With its decision of March 9 2017, The European Court of Justice has set limits to the right to be forgotten with respect to personal data recorded in the company register.
According to the Court, it cannot be guaranteed that liquidator and any person having the power to represent a company have a right to obtain, after a certain period of time from the dissolution of their company, the erasure of their personal data which have been entered in the company register or the blocking of that data from the public.
It is for each Member States to determine whether, under exceptional circumstances and on a case-by-case basis, natural persons may ask for their personal data not to be made publicly available.
1.Facts:
Mr Manni is the sole director of Italiana Costruzioni Srl, a building company which was awarded a contract for the construction of a tourist complex.
According to Mr Manni, the properties in that complex were not selling because it was apparent from the companies register the he had been the sole director and liquidator of a real estate company, which had been declared insolvent in 1992 and struck off the companies register on July 7 2005 following liquidation proceedings.
Still according to Mr Manni, a company specialised in risk assessment (“rating”) had processed Mr Manni’s personal data published in the company register.
The Lecce Chamber of Commerce refusing to remove the information from the company register, Mr Ranni started proceeding on December 2007 in order to get this information removed and to obtain compensation for the damage he suffered by reason of the injury to his reputation.
2.Position of the Court :
2.1.Right to erasure of company’s representative and liquidators information cannot be guaranteed
For the Court, it cannot be guaranteed that liquidator and any person having the power to represent a company have a right to obtain, after a certain period of time from the dissolution of their company, the erasure of their personal data which have been entered in the company register or the blocking of that data from the public.
As pointed out by the Advocate General, it is common ground that even after the dissolution of a company, rights and legal relations relating to it continue to exist.
For example, the data may be necessary in order to assess the legality of an act carried out on behalf of that company during the period of its activity or so that third parties can bring an action against the members of the organs or against the liquidators of that company.
It also depend on the limitation periods applicable in each various Member States. The information may therefore be necessary many years after a company has ceased to exist.
According to the Court, given the fact that limitation periods provided for by the various national laws in the various areas of law, it seems impossible at present to identify a single time limit from the dissolution of a company at the end of which the inclusion of such data in the register and their disclosure would no longer be necessary.
2.2.This position is not a disproportionate interference with the fundamental rights
As for the Court, this position is not a disproportionate interference with the fundamental rights of the persons including their right to respect for private life and right to protection of personal data for the following reasons:
- Directive 68/151 relating to the disclosure of information by companies in the company register, requires disclosure of a limited number of personal data items (identity and functions of persons having the power to bind the company or their liquidator.
- The only guarantee Joint stock companies and limited liability companies offer to third parties is their assets. It is an increased economic risk for third party and it is therefore natural for natural persons who choose to participate in trade through companies to disclose the data relating to their identity and function within that company.
2.3.But under certain circumstances, access to information should be limited
However the ECJ has left room to derogations by adding that there may be specific situation where the overriding and legitimate reasons relating to the specific case of the person concerned justify exceptionally that access to personal data entered in the register is limited, upon expiry of a sufficiently long period after the dissolution of the company in question to third parties who can demonstrate a specific interest in their consultation.
Even though the Court is open to derogation, the mere fact that allegedly Mr Manni does not sell properties of a tourist complex because potential purchasers have access to information relating to a previous liquidation is not sufficient to constitute a legitimate ground to object such processing of personal information.
Under the Court decision, it is for Member State to determine whether the natural persons that must provide personal information in the company register (i.e. company’s representative and liquidator) may apply to the authority responsible for keeping the register to determine, on a case by case basis, if it is exceptionally justified, on compelling legitimate grounds, to limit, on the expiry of a sufficiently long period after the dissolution of the company concerned, access to personal data relating to them, entered in that register, to third parties who can demonstrate a specific interest in consulting that data.
3.Comments:
3.1. It is surprising that the ECJ found impossible to determine a data retention period on the ground of the complexity of the situation and of the various applicable law whereas the directive and the future data protection regulation impose to all data controllers to determine a data retention period of their data processing and the GDPR further requires to provide the information relating to data retention period to the data subjects at the time of the data collection.
It is even more surprising that it seems to accept that personal data may be kept without any data retention period be determined and should under exceptional circumstances not be made publicly available instead of being deleted.
Even though it seems it was not possible to determine the data retention period uniformly applicable to all Member states, it could have been expected that the Court provide either the keys to determining a data retention period or require such data retention period to be determined by the Member States.
3.2. Indeed, there is no derogation to the determination of a data retention period provided for in neither the directive nor the GDPR when it comes to complex situation or company’s register. A data retention period have to be determined however long it is unless the ECJ accepts that sometimes the purpose of data protection regulation are not in line with a more complex reality and that it is not always possible to determine a data retention period. Many professional would agree… but data should always be deleted at some point unless otherwise provided by law (etc. archiving etc.)
3.3. However, in the case of a public register, unlike the ECJ states, it is not only the identity of a liquidator or a representative that is made publicly available but also the fact that a person failed in business at some point in their life. Even though it is a very important information for third party making business with this person, maybe this information does not need to be made publicly available for ever and should also be permanently deleted from the register at some point.
This question should be raised at national level in order to determine how long this information should be made publicly available and how long it should be kept by company register taking in consideration all kind of stakeholders’ interests. This would provide certainty and would still be in line with the data protection rules as such a derogation to the data protection principles is difficult to understand.
This post is also available in fr_FR.
