OPINION OF ADVOCATE GENERAL
BOT
delivered on 8 September 2016 (1)
Case C‑398/15
Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce
v
Salvatore Manni
(Request for a preliminary ruling
from the Corte suprema di cassazione
(Court of Cassation, Italy))
(Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Article 6(1)(e) and Article 7(c), (e) and (f) — Data subject to disclosure in the companies register — First Directive 68/151/EEC — Article 2(1)(d) and (j) and Article 3 — Right to be forgotten — Charter of Fundamental Rights of the European Union — Articles 7 and 8)
1. Following its judgment of 13 May 2014 in Google Spain and Google (C‑131/12, EU:C:2014:317), the Court is invited to delineate the contours of the right of individuals to obtain erasure or anonymisation of their personal data, this time in the specific context of official disclosure of information relating to companies.
2. In the present case, the Court will need to interpret the provisions of two directives in the light of the Charter of Fundamental Rights of the European Union (‘the Charter’), so as to make their provisions reconcilable.
3. The directives concerned are First Council Directive 68/151/EEC of 9 March 1968 on coordination of safeguards which, for the protection of the interests of members and others, are required by Member States of companies within the meaning of the second paragraph of Article 58 of the Treaty, with a view to making such safeguards equivalent throughout the Community, (2) as amended by Directive 2003/58/EC of the European Parliament and of the Council of 15 July 2003 (‘Directive 68/151’), (3) and Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. (4)
4. The present request for a preliminary ruling has been made in proceedings between Mr Salvatore Manni and the Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce (Chamber of Commerce, Industry, Craft Trades and Agriculture of Lecce, Italy, hereafter ‘the Lecce Chamber of Commerce’), concerning the latter’s refusal to remove certain personal data relating to Mr Manni from the companies register. (5)
5. In this Opinion, I suggest that the Court’s answer to the Corte suprema di cassazione (Court of Cassation, Italy) should be that Article 2(1)(d) and (j) and Article 3 of Directive 68/151, and Article 6(1)(e) and Article 7(c), (e) and (f) of Directive 95/46, read in the light of Articles 7 and 8 of the Charter, must be interpreted as preventing personal data entered in the companies register being, after a certain period has elapsed and at the request of the person concerned, removed, anonymised or blocked, or made accessible only to a restricted category of third parties, namely those demonstrating a legitimate interest in having access to such data.
I – Legal framework
A – EU law
1. Directive 68/151
6. Under Article 1 of Directive 68/151, the coordination measures laid down by that directive apply to the laws, regulations and administrative provisions of the Member States relating to the following types of company: in Italy, ‘[the] società per azioni [joint-stock company], [the] società in accomandita per azioni, [partnership partly limited by shares] and [the] società a responsabilità limitata [company with limited liability]’.
7. Articles 2 and 3 of that directive, which appear in section I, entitled ‘Disclosure’ provide:
‘Article 2
1. Member States shall take the measures required to ensure compulsory disclosure by companies as referred to in Article 1 of at least the following documents and particulars:
(a) the instrument of constitution, and the statutes if they are contained in a separate instrument;
…
(d) the appointment, termination of office and particulars of the persons who either as a body constituted pursuant to law or as members of any such body:
(i) are authorised to represent the company in dealings with third parties and in legal proceedings;
(ii) take part in the administration, supervision or control of the company.
…
(h) the winding up of the company;
…
(j) the appointment of liquidators, particulars concerning them, and their respective powers, unless such powers are expressly and exclusively derived from law or from the statutes of the company;
(k) the termination of the liquidation and, in Member States where striking off the register entails legal consequences, the fact of any such striking off.
Article 3
1. In each Member State, a file shall be opened in a central register, commercial register or companies register, for each of the companies registered therein.
2. All documents and particulars which must be disclosed pursuant to Article 2 shall be kept in the file, or entered in the register; the subject matter of the entries in the register must in every case appear in the file.
…
3. A copy of the whole or any part of the documents or particulars referred to in Article 2 must be obtainable on application. As from 1 January 2007 at the latest, applications may be submitted to the register by paper means or by electronic means as the applicant chooses.
…’
8. Directive 68/151 was repealed and replaced by 2009/101/EC of the European Parliament and of the Council of 16 September 2009 on coordination of safeguards which, for the protection of the interests of members and third parties, are required by Member States of companies within the meaning of the second paragraph of Article 48 of the Treaty, with a view to making such safeguards equivalent. (6)
9. Directive 2009/101 was itself amended by Directive 2012/17/EU of the European Parliament and of the Council of 13 June 2012 amending Council Directive 89/666/EEC and Directives 2005/56/EC and 2009/101/EC of the European Parliament and of the Council as regards the interconnection of central, commercial and companies registers. (7)
10. It is apparent from the ninth recital in the preamble to Directive 2012/17 that that directive seeks to improve cross-border access to business information on companies and their branches opened in other Member States by ensuring that registers are interoperable.
