On 9 March 2017 the ECJ (Court of Justice of the European Union) handed down its judgement in a preliminary ruling referred to it by the Corte suprema di cassazione (Court of Cassation, Italy).
Mr Manni had brought an action against the Lecce Chamber of Commerce as he believed that information available on the company register relating to him previously being the administrator of a company that went bankrupt in 1992 and was wound up in 2005, affected the sales of properties in a complex built by another company of which he was a director.
Initially, the Tribunale di Lecce (Court of Lecce, Italy) ordered the Lecce Chamber of Commerce to anonymise Mr Manni's data which related to the liquidation of the company and pay him damages. The Lecce Chamber of Commerce appealed this judgement and the Corte suprema di cassazione then referred the question to the ECJ for a preliminary ruling.
Preliminary Ruling
The preliminary ruling posed this question to the ECJ: does the directive on protection of personal data and the directive on disclosure of company documents preclude any person from accessing, without time limit, data relating to persons set out in company registers?
In considering this, the ECJ noted that the public nature of company registers is intended to ensure legal certainty between companies and third parties and matters requiring the availability of information in the company register may still arise years after the company has ceased to exist. Due to the diversity of companies as well as the varying limitation periods of Member States, it was impossible for the ECJ to identify a period after which entries in the company register would no longer be necessary.
The interference with the fundamental rights of persons posed by the availability of data on company registers was not considered disproportionate as the personal information contained in company registers is limited and justified on the basis that individuals involved in companies should be required to disclose data relating to their identity and function within a company.
The ECJ did not exclude the possibility that in some situations, there could be legitimate reasons that may justify that access to personal data available on company registers being limited upon expiry of a sufficiently long period after the dissolution of the company. This would be decided on a case-by-case basis and is for each Member State to decide if it wants such limitation of access in national law.
In Mr Manni's case, the ECJ considered that the fact properties did not sell because purchasers could have accessed information held on the company register did not justify limiting access to the data.
What does this mean?
With this ruling, the ECJ has made it difficult for individuals to argue that personal data contained in company registers should be removed after dissolution of a company. The company register is an important mechanism for third parties to find out information on companies and the people behind them and therefore it seems that there would need to be exceptional circumstances to justify deletion of data on company registers.
GDPR Changes
This could all change once the General Data Protection Regulation (GDPR) comes into force on 25 May 2018. The GDPR creates a "right to be forgotten" which allows individuals to request the deletion or removal of personal data where there is no compelling reason to continue processing. This right is not absolute but could, in some circumstances, provide a mechanism for individuals involved in companies to request limitation of data available on company registers where the company no longer exists if they can argue that the data is no longer necessary.
To view the full press release on the decision please click here.
Disclaimer
The material contained in this article is of the nature of general comment only and does not give advice on any particular matter. Recipients should not act on the basis of the information in this e-update without taking appropriate professional advice upon their own particular circumstances.
