62023CJ0200_RES
Case C‑200/23
Agentsia po vpisvaniyata
v
OL
(Request for a preliminary ruling from the Varhoven administrativen sad)
Judgment of the Court (First Chamber) of 4 October 2024
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Publication in the commercial register of a company’s constitutive instrument containing personal data – Directive (EU) 2017/1132 – Non-compulsory personal data – Lack of consent of the data subject – Right to erasure – Non-material damage)
Freedom of establishment – Companies – Directive 2017/1132 – Obligation of a Member State to permit the disclosure, in the commercial register, of a company’s constitutive instrument containing personal data – Publication of the data not required by national law – No obligation
(European Parliament and Council Directive 2017/1132, Art. 21(2))
(see paragraphs 54, 55, 60, operative part 1)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Concept of controller – Concept of recipient of the data – Authority responsible for the commercial register of a Member State disclosing personal data contained in a company’s constitutive instrument – Included – Contract containing personal data not required either by Directive 2017/1132 or by national law – Irrelevant
(European Parliament and Council Regulation 2016/679, Art. 4(7) and (9); European Parliament and Council Directive 2017/1132)
(see paragraphs 66, 72-76, 83, operative part 2)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Conditions governing the lawfulness of the processing of personal data – Processing necessary for compliance with a legal obligation incumbent on the controller – Publication of personal data contained in a company’s constitutive instrument – Personal data not required either by Directive 2017/1132 or by national law – Not included – Disclosure classified as processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority – Conditions – Necessity of the processing
(European Parliament and Council Regulation 2016/679, Art. 6(1), first subpara., points (c) and (e); European Parliament and Council Directive 2017/1132)
(see paragraphs 94-96, 105-112, 114-116)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to erasure – Scope – Unlawful processing of personal data – Included – Lawful processing of personal data – Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority – Not included – Exception – Existence of compelling legitimate grounds for the processing overriding the interests, rights and freedoms of the data subject – Burden of proof lying with the controller
(European Parliament and Council Regulation 2016/679, Arts 6(1), point (e), 17(1), points (c) and (d), and 21(1))
(see paragraphs 118-120)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to erasure – Obligation of a national authority responsible for the commercial register of a Member State to refuse any request for erasure of non-redacted data – Personal data not required either by Directive 2017/1132 or by national law – Not permissible
(European Parliament and Council Regulation 2016/679, Art. 17; European Parliament and Council Directive 2017/1132, Art. 16)
(see paragraph 127, operative part 3)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Concept of personal data – Handwritten signature of a natural person – Included
(European Parliament and Council Regulation 2016/679, Art. 4(1))
(see paragraphs 131, 133-136, operative part 4)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to compensation and liability – Right to compensation for the damage suffered – Non-material damage – Concept – Loss of control over personal data – Included – Conditions – Burden of proof for non-material damage borne by the data subject – Obligation to demonstrate the existence of additional tangible adverse consequences – None
(European Parliament and Council Regulation 2016/679, Art. 82(1))
(see paragraphs 140-146, 156, operative part 5)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to compensation and liability – Responsibility of the controller and obligation to pay compensation for the damage suffered by a data subject – Exemption – Scope – Issue, by a supervisory authority, of an advisory opinion on data protection issues provided to the controller – Non-application of the exemption from liability of a national authority which has the status of controller
(European Parliament and Council Regulation 2016/679, Arts 4(7), 58(3)(b) and 82(1) to (3))
(see paragraphs 171, 172, 174, 176, operative part 6)
Résumé
Following a reference for a preliminary ruling from the Varhoven administrativen sad (Supreme Administrative Court, Bulgaria), the Court of Justice rules on a series of questions concerning, in essence, the relationship between the provisions of EU law on disclosure of company documents (
1
) and the GDPR. (
2
)
OL is a member of ‘Praven Shtit Konsulting’ OOD, a limited liability company governed by Bulgarian law entered in the commercial register following the submission of a company’s constitutive instrument. That instrument, made public by the Agentsia po vpisvaniyata (Registration Agency, Bulgaria) (‘the Agency’) as submitted, contains several items of personal data of its members, including their surnames, forenames, identity card numbers, addresses and signatures.
In 2021, OL made a request to the Agency that it erase her personal data contained in that instrument. That agency’s refusal to grant that request was the subject of two actions brought by OL before the Administrativen sad Dobrich (Administrative Court, Dobrich, Bulgaria). By judgment of 5 May 2022, that court ordered the Agency to pay compensation to OL in respect of non-material damage, pursuant to the GDPR. (
3
) The Agency, which disagreed with that judgment, brought an appeal on a point of law before the referring court.
Uncertain as to the balancing exercise which must be carried out between the legislation on the right to protection of personal data and that guaranteeing disclosure and access to certain company documents, the national court referred questions to the Court for a preliminary ruling.
Findings of the Court
In the first place, as regards the scope of voluntary disclosure of information, including personal data contained in company documents, the Court notes that the provision of Directive 2017/1132 on the voluntary disclosure of company documents and information (
4
) concerns only their translations, without however referring to their content. Therefore, it cannot be interpreted as imposing any obligation relating to the disclosure of data which are not required to be disclosed either by other provisions of EU law or by the law of the Member State concerned, but which appear in a document subject to compulsory disclosure under that directive. (
5
) Accordingly, that provision does not impose on a Member State an obligation to permit the disclosure, in the commercial register, of a company’s constitutive instrument subject to compulsory disclosure under that directive and containing personal data, other than the minimum personal data required, disclosure of which is not prescribed by the law of that Member State.
In the second place, the Court notes that the authority responsible for maintaining the commercial register of a Member State which publishes therein the personal data contained in a company’s constitutive instrument, which is subject to compulsory disclosure under Directive 2017/1132 and transmitted in the context of an application for registration of the company in that register, is both a ‘recipient’ of those data and, particularly in so far as it makes them available to the public, a ‘controller’ of those data, (
6
) even where that instrument contains personal data not required by that directive or by the law of that Member State.
In that context, the Court observes that, under Directive 2017/1132, it is for the Member States to determine, inter alia, which categories of information concerning the identity of the persons linked to the companies, in particular, which kind of personal data, are to be subject to compulsory disclosure, in accordance with EU law.
The Court also notes that, by transcribing and storing personal data received in connection with an application for registration of a company in the commercial register of a Member State, disclosing those data, where appropriate, on request to third parties and publishing them in the national gazette, or by an equally effective means, the authority responsible for maintaining that register carries out processing of personal data for which it is the ‘controller’. Those kinds of processing of personal data are distinct from and subsequent to the disclosure of personal data carried out by the applicant for that registration and received by that authority. In addition, that authority carries them out alone, in accordance with the purposes and procedures laid down by Directive 2017/1132 and by the legislation of the Member State implementing that directive.
In the third place, as regards the right to erasure, which may be available to the subject data, the Court, (
7
) in the first instance, examines the grounds of lawfulness under which the processing of his or her personal data may fall.
First, as regards whether that processing is necessary for compliance with a legal obligation arising from EU law or Member State law to which the controller is subject, (
8
) the Court notes that Directive 2017/1132 does not require the systematic processing of all personal data contained in an act subject to compulsory disclosure under that directive. On the contrary, any processing of personal data carried out in the context of that directive must fully satisfy the requirements arising