11. According to the twenty-fifth recital in the preamble to Directive 2012/17, any processing of personal data by the registers of Member States, by the Commission and, if applicable, by any third party involved in operating the central European platform established by the directive should take place in compliance with Directive 95/46.
12. To that end, Directive 2012/17 (amongst other things) inserted Article 7a into Directive 2009/101, which provides as follows:
‘The processing of personal data carried out in the context of this Directive shall be subject to Directive 95/46/EC ...’
13. However, having regard to the date of the events at issue in the main proceedings, those proceedings remain governed by Directive 68/151.
2. Directive 95/46
14. Directive 95/46, which, according to Article 1, has the object of protecting the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and of removing obstacles to the free flow of such data, states in the second, eighth, tenth, twenty-fifth, twenty-eighth and twenty-ninth recitals in its preamble:
‘(2) Whereas data-processing systems are designed to serve man; whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy, and contribute to economic and social progress, trade expansion and the well-being of individuals;
…
(8) Whereas, in order to remove the obstacles to flows of personal data, the level of protection of the rights and freedoms of individuals with regard to the processing of such data must be equivalent in all Member States …
(9) Whereas, given the equivalent protection resulting from the approximation of national laws, the Member States will no longer be able to inhibit the free movement between them of personal data on grounds relating to protection of the rights and freedoms of individuals, and in particular the right to privacy …
(10) Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms [, signed in Rome on 4 November 1950,] and in the general principles of Community law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community;
…
(25) Whereas the principles of protection must be reflected, on the one hand, in the obligations imposed on persons … responsible for processing, in particular regarding data quality, technical security, notification to the supervisory authority, and the circumstances under which processing can be carried out, and, on the other hand, in the right conferred on individuals, the data on whom are the subject of processing, to be informed that processing is taking place, to consult the data, to request corrections and even to object to processing in certain circumstances;
…
(28) Whereas any processing of personal data must be lawful and fair to the individuals concerned; whereas, in particular, the data must be adequate, relevant and not excessive in relation to the purposes for which they are processed; whereas such purposes must be explicit and legitimate and must be determined at the time of collection of the data; whereas the purposes of processing further to collection shall not be incompatible with the purposes as they were originally specified;
(29) Whereas the further processing of personal data for historical, statistical or scientific purposes is not generally to be considered incompatible with the purposes for which the data have previously been collected provided that Member States furnish suitable safeguards; whereas these safeguards must in particular rule out the use of the data in support of measures or decisions regarding any particular individual.’
15. Article 2 of Directive 95/46 provides:
‘For the purposes of this Directive:
(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity;
(b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
…
(d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law;
…’
16. Article 3 of that directive, entitled ‘Scope’, provides in paragraph 1:
‘This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing other than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.’
17. In Section I (entitled ‘Principles relating to data quality’) of Chapter II of Directive 95/46, Article 6 is worded as follows:
‘1. Member States shall provide that personal data must be:
(a) processed fairly and lawfully;
(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards;
(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified;
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.
2. It shall be for the controller to ensure that paragraph 1 is complied with.’
18. In Section II (entitled ‘Criteria for making data processing legitimate’) of Chapter II of Directive 95/46, Article 7 provides:
‘Member States shall provide that personal data may be processed only if:
…
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
or
…
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed;
or
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1(1).’
19. Furthermore, Article 12 of that directive, entitled ‘Right of access’, provides:
‘Member States shall guarantee every data subject the right to obtain from the controller:
…
(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
…’
20. Finally, Article 14 of Directive 95/46, entitled ‘The data subject’s right to object’, is in the following terms:
‘Member States shall grant the data subject the right:
(a) at least in the cases referred to in Article 7 (e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;
…’
B – Italian law
21. Article 2188 of the Codice civile (Civil Code) provides:
‘A companies register shall be established for the entries in the register required by law.
The register shall be kept by the office of the companies register under the supervision of a judge appointed by the president of the court.
The register shall be publicly available.’
22. Article 8(1) and (2) of legge n. 580 — Riordinamento delle camere di commercio, industria, artigianato e agricoltura (Law No 580 on the reorganisation of chambers of commerce, industry, craft trades and agriculture), of 29 December 1993, (8) provides that it is the responsibility of the chambers of commerce, industry, craft trades and agriculture to keep the register.
23. Decreto del Presidente della Repubblica n. 581 — Regolamento di attuazione dell’articolo 8 della legge 29 dicembre 1993, n. 580, in materia di istituzione del registro delle impresa di cui all’articolo 2188 del codice civile (Decree No 581 of the President of the Republic, laying down implementing regulations for Article 8 of Law No 580, of 29 December 1993, concerning the establishment of the companies register referred to in Article 2188 of the Civil Code), of 7 December 1995, (9) governs certain details relating to the companies register.
