March 13, 2017

In 2007, Mr Salvatore Manni, director of a construction company that had constructed a tourist complex in Italy, brought proceedings against the Lecce Chamber of Commerce, contending that the properties in the complex had not sold because it was clear from the companies register that he had been the administrator of another company that had gone bankrupt in 1992 and had been wound up in 2005.

The Lecce court ordered the Lecce Chamber of Commerce to anonymise the data linking Mr Manni to the liquidation of the first company and to pay damages to Mr Manni. The Chamber of Commerce appealed the decision to the Court of Cassation, which asked the CJEU whether the Data Protection Directive (95/46/EC) and the Disclosure of Company Documents Directive (68/151/EEC) preclude any person from accessing, at any time, data relating to natural persons in the companies register.

The CJEU noted that the public nature of company registers is intended to ensure legal certainty in dealings between companies and third parties and to protect, in particular, the interests of third parties in relation to joint stock companies and limited liability companies, since the only safeguards they offer to third parties are their assets.

The CJEU further noted that matters requiring the availability of personal data in the companies register may arise for many years after a company has ceased to exist. Considering: (i) the range of legal rights and obligations of a company with interests in different Member States (even after its dissolution); and (ii) the different limitation periods set by the various national laws, it was impossible to identify a single period after which the entry of the data in the register and its disclosure would no longer be necessary.

In those circumstances, the CJEU Said, Member States cannot guarantee that people whose data is included in the company register have the right to have their personal data erased after a certain period of time has passed.

The CJEU said that this interference with the fundamental rights of the persons concerned (in particular the right to respect for private life and the right to protection of personal data guaranteed by the Charter of Fundamental Rights) was not disproportionate insofar as: (i) only a limited amount of personal data was entered in the company register; and (ii) it was justified that people who choose to participate in trade through a joint stock company or limited liability company, whose only safeguards for third parties are the assets of that company, should be required to disclose data relating to their identity and functions within that company.

Nevertheless, the CJEU did not exclude the possibility that, in specific situations, overriding and legitimate reasons relating to the specific case of the person concerned may justify, exceptionally, that access to personal data concerning him/her should be limited, upon expiry of a sufficiently long period after the dissolution of the company in question, to third parties who can demonstrate a specific interest in consulting that data. Such limitation of access to personal data must be based on a case-by-case assessment. It was for each Member State to decide if it wanted such a limitation of access in its national legal system.

In this case, the CJEU considered that the mere fact that the properties of the tourist complex did not sell because potential purchasers had access to the data of Mr Manni in the companies register did not justify a limitation of access by third parties to that data, in particular given the legitimate interest of those purchasers in having that information. (Case C-398/15 Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni — to access the judgment in full, go to the curia search form, type in the case number and follow the link).