Thursday, the Court of Justice of the European Union considered whether the right to be forgotten should be applied to a register of companies. The CJEU had previously held the RTBF might apply to the processing of personal data by search engines in Google Spain. In the Manni judgement, the CJEU held that the RTBF could not be generally applied to a company register, though it did suggest that there may be some very limited circumstances where limitations might be imposed on access to personal data held on such a register.
This judgment resulted from a court case initiated by Salvatore Manni, an Italian. A company of which he was a director had been unable to sell apartments in a tourist complex. Manni believed this was because his local company register disclosed “… that he had been the administrator of another company that went bankrupt in 1992 and was wound up in 2005.” Manni challenged this availability of his personal data before his local courts, which referred the question of whether he was entitled to seek limitations upon access to his data to the CJEU.
Italian company law did not impose any period for which data had to be retained. The CJEU concluded that it was “… impossible … identify a single time limit, as from the dissolution of a company, at the end of which the inclusion of such data in the register and their disclosure would no longer be necessary” This led the CJEU to hold that “… Member States cannot … guarantee that the natural persons … have the right to obtain, as a matter of principle, after a certain period of time … the erasure of personal data concerning them, which have been entered in the register pursuant to the latter provision, or the blocking of that data from the public”
This judgment is quite specific to EU company law, but it may be significant that the CJEU was unwilling to specify any period after which it would, in principle, be unnecessary to retain or allow access to personal data on a company register.
The Court explained that this retention of personal data was not a disproportionate interference with the right of data subjects for two reasons: firstly, only a limited number of personal data items were entered in the company register; and secondly, the CJEU felt that it was justified that natural persons who choose to trade through a limited liability company, whose only safeguards for third parties would be the assets of that company, should be required to disclose data relating to their identity and functions within that company. The second finding is interesting as it suggests that a person who takes up a particular occupation may have to accept that this may result in their personal data being processed in particular ways. Of course this suggestion is not new (see Institut professionnel des agents immobiliers) but it is interesting to see it reiterated by the CJEU now.
The CJEU did not entirely exclude the possibility that there might be specific situations where there might be overriding and legitimate reasons that would justify that access to personal data entered in the register could be limited. Such limitations could only occur “exceptionally” and “…upon expiry of a sufficiently long period after the dissolution of the company in question." In addition the register would still have to allow access “… to third parties who can demonstrate a specific interest ...” The CJEU made clear that was for national legislatures (not their courts) to decide whether they wanted to provide for such limitations on access in the first place. If such limitations were to be provided, they would have to be based on “… a case-by-case assessment.”
Finally, the CJEU seemed to suggest that the continued processing of Manni’s personal data on the company register seemed justified in this case. The CJEU pointed out that the mere fact that a tourist complex found it difficult to sell properties because potential purchasers had access to the data of Manni in the company register could not, in itself, justify limiting access by third parties to that data.
Judgment in Manni seems consistent with the new right to be forgotten found in Article 17 of the GDPR which will apply from May 25, 2018. This provides that subjects may seek the erasure of their personal data where that data is “… no longer necessary in relation to the purposes for which they were collected …” However, subjects will not be able to obtain the erasure of their personal data where processing is necessary “… for compliance with a legal obligation …” So if the retention of data is required by law then the RTBF cannot be invoked, unless that law limits the time for which data may be retained. Both of these positions seem consistent with Manni.
Photo credit: Image provided by the Court of Justice of the European Union.