24. Directive 95/46 has been transposed into Italian law by decreto legislativo n. 196 — Codice in materia di protezione dei dati personali (Legislative Decree No 196 on the personal data protection code), of 30 June 2003. (10)
II – The main proceedings and the questions referred
25. Mr Manni is the sole director of Italiana Costruzioni Srl, a building company which was awarded a contract for the construction of a tourist complex.
26. By an action commenced on 12 December 2007, Mr Manni brought proceedings against the Lecce Chamber of Commerce, claiming that the complex buildings were not selling because it was apparent from the companies register that he had been the sole director and liquidator of Immobiliare e Finanziaria Salentina Srl (‘Immobiliare Salentina’), which had been declared insolvent in 1992 and struck off the companies register, following liquidation proceedings, on 7 July 2005.
27. In that action, Mr Manni has alleged that that personal data which appear in the companies register have been processed by commercial information companies, such as Cerved Business Information SpA, and that, notwithstanding a request of 10 April 2006 to remove it from the register, the Lecce Chamber of Commerce has not done so.
28. Mr Manni has therefore sought an order requiring the Lecce Chamber of Commerce to erase, anonymise or block the data linking him to the liquidation of Immobiliare Salentina, together with an order that the Lecce Chamber of Commerce compensate him for the damage he has suffered by reason of the injury to his reputation.
29. By judgment of 1 August 2011, the Tribunale di Lecce (Court of Lecce, Italy) upheld that claim, ordering the Lecce Chamber of Commerce to anonymise the data linking Mr Manni to the liquidation of Immobiliare Salentina and to pay compensation for the damage suffered by him, assessed at EUR 2 000, together with interest and costs.
30. The Tribunale di Lecce (Court of Lecce) considered that ‘it is difficult to see the need for or utility of the name of the person who was sole director of the company at the time of the liquidation being shown’, on the basis that ‘the court is asked to consider events which occurred more than a decade ago, this notwithstanding that the company was removed from the register … more than two years ago’. According to that court, the ‘“historical memory” of the existence of the company and the difficulties it experienced … can to a great extent be just as well effected by means of anonymous data’. ‘It is not permissible for entries in the register which link the name of an individual to a critical phase in the life of the company (such as its liquidation) to be permanent, unless there is a specific general interest in their retention and disclosure’. In the absence of any provision of the Civil Code laying down a maximum period of registration, that court held that, ‘after an appropriate period’ from the conclusion of the liquidation, and after the company has been removed from the register, stating the name of the person who was sole director at the time of the liquidation ceases to be necessary and useful, for the purposes of Legislative Decree No 196, and the public interest can be satisfied by indicating the company’s difficulties together with anonymous data relating to the individual who was authorised to represent it.
31. The Lecce Chamber of Commerce brought an appeal against that judgment before the Corte suprema di cassazione (Court of Cassation), which decided to stay the proceedings and refer the following questions to the Court for a preliminary ruling:
‘(1) Must the principle of keeping personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed, laid down in Article 6[(1)](e) of Directive 95/46 … implemented [by] Legislative Decree No 196 of 30 June 2003, take precedence over and, therefore, preclude the system of disclosure through the commercial registers provided for by … Directive 68/151 … and by national law in Article 2188 of the Civil Code and Article 8 of Law No 580 of 29 December 1993 [on the reorganisation of chambers of commerce, industry, craft trades and agriculture], in so far as it is a requirement of that system that anyone may, at any time, obtain the data relating to individuals in those registers?
(2) Consequently, is it permissible under Article 3 of … Directive 68/151 … by way of derogation from [the principles] that there should be no time limit and that anyone may consult the data published in the companies register, for the data no longer to be subject to ‘disclosure’, in both those regards, but to be available for only a limited period and only to certain recipients, on the basis of a case by case assessment by the data manager?’
III – Analysis
32. By its questions, which in my view should be considered together, the referring court asks the Court, essentially, for a ruling as to whether Article 2(1)(d) and (j) and Article 3 of Directive 68/151, and Article 6(1)(e) and Article 7(c), (e) and (f) of Directive 95/46, read in the light of Articles 7 and 8 of the Charter, must be interpreted as meaning that it is mandatory, or, on the contrary, that it is prohibited, for personal data appearing in the register of companies, after a certain period has elapsed and upon the request of the person concerned, to be removed, anonymised or blocked, or made accessible only to a restricted category of third parties, namely those who can demonstrate a legitimate interest in having access to such data.
33. The Court is requested to answer those questions against the background of Mr Manni’s request for personal data relating to him appearing in the companies register kept by the Lecce Chamber of Commerce, in relation to a company which he formerly managed and which was declared to be insolvent, to be erased, anonymised or blocked.
34. Moreover, those questions relate to whether the processing of those data by the Lecce Chamber of Commerce was compatible with EU law, not whether subsequent processing of the same data by a commercial information company would be so compatible.
