Right (not) to be forgotten in the companies register – an update from the CJEU

by Alina Trapova

Although strictly speaking not an IP matter, the right to be forgotten has entertained IP “cousin” blogs, journals and academics. Hence, a little update from the data protection sector would not harm.

Mr Salvatore Manni (IT) was the sole director of the company Italiana Costruzioni Srl, responsible for the construction of a tourist complex in Italy. He brought an action against the Lecce Chamber of Commerce since the companies register revealed that he had been the administrator of another company (Immobiliare e Finanziaria Salentina Srl) which went bankrupt back in 1992. Mr Manni believed that this publicly available information was the reason why properties in the newly built tourist complex were not selling. Therefore, it should be deleted, anonymised or blocked from the register.

Basis for his claim was the so-called Google Spain case [1], which in essence says that individuals have the right under certain conditions to request search engines to remove links with personal information about them. For the right to be forgotten to kick in, that information should be inaccurate, inadequate, irrelevant or excessive, which was the case of Mr González where press articles discussed debt recovery proceedings in which he had been involved 16 years ago. Nevertheless, the right to be forgotten is far from absolute – it must be appropriately balanced with other fundamental interests such as freedom of speech. Inevitably, each case is assessed on its own merits.

Mr Manni was successful before the Court of Lecce (Tribunale di Lecce), which ordered the said information to be anonymised and compensation for the damage to be paid. The Lecce Chamber of Commerce was however unhappy with this outcome and appealed the case before the Court of Cassation (Corte suprema di cassazione), which in turn referred several questions to the CJEU. In essence it asked whether the Directive on protection of personal data [2] and the Directive on disclosure of company documents [3] preclude the public from accessing, without any time limit, data relating to natural persons set out in the companies register.

In a judgment of 9 March 2017 (C-987/15) the CJEU was less sympathetic to Mr Manni than the Tribunale di Lecce. It outlined the important role of the public companies register, i.e. safeguarding interests of third parties in relation to joint stock companies and limited liability companies. The Court also emphasised that it was not possible to specify the period after which the retention of this personal information would no longer be necessary.

It acknowledged that such retention of personal information long after the dissolution of a company interferes with fundamental rights, i.e. the respect for private life and the right to protection of personal data, both enshrined in the Charter of Fundamental Rights of the European Union. Yet such interference is not disproportionate as only limited data is entered on the company register and is nevertheless justified since natural persons who choose to set up joint stock company or limited liability company are to disclose data relating to their identity and functions within that entity.

However, there is a caveat – in specific situations after a sufficiently long period following the dissolution of the company in question there might be overriding and legitimate reasons justifying the limitation of access to that personal data (of course, relating to the specific case at hand). As usual, this limitation is applied on a case-by-case approach and it is up to each Member State to decide whether to adopt it.

In the present case, the legitimate interest of third parties in having access to the information in the companies register was vital and the mere fact that properties of a tourist complex do not sell as potential purchasers have access to Mr Manni’s data in the companies register was insufficient to outweigh it.

 Comment

Italy is a beautiful country (proof here, here, here, etc.), so the blame-shifting attempt about not selling the properties did not play to Mr Manni’s benefit on this occasion. Every time expressions such as “balancing against other fundamental rights”, “a case-by-case assessment” and “specific situations” crop up, one has the feeling that legal certainty quietly leaves the room. Well, it is safe to say that in the 65 paragraphs of this CJEU preliminary ruling no such ambiguity was left. After all, the companies register is not equivalent to Google Search.

Full judgment can be found here.

Alina Trapova LL.M. (QMUL)

[1] Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González, Case C-131/12.

[2] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995, L 281, p.31).

[3] First Council Directive 68/151/EEC of 9 March 1968 (OJ 1968, L 65, p.8), as amended by Directive 2003/58/EC of the European Parliament and the Council of 15 July 2003 (OJ 2003, L 221, p. 13).