In Case
C-398/15 Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v
Salvatore Manni, the Court of Justice of the European Union has ruled
that there is no general ‘right to be forgotten’ in respect of personal data in
a companies register. However, upon expiry of a sufficiently long period after
dissolution of the company concerned, Member States may provide for restricted
access to such data by third parties in exceptional cases.
In 2007, Mr Salvatore Manni, a director of a company which
was awarded a contract for the construction of a tourist complex in Italy,
brought an action against the Lecce Chamber of Commerce. In his view, the
properties in the complex were not sold because it was clear from the companies
register that he had been the administrator of another company that went
bankrupt in 1992 and was wound up in 2005.
The Court of Lecce ordered the Lecce Chamber of Commerce to
anonymise the data linking Mr Manni to the liquidation of the first company and
to pay compensation for the damage suffered by Mr Manni. The Lecce Chamber of
Commerce brought an appeal against that judgment before the Corte suprema di
cassazione, which decided to refer several questions to the Court of Justice
for a preliminary ruling. The Italian Court asked whether the Data Protection
Directive and the Directive on disclosure of company documents (First Council
Directive 68/151/EEC of 9 March 1968) preclude any person from accessing,
without any time limit, data relating to natural persons set out in the
companies register.
In its judgment, the CJEU notes first of all that the public
nature of company registers is intended to ensure legal certainty in dealings
between companies and third parties and to protect, in particular, the
interests of third parties in relation to joint stock companies and limited
liability companies, since the only safeguards they offer to third parties are
their assets. The Court further notes that matters requiring the availability
of personal data in the companies register may arise for many years after a
company has ceased to exist. Having regard to (1) the range of legal rights and
relations which may involve a company with actors in several Member States
(even after its dissolution), and (2) the diversity of limitation periods
provided for by the various national laws, it seems impossible to identify a
single period after which the entry of the data in the register and their
disclosure would no longer be necessary. In those circumstances, Member States
cannot guarantee that natural persons whose data are included in the company
register have the right to obtain, after a certain period of time from the
dissolution of the company, the erasure of personal data concerning them.
The Court considers that this interference with the
fundamental rights of the persons concerned (in particular the right to respect
for private life and the right to protection of personal data guaranteed by the
Charter of Fundamental Rights of the Union) is not disproportionate in so far
as (1) only a limited number of personal data items are entered in the company
register and (2) it is justified that natural persons who choose to participate
in trade through such a joint stock company or limited liability company, whose
only safeguards for third parties are the assets of that company, should be
required to disclose data relating to their identity and functions within that
company. Nevertheless, the Court does not exclude the possibility that, in
specific situations, overriding and legitimate reasons relating to the specific
case of the person concerned may justify, exceptionally, that access to
personal data concerning him should be limited, upon expiry of a sufficiently
long period after the dissolution of the company in question, to third parties
who can demonstrate a specific interest in consulting that data. Such
limitation of access to personal data must be based on a case-by-case assessment.
It is for each Member State to decide if it wants such a limitation of access
in its national legal system. In the present case, the Court considers that the
mere fact that the properties of the tourist complex do not sell because
potential purchasers have access to the data of Mr Manni in the companies
register cannot justify a limitation of access by third parties to that data,
in particular given the legitimate interest of those purchasers in availing of
that information.
The official ruling is as follows:
Article 6(1)(e),
Article 12(b) and subparagraph (a) of the first paragraph of
Article 14 of Directive 95/46/EC of the European Parliament and of the
Council of 24 October 1995 on the protection of individuals with regard to
the processing of personal data and on the free movement of such data, read in
conjunction with Article 3 of the First Council Directive 68/151/EEC of
9 March 1968 on co-ordination of safeguards which, for the protection of
the interests of members and others, are required by Member States of companies
within the meaning of the second paragraph of Article 58 of the Treaty,
with a view to making such safeguards equivalent throughout the Community, as
amended by Directive 2003/58/EC of the European Parliament and of the Council
of 15 July 2003, must be interpreted as meaning that, as EU law currently
stands, it is for the Member States to determine whether the natural persons
referred to in Article 2(1)(d) and (j) of that directive may apply to the
authority responsible for keeping, respectively, the central register,
commercial register or companies register to determine, on the basis of a
case-by-case assessment, if it is exceptionally justified, on compelling
legitimate grounds relating to their particular situation, to limit, on the
expiry of a sufficiently long period after the dissolution of the company
concerned, access to personal data relating to them, entered in that register,
to third parties who can demonstrate a specific interest in consulting that
data.