35. The questions referred seek to reconcile two principles: the principle that information appearing in companies registers is subject to disclosure, laid down by Directive 68/151; and the principle that personal data are to be kept for no longer than is necessary for the purposes for which the data are processed, laid down by Directive 95/46.
36. In order to reconcile those two principles, the referring court envisages that it may be possible to limit the principle that information appearing in companies registers is subject to disclosure by permitting access to personal data in the register for a limited period only, and/or for the benefit of a restricted category of persons.
37. I should state, first of all, that the processing of the personal data in question falls within the scope of Directive 95/46. (11)
38. The data which are required to appear in the companies register, under Article 2(1)(d) and (j) of Directive 68/151, constitute personal data within the meaning of Article 2(a) of Directive 95/46 because they represent ‘information relating to an identified or identifiable natural person’. (12) The fact that that information was provided as part of a professional activity does not mean that it cannot be characterised as a set of personal data. (13)
39. Next, I observe that Article 2(b) of Directive 95/46 defines ‘processing of personal data’ as ‘any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction’.
40. It is not disputed that the recording, storage and making available of personal data by the authority responsible for keeping the companies register is to be characterised as ‘processing of personal data’ within the meaning of Article 2(b) of Directive 95/46. Furthermore, that authority is the ‘controller’ of such processing, within the meaning of Article 2(d) of that directive.
41. The personal data protection rules contained in Directive 95/46 must be complied with in respect of any processing of such data as defined by Article 3 of that directive. (14)
42. Directive 68/151 does not lay down any period on expiry of which the information contained in companies registers is to be erased, anonymised or blocked, nor does it make any provision for access to such information to be limited, after a certain period has elapsed, to a restricted category of persons. However, in implementing that directive, Member States are required to comply with EU law concerning the protection of personal data, that is, with Directive 95/46 and Articles 7 and 8 of the Charter.
43. In relation to the rules contained in Directive 95/46, processing of personal data by national authorities responsible for keeping companies registers must comply with the data quality principles set out in Article 6 of that directive and must satisfy one of the criteria listed in Article 7 for making data processing legitimate.
44. The Court has held that the provisions of Directive 95/46, inasmuch as they govern the processing of personal data liable to infringe fundamental freedoms, in particular the right to respect for private life, must necessarily be interpreted in the light of the fundamental rights guaranteed by the Charter. (15)
45. Thus, Article 7 of the Charter guarantees the right to respect for private life, whilst Article 8 of the Charter expressly declares the right to the protection of personal data. Article 8(2) and (3) of the Charter stipulates that such data must be processed fairly, for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law, that everyone has the right of access to data which have been collected concerning him or her and the right to have it rectified, and that compliance with those rules is to be subject to control by an independent authority. Those requirements are implemented by, inter alia, Articles 6, 7, 12, 14 and 28 of Directive 95/46.
46. It is apparent from Article 1 of Directive 95/46 and from recitals 2 and 10 thereof that that directive seeks to ensure not only effective and complete protection of the fundamental rights and freedoms of natural persons, in particular the fundamental right to respect for private life with regard to the processing of personal data, but also a high level of protection of those fundamental rights and freedoms. The importance of both the fundamental right to respect for private life, guaranteed by Article 7 of the Charter, and the fundamental right to the protection of personal data, guaranteed by Article 8 thereof, is, moreover, emphasised in the case-law of the Court. (16)
47. That having been said, it is apparent from the case-law of the Court that the right to protection of personal data is not an absolute right, but must be considered in relation to its function in society. (17) Moreover, Article 52(1) of the Charter permits limitations to be imposed on the exercise of rights such as those enshrined in Articles 7 and 8 of the Charter, provided that the limitations are provided for by law, respect the essence of those rights and freedoms and, subject to the principle of proportionality, are necessary and actually meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.
48. The uncertainty expressed by the referring court is focused on the interpretation of Article 6(1)(e) of Directive 95/46, which provides that personal data must be ‘kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed’. It also provides that ‘Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use’.
49. The data quality principle expressed in Article 6(1)(e) of Directive 95/46 means that, for as long as the purpose for which the personal data were collected and, where applicable, subsequently processed requires, it remains lawful to keep the data in a form which permits identification of data subjects.
50. The issue raised by the present case is whether national authorities responsible for keeping companies registers must decide, after a certain period has elapsed since a company ceased to trade, and on the request of the data subject, either to erase or to anonymise personal data of the data subject appearing in a companies register, or to limit their disclosure by restricting their availability to a restricted category of persons.
51. I consider that the EU legal rules relating to the protection of personal data do not impose such limitations on the official disclosure provided by the companies register.
52. I observe at the outset that the processing of personal data at issue in the main proceedings satisfies several of the criteria making data processing legitimate set out in Article 7 of Directive 95/46. Firstly, in accordance with Article 7(c) of that directive, the processing is ‘necessary for compliance with a legal obligation to which the controller is subject’. Secondly, in accordance with Article 7(e) of that directive, the processing is ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed’. Thirdly, in accordance with Article 7(f) of Directive 95/46, the processing is ‘necessary for the purposes of the legitimate interests pursued … by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1(1)’.
