffered. In its decision, the Court of Lecce argued that, unless there is a particular public interest in the retention and disclosure of registry entries related to events occurring during the company’s existence, register entries related to such events should not be permanent. However, Italian law does not provide for a minimum or a maximum term for the retention of data published in the companies register.

The Lecce Chamber of Commerce appealed this decision directly to the Italian Supreme Court pursuant to Art 152, paragraph 13, of the Legislative Decree No. 196 of June 30, 2003, also known as the Italian Data Protection Code. According to the Italian Supreme Court, public registers play an important role in gathering and providing information which promotes the creation and development of commercial and social relations. Indeed, it said, such data helps to increase and ensure legal certainty, which is the public purpose justifying their retention.

Notwithstanding the public purpose argument which would justify the permanent processing of personal data, the Supreme Court recognised the relevance of the right to be forgotten as a fundamental instrument to protect personal identity. As a consequence, it said that this right needed to be balanced with the necessity to ensure legal certainty through the information published in the companies register. In light of this controversial issue, the Italian Supreme Court asked the ECJ to advise on whether, in the absence of any legal rule, the protection of personal data gives the data subject the right to obtain the cancellation or anonymization of his or her data published in the companies register after a certain period of time.

On March 9, 2017, the ECJ ruled that, as EU law currently stands, the right to be forgotten relating to information published in companies registers is to be determined by Member States on the basis of a case-by-case assessment. If compelling legitimate grounds relating to the requester’s particular situation justify it, such authority may, upon the expiration of a sufficiently long period after the dissolution of the company concerned, limit access to such personal data entered in that register only to third parties who can demonstrate a specific interest in obtaining that data. In further guidance the ECJ stated that the “mere fact that, allegedly, the properties of a tourist complex built by Italiana Costruzioni, of which Mr Manni is currently the sole director, do not sell because of the fact that potential purchasers of those properties have access to that data in the company register, cannot be regarded as constituting such a reason, in particular in view of the legitimate interest of those purchasers in having that information.”

Decision Overview

The Italian Supreme Court, following the ECJ’s ruling and in light of current Italian law, said that the right to be forgotten relating to information published in companies’ register cannot be granted by the authority responsible for maintaining the company register. In the absence of any national legal rule which provides for the retention of such data only for a specific period of time, the decision regarding the cancellation or the block of access to third parties cannot be left either to the authority responsible for maintaining the companies register nor to a judicial decision. It said that, in the first case, the authority would risk being burdened with an indefinite number of requests which would prejudice the management of the register. In the second case, and without any legislative limitation, different judges would interpret cases in different ways resulting in little consistency in decisions.

According to the Italian Supreme Court, the decision not to specify a finite period for retention is also driven by the nature of the data involved which needs to be retained in order to protect third-party interests and increase the transparency of the European internal market. Indeed, it said, the retention of data published in the companies register satisfies the general interest in ensuring the certainty and transparency of relevant information in order to promote economic and social relationships. This is highlighted by the mandatory publication of the register, which is ensured through the ex officio procedure pursuant to article 2190 of the Italian Civil Code, and by the fact that the register is managed by a public authority.

The Court said that since ensuring transparency for the security of economic exchanges was the traditional function of the business register, the right to be forgotten of an individual could not prejudice this public purpose. According to the Court, the protection of an individual’s fundamental right cannot prevail over the collective dimension of public good and the existence of a related obligation. The Italian Supreme Court stated that the principle of solidarity acted as the necessary balance between idiosyncratic positions and society by means of duties that are imposed for the safeguard and protection of interests and values of the community as a whole. In other words, according to the Court, the principle of solidarity constitutes the point of mediation that allows the legal system to safeguard the right of the individual within the community. It said that the relation between the individual and the community is the key to the system of fundamental rights recognised by the Italian Constitution: individuals enjoy their rights not as nomads, but in their relations with the social groups to which they belong.

The establishment of the companies register and the lack of a national rule allowing data retention for a limited time only are the result of a balancing exercise carried out by the Italian legislator between individual needs and those of the community, so that the interest of the individual to prevent the availability of data relating to his or her management history cannot prevail over the above-mentioned public interests.