There is no “right to be forgotten” in respect of personal data in the companies register, though exceptionally member states may provide for restricted access to such data by third parties after a sufficiently long period following dissolution of the company concerned, the EU Court of Justice has ruled.
The court was giving its decision in a case referred from the Italian courts, brought by company director Salvatore Manni against the Lecce Chamber of Commerce. Mr Manni's company had been awarded a contract for the construction of a tourist complex, but the properties in the complex had not sold, in Mr Manni's view because it was clear from the companies register that he had been the administrator of another company that went bankrupt in 1992 and was wound up in 2005.
At first instance the court ordered anonymisation of the relevant data and payment of compensation to Mr Manni. On appeal the Court of Cassation referred to the Court of Justice the questions whether the directive on the protection of personal data and the directive on disclosure of company documents precluded any person from accessing, without any time limit, data relating to natural persons set out in the companies register.
In its judgment the Court of Justice noted that the public nature of company registers is intended to ensure legal certainty in dealings between companies and third parties, and to protect the interests of third parties in relation to limited liability companies. Further, matters requiring the availability of personal data in the companies register may arise for many years after a company has ceased to exist. Having regard to the range of legal rights potentially involved, and to the diversity of limitation periods in the various national laws, it was impossible to identify a single period after which the entry of the data in the register and their disclosure would no longer be necessary.
The interference this involved with the fundamental rights of the persons concerned, in particular the right to respect for private life and the right to protection of personal data, guaranteed by the EU Charter of Fundamental Rights, was not disproportionate having regard to the limited number of personal data items entered in the company register, and the consideration that “It appears justified that natural persons who choose to participate in trade through such a company are required to disclose the data relating to their identity and functions within that company, especially since they are aware of that requirement when they decide to engage in such activity.”
The court did not exclude the possibility that, in specific situations, overriding and legitimate reasons relating to the specific case of the person concerned may justify, exceptionally, that access to personal data concerning him should be limited, upon expiry of a sufficiently long period after the dissolution of the company in question, to third parties who can demonstrate a specific interest in consulting that data. Such limitation of access to personal data would have to be “on the basis of a case-by-case assessment”, and it was for each member state to decide whether it wanted such a limitation of access in its national legal system.
In the present case, the mere fact that the properties of the tourist complex did not sell because potential purchasers had access to Mr Manni's data in the companies register could not justify a limitation of access by third parties to that data, “in particular in view of the legitimate interest of those purchasers in having that information”.
Click here to view the judgment.