53. The legal obligation to which the controllers are subject arises from Articles 2 and 3 of Directive 68/151, as transposed into the national law of the Member States, which require the Member States to provide for personal data relating to directors and liquidators of companies to be entered in the companies registers, and for third parties to have access to that data.
54. The recording and disclosure of basic company information by means of such registers is intended to create a reliable source of information and thus provide the legal certainty which is necessary to protect the interests of third parties (in particular those of creditors), fair trading, and thus the proper functioning of the market. Third parties must also have access to official, reliable information about companies, in order to ensure an appropriate degree of transparency and legal certainty within the market.
55. The requirements of disclosure relate to the companies identified in Article 1 of Directive 68/151. Those companies benefit from a particular legal status offering them the advantages of legal personality. In exchange, it is in the public interest for information relating to the individuals involved in such companies to be officially recorded and disclosed.
56. In its judgment of 12 July 2012, Compass-Datenbank (C‑138/11, EU:C:2012:449), the Court held that a data collection activity relating to undertakings, based on a statutory obligation on those undertakings to disclose the data and powers of enforcement related thereto, fell within the exercise of public powers. As a result, such an activity is not an economic activity. (18)
57. Equally, the Court held that an activity consisting in the maintenance and making available to the public of the data thus collected, whether by a simple search or by means of the supply of print-outs, in accordance with the applicable national legislation, also does not constitute an economic activity, since the maintenance of a database containing such data and making those data available to the public are activities which cannot be separated from the activity of collection of the data. The collection of the data would be rendered largely useless in the absence of the maintenance of a database which stores the data for the purpose of consultation by the public. (19)
58. I share the view expressed by Advocate General Jääskinen in his Opinion in Compass-Datenbank (C‑138/11, EU:C:2012:251), where he stated that ‘it is beyond doubt that the storing in a database, in this case the undertakings register, of information provided by undertakings on the basis of statutory reporting obligations is by its nature, aim and the rules to which it is subject connected to the exercise of public powers’. (20) He also stated that ‘the storage of data on the undertakings register, on the basis of a legal obligation to do so, is an activity undertaken in the general interest of legal certainty’ (21) and that ‘the express purpose of public registers such as the companies register is to create a source of information that can be relied on in legal relations, and thereby provide the legal certainty necessary for exchange on the market’. (22) Finally, only specific legal rules can make the information appearing on undertakings registers binding on third parties, which distinguishes such information from that collected by undertakings for commercial purposes. (23)
59. In this regard, as the referring court rightly observes, a clear distinction must be made between processing of personal data carried out by the authority responsible for keeping the companies register and processing of personal data carried out by third parties on the basis of the information appearing in the register. Only processing of the first type is a manifestation of the exercise of official authority to regulate the market, as opposed to participation in the market.
60. As is apparent from recital 1 of Directive 68/151, that directive seeks to promote the development of the internal market. In order to achieve that objective, the directive provides for minimum common rules on disclosure in relation to companies and the minimum information which the registers must contain, in the interests of the legal certainty necessary for trade and the actual development of the internal market.
61. According to recital 2 of Directive 68/151, the objective of the directive is to protect the interests of third parties. In particular, according to recital 4 of that directive, ‘the basic documents of the company should be disclosed in order that third parties may be able to ascertain their contents and other information concerning the company, especially particulars of the persons who are authorised to bind the company’. It is also apparent from recitals 4 to 6 of the directive that the fact of disclosing basic documents and information in relation to the company to third parties, in particular data relating to the persons who are authorised to bind it, is closely linked to the need to restrict to the greatest possible extent the grounds on which obligations entered into in the name of the company are not valid. Accordingly, the objective of disclosure of data entered in the companies register is to ensure legal certainty with regard to commercial transactions.
62. The EU legislature has thus emphasised the importance to third parties of having access to data relating to individuals who are authorised to represent a company or who participate in its management, supervision or control. In its judgment of 12 November 1974, Haaga (32/74, EU:C:1974:116), the Court observed that the purpose of Directive 68/151 is to ‘guarantee legal certainty in relation to dealings between companies and third parties in view of the intensification of trade between Member States following the creation of the Common Market’. (24) With that in mind, it is important, in the Court’s view, that ‘any person wishing to establish and develop trading relations with companies situated in other Member States should be able easily to obtain essential information relating to the constitution of trading companies and to the powers of persons authorised to represent them’. (25) Accordingly, ‘in the interests of legal transactions between nationals of different Member States, it is … important that all the relevant information should be expressly stated in official registers or records’. (26) Each national authority responsible for keeping companies registers thus becomes a ‘custodian of something resembling the civil status of a legal person’. (27)
63. Furthermore, the Court has had occasion to hold that protecting the interests of third parties, in particular those of creditors, and preserving fairness and legal certainty in commercial transactions are imperative requirements in the public interest. (28)
64. In the light of the foregoing considerations, in implementing Articles 2 and 3 of Directive 68/151, which provide for official disclosure of the information entered in companies registers, the Member States are undoubtedly pursuing an objective of general interest recognised by the Union, as required by Article 52(1) of the Charter.
