Privacy, Data Protection and Retention
Lillo-Stenberg v. Norway
Closed Expands Expression
Global Freedom of Expression is an academic initiative and therefore, we encourage you to share and republish excerpts of our content so long as they are not used for commercial purposes and you respect the following policy:
Attribution, copyright, and license information for media used by Global Freedom of Expression is available on our Credits page.
The Italian Supreme Court, relying on the preliminary ruling of the European Court of Justice (hereinafter, “ECJ”), held that as Italian law provides no right to be forgotten relating to information published in companies’ register neither the authority responsible for maintaining the register nor the courts could erase, block or anonymize personal data in the register. Mr. Salvatore Manni, director of a company which was awarded a contract for the construction of a tourist complex in Italy, brought an action against the Lecce Chamber of Commerce. In his view, the properties in the complex were not sold because of information in the companies register that he had been the administrator of another company that went bankrupt in 1992 and was wound up in 2005. The Italian Supreme Court reasoned that the establishment of the companies register and the lack of a national rule allowing retention of data only for a certain time were the result of a balancing exercise carried out by the Italian legislator between individual needs and those of the community, and that the interest of the individual to prevent the availability of data relating to his or her management history could not prevail over the public interest in maintaining the certainty and transparency necessary to promote economic and social relationships.
In December 2007, Mr. Salvatore Manni, a director of a company which was awarded a contract to build a tourist complex in Italy, brought an action against the Lecce Chamber of Commerce. In his view, he was unable to sell the properties in his new complex because information in the companies register documented that he had been the administrator of another company that went bankrupt in 1992 and was liquidated in 2005.
On August 1, 2011, the Court of Lecce upheld the claims and ordered the Lecce Chamber of Commerce to anonymize – but not remove – the data related to Mr. Manni, and also to pay him compensation for the damage suffered. In its decision, the Court of Lecce argued that, unless there is a particular public interest in the retention and disclosure of registry entries related to events occurring during the company’s existence, register entries related to such events should not be permanent. However, Italian law does not provide for a minimum or a maximum term for the retention of data published in the companies register.
The Lecce Chamber of Commerce appealed this decision directly to the Italian Supreme Court pursuant to Art 152, paragraph 13, of the Legislative Decree No. 196 of June 30, 2003, also known as the Italian Data Protection Code. According to the Italian Supreme Court, public registers play an important role in gathering and providing information which promotes the creation and development of commercial and social relations. Indeed, it said, such data helps to increase and ensure legal certainty, which is the public purpose justifying their retention.
Notwithstanding the public purpose argument which would justify the permanent processing of personal data, the Supreme Court recognised the relevance of the right to be forgotten as a fundamental instrument to protect personal identity. As a consequence, it said that this right needed to be balanced with the necessity to ensure legal certainty through the information published in the companies register. In light of this controversial issue, the Italian Supreme Court asked the ECJ to advise on whether, in the absence of any legal rule, the protection of personal data gives the data subject the right to obtain the cancellation or anonymization of his or her data published in the companies register after a certain period of time.
On March 9, 2017, the ECJ ruled that, as EU law currently stands, the right to be forgotten relating to information published in companies registers is to be determined by Member States on the basis of a case-by-case assessment. If compelling legitimate grounds relating to the requester’s particular situation justify it, such authority may, upon the expiration of a sufficiently long period after the dissolution of the company concerned, limit access to such personal data entered in that register only to third parties who can demonstrate a specific interest in obtaining that data. In further guidance the ECJ stated that the “mere fact that, allegedly, the properties of a tourist complex built by Italiana Costruzioni, of which Mr Manni is currently the sole director, do not sell because of the fact that potential purchasers of those properties have access to that data in the company register, cannot be regarded as constituting such a reason, in particular in view of the legitimate interest of those purchasers in having that information.”
The Italian Supreme Court, following the ECJ’s ruling and in light of current Italian law, said that the right to be forgotten relating to information published in companies’ register cannot be granted by the authority responsible for maintaining the company register. In the absence of any national legal rule which provides for the retention of such data only for a specific period of time, the decision regarding the cancellation or the block of access to third parties cannot be left either to the authority responsible for maintaining the companies register nor to a judicial decision. It said that, in the first case, the authority would risk being burdened with an indefinite number of requests which would prejudice the management of the register. In the second case, and without any legislative limitation, different judges would interpret cases in different ways resulting in little consistency in decisions.
According to the Italian Supreme Court, the decision not to specify a finite period for retention is also driven by the nature of the data involved which needs to be retained in order to protect third-party interests and increase the transparency of the European internal market. Indeed, it said, the retention of data published in the companies register satisfies the general interest in ensuring the certainty and transparency of relevant information in order to promote economic and social relationships. This is highlighted by the mandatory publication of the register, which is ensured through the ex officio procedure pursuant to article 2190 of the Italian Civil Code, and by the fact that the register is managed by a public authority.
The Court said that since ensuring transparency for the security of economic exchanges was the traditional function of the business register, the right to be forgotten of an individual could not prejudice this public purpose. According to the Court, the protection of an individual’s fundamental right cannot prevail over the collective dimension of public good and the existence of a related obligation. The Italian Supreme Court stated that the principle of solidarity acted as the necessary balance between idiosyncratic positions and society by means of duties that are imposed for the safeguard and protection of interests and values of the community as a whole. In other words, according to the Court, the principle of solidarity constitutes the point of mediation that allows the legal system to safeguard the right of the individual within the community. It said that the relation between the individual and the community is the key to the system of fundamental rights recognised by the Italian Constitution: individuals enjoy their rights not as nomads, but in their relations with the social groups to which they belong.
The establishment of the companies register and the lack of a national rule allowing data retention for a limited time only are the result of a balancing exercise carried out by the Italian legislator between individual needs and those of the community, so that the interest of the individual to prevent the availability of data relating to his or her management history cannot prevail over the above-mentioned public interests.
Decision Direction indicates whether the decision expands or contracts expression based on an analysis of the case.
The decision expands freedom of expression by ensuring the retention and publication of public data published in the companies register. This case establishes another exception to the “right to be forgotten”, in which transparency to promote relations between businesses and third parties for the development of the internal market justifies the limitation of other fundamental freedoms.
Global Perspective demonstrates how the court’s decision was influenced by standards from one or many regions.
Case significance refers to how influential the case is and how its significance changes over time.
Let us know if you notice errors or if the case analysis needs revision.