65. It remains to be determined whether such official disclosure goes beyond what is necessary to achieve that objective of general interest where it is not subject to any time limit or restricted to a determinate category of persons.
66. In that regard, I observe that it is apparent from the Court’s case-law that protection of the fundamental right to respect for private life at EU level requires derogations and limitations in relation to the protection of personal data to apply only in so far as is strictly necessary. (29)
67. While that is so, the Court has also stated that, in order to guarantee the protection of personal data, the national supervisory authorities must ensure a fair balance between, on the one hand, observance of the fundamental right to privacy and, on the other hand, the interests requiring free movement of personal data. (30) In this regard, it is essential not to lose sight of the fact that the objective pursued by Directive 95/46 is to maintain a balance between the free movement of personal data and the protection of private life. (31)
68. In my view, with regard to official disclosure of information relating to companies, the interests requiring free movement of personal data take precedence over the right of the individuals whose data appear in a companies register to demand, after a certain period has elapsed, that their data be erased or anonymised, or to request that their disclosure be limited to third parties demonstrating a legitimate interest.
69. It is appropriate to preserve the essential function of the companies register, which is to paint a complete picture of the life and history of a company and to provide anybody and everybody with access to the information making up that picture, wherever it may be and without any time limit.
70. Guaranteeing that essential function of the companies register is not, in my view, a disproportionate interference with the right to protection of personal data, for the reasons which follow.
71. First, the official disclosure required by Directive 68/151 relates to a limited number of details which concern, as recital 4 of that directive indicates, ‘the basic documents of the company … and other information concerning the company, especially particulars of the persons who are authorised to bind the company’. In particular, the personal data referred to in Article 2(1)(d) and (j) of that directive constitute the minimum information required to identify the individuals who are hidden behind the veil of corporate personality.
72. Secondly, I would emphasise that disclosure of the information entered on companies registers remains necessary for the protection of the interests of third parties, even when it relates to companies which ceased trading several years or indeed several decades previously.
73. In this regard, it seems to me to be beyond doubt that such information, including personal data, must be subject to the principle of disclosure of the register not simply for as long as a company is active on the market, but also after it has ceased trading. The fact that a company ceases to exist and is consequently removed from the register does not prevent rights and legal relations relating to that company from continuing to exist. It is, therefore, necessary for persons who may claim such rights against a company which has ceased trading, or who have entered into such legal relations with that company, to have access to information relating to it, including personal data relating to its directors.
74. As the German Government has pointed out, even data which is no longer current is important to trade. Thus, in the event of litigation, it is often necessary to know who was authorised to act on behalf of a company at a given time. (32) Similarly, I consider, as do the Czech and Polish Governments, that it is necessary to preserve the information in the register even after the dissolution of a company, since such information may still prove to be relevant, for example in verifying the legality of an instrument executed by the director of a company several years previously, or enabling third parties to bring an action against the members of the company’s organs or its liquidators.
75. Furthermore, third parties must be able to form, at any time, a reliable picture of the company, whether or not it is still active on the market, and of its directors, in order to assess the risks of a commercial relationship. The objective of protecting third parties, which requires it to be possible to obtain a reliable picture of the history of the company, thus militates in favour of storage and disclosure of the information entered in the companies register for an indeterminate period.
76. It is precisely one of the functions of the companies register to provide reliable and complete information to third parties concerning past events. Every register is thus made up of current data and historical data.
77. The register must guarantee complete, rapid and transparent access to all information relating to companies operating or formerly operating on the market, wherever the person seeking such access may be. Every person must have access to the full profile of every company, even those which ceased trading many years previously. To remove certain information from the register in respect of that category of companies, with the consequence that the picture of the company would no longer be complete, would thus undermine the protection of the interests of third parties.
78. Furthermore, unlike the statistical function, the historical function of the companies register and the objective of protecting third parties make it necessary to collect and store identifying data. In other words, the objective of establishing a complete picture of companies is incompatible with the processing of anonymous information. (33) Providing adequate information to third parties thus requires, for example, them to be able to link a company which has been in liquidation to the directors who controlled it. Accordingly, I do not share the view of the Tribunale di Lecce (Court of Lecce), which held that the historical memory of the existence of the company and the difficulties it experienced could to a great extent be just as well effected by means of anonymous data.
79. Concretely, in the present case Mr Manni’s interest in his former activity as a director of a company which had to cease trading due to insolvency no longer being brought to the attention of the public is opposed to the interest of third parties in being able to discover, even after the event, who was authorised to act on behalf of that company while it was still trading. Thus it may prove useful to a future purchaser of a property to know how long the company responsible for its construction had operated on the market, whether its director had headed other companies in the past, and what the history of those companies had been. In particular, the fact that one of the companies had become insolvent, from the point of view of the purchaser, might be a decisive factor in the purchase.
80. Furthermore, taking account of the disparity in the limitation periods for civil and commercial actions which are in force in the Member States, of the diversity of the interests which third parties may have in consulting companies registers, and of the fact that legal relations may involve parties in several Member States, it seems to me to be difficult, if not impossible, for the authorities responsible for keeping such registers to decide with any certainty that, at a given date, the interests of third parties are exhausted. Thus, in a given case, granting a request for erasure or anonymisation of personal data appearing in the register could compromise other requests for the communication of information which remain necessary for the protection of third party interests.
81. In a similar vein, in order to illustrate that third party interests continue to exist even after a company has been struck off the register, the Italian Government made reference to the very long limitation periods applicable to the liability of organs of capital companies, which in any event can be restarted in the course of legal proceedings, as well as the lack of any limitation period applicable to invalidity proceedings in Italy.
82. Finally, I observe that the Court has already acknowledged that the scope of Directive 95/46 is very wide and that the personal data it covers are varied. The length of time such data are to be stored, defined in Article 6(1)(e) of the directive according to the purposes for which the data were collected or for which they are further processed, can therefore differ. In certain cases, it may be very long. (34)
83. Thirdly, in striking the balance between the objective of protecting third parties and the right to protection of personal data entered in the companies register, account must be taken of the fact that data enabling individuals to be identified appear in the register because those individuals have chosen to carry out their activity through a company with legal personality. The Court has observed that ‘the seriousness of the breach of the right to protection of personal data manifests itself in different ways for, on the one hand, legal persons and, on the other, natural persons. It is necessary to point out in this regard that legal persons are already subject to a more onerous obligation in respect of the publication of data relating to them’. (35)
84. I share the opinion of the German Government that any person wishing to trade through the intermediary of a commercial company must be prepared to make certain information public. This is the quid pro quo for carrying out an activity in the form of a company with legal personality. The entrepreneur, when he enters the market by forming a commercial company, is aware that his data will be entered in the companies register, which is public in nature, and that they will be available regardless of the events punctuating the life of the company.
85. Article 2(1)(d) and (j) of Directive 68/151 provides for the entry in the companies register of particulars relating to the individuals occupying, during a given period, posts within one of the organs of the company, or occupying the role of liquidator of that company. While the publication of those particulars may be inconvenient for an individual because of difficulties possibly encountered by the company with which that individual was involved, such inconvenience is a normal feature of participation in commercial life.
86. I add, as the Italian Government pointed out, that the fact that a company has been subject to insolvency proceedings is not, in itself, a matter the disclosure of which is damaging to the reputation or honour of its director. The insolvency of a company may have been caused by external circumstances which are not directly due to poor management of the company, such as a recession or a fall in demand in the sector in question.
87. Fourthly, I do not think that the Commission’s proposed solution, which is to limit disclosure of the information entered in the companies register, after a certain period has elapsed from a commercial company ceasing to trade, to a restricted category of third parties, namely those demonstrating a legitimate interest in having that information which prevails over the fundamental rights of the person concerned under Articles 7 and 8 of the Charter, is, as EU law presently stands, such as to ensure a fair balance between the objective of protecting third parties and the right to protection of personal data entered in the companies register.
88. I observe in this regard that the objective of protecting third party interests pursued by Directive 68/151 is formulated in terms wide enough to cover not only the creditors of the company to which the information in question relates, but also, more generally, any person wishing to obtain information concerning that company.
89. The Court has already determined what falls within the category of the third parties or ‘others’ whose interests Directive 68/151 seeks to protect.
90. In its judgment of 4 December 1997, Daihatsu Deutschland (C‑97/96, EU:C:1997:581), the Court adopted a wide interpretation of the concept of third party. It observed that the very wording of Article 54(3)(g) of the EC treaty, which provides the legal basis for Directive 68/151, ‘refers to the need to protect the interests of “others” generally, without distinguishing or excluding any categories falling within the ambit of that term’. (36) In the view of the Court, ‘the term “others”, as contemplated in [that provision], cannot be limited merely to creditors of the company’. (37) The Court also held that ‘Article 3 of [Directive 68/151], which provides for the maintenance of a public register in which all documents and particulars to be disclosed must be entered, and pursuant to which copies of the annual accounts must be obtainable by any person upon application, confirms the concern to enable any interested persons to inform themselves of these matters’. (38)
91. In its Order of 23 September 2004 in Springer (C‑435/02 and C‑103/03, EU:C:2004:552), the Court gave an even clearer answer to the question of whether the category of third parties to be protected under Article 54(3)(g) of the Treaty was to be defined as including any person, regardless of status or capacity. Applying the reasoning adopted in its judgment of 4 December 1997, Daihatsu Deutschland (C‑97/96, EU:C:1997:581), the Court held that ‘the disclosure obligations laid down in Article 3 of the First Companies Directive … mean that any person may inspect the annual accounts and annual report of the types of partnerships that [Directive 90/605/EEC (39)] refers to, without having to establish a right or an interest requiring to be protected’. (40) The Court also confirmed that the term ‘others’, within the meaning of Article 54(3)(g) of the Treaty, ‘includes all third parties’ and that ‘that term must be interpreted broadly’. (41)
92. Furthermore, the solution proposed by the Commission has the major disadvantage of leaving it to the unfettered assessment of the authorities responsible for keeping companies registers not only to determine the time at which unrestricted disclosure of the information appearing in those registers transforms into selective disclosure, limited to a restricted category of persons demonstrating a legitimate interest in obtaining disclosure of such information, but also to decide whether or not such a legitimate interest exists. Such a solution thus presents a major risk of divergence in the assessments made by authorities responsible for keeping companies registers.
93. Consequently, to permit the authorities responsible for keeping companies registers to make disclosure of personal data appearing in such registers subject to the existence of a legitimate interest would inevitably disrupt equality of access to such data as between traders within the European Union.
94. Indisputably, the coordination measures provided for by Directive 68/151 are not intended to govern all matters relating to the companies registers of the Member States. For example, establishing the search criteria which can be used to gain access to the information appearing in such registers falls within the discretion of the Member States. (42) While that is so, it is clearly apparent from Article 2(1) of Directive 68/151 that the aim of that directive is to lay down a minimum bundle of company information which is required to be disclosed. It would serve no purpose to provide for such a uniform bundle for all Member States if each of them could adjust it with regard to time and according to the presence or absence of a legitimate interest in obtaining access to the information appearing in their companies register. That would also work against the objective of coordinating national legislation, which consists, in respect of directives based on Article 54 of the Treaty, in removing impediments to freedom of establishment which arise from legislative differences between the various Member States, by establishing within the European Union, with particular regard to the objective provided for by Article 54(3)(g) of the Treaty, equivalent minimum legal requirements as regards the extent of company information which must be made available to the public. (43)
95. Furthermore, it must be noted that Directive 95/46 is intended, as appears in particular from recital 8 thereof, to ensure that the level of protection of the rights and freedoms of individuals with regard to the processing of personal data is equivalent in all Member States.
96. In addition, I share the opinion of the German Government that making access to the companies register subject to a requirement to demonstrate a legitimate interest, even, as the Commission proposes, after a certain period, would compromise the operation of the companies register. Verifying the existence of such a legitimate interest on the part of the applicant would involve a disproportionate administrative burden, in terms of time and cost, which would ultimately call into question the capacity of the register to fulfil its functions.
97. Furthermore, if all those involved, in one capacity or another, in commercial relations were subject to the risk of being unable to demonstrate their interest in obtaining information appearing in the companies register, the effect would be to lessen their confidence in the register.
98. In sum, I consider that public registers such as companies registers can attain their essential objective, which is to reinforce legal certainty through transparent disclosure of legally reliable information, only if access to them is open to all and is available indefinitely.
99. The Court has recognised that the fair balance between the fundamental rights protected by EU law and the general interest objectives recognised by the European Union may depend on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life. (44)
100. The choice made by natural persons to engage in economic life through the medium of a commercial company has the corollary of a permanent requirement of transparency. For that principal reason, which manifests itself in its various aspects in the reasoning above, I consider that the interference with the law regarding the protection of personal data appearing in companies registers which consists in ensuring disclosure of such data for an unlimited period, and to any person requesting access to that information, is justified by the preponderant interest of third parties in having access to the information in question. (45)
101. Finally, I observe that the foregoing analysis is in step with Article 17(3)(b) and (d) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation). (46) Under that provision, the right to erasure of personal data or ‘right to be forgotten’ does not apply where the processing is necessary ‘for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’, or ‘for archiving purposes in the public interest’.
IV – Conclusion
102. Having regard to the foregoing considerations, I propose that the Court should respond to the Corte suprema di cassazione (Court of Cassation) as follows:
Article 2(1)(d) and (j) and Article 3 of First Council Directive 68/151/EEC of 9 March 1968 on coordination of safeguards which, for the protection of the interests of members and others, are required by Member States of companies within the meaning of the second paragraph of Article 58 of the Treaty, with a view to making such safeguards equivalent throughout the Community, as amended by Directive 2003/58/EC of the European Parliament and of the Council of 15 July 2003, and Article 6(1)(e) and Article 7(c), (e) and (f) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, read in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, must be interpreted as precluding personal data entered in the companies register from being, after a certain period has elapsed and at the request of the person concerned, removed, anonymised or blocked, or made accessible only to a restricted category of third parties, namely those demonstrating a legitimate interest in having access to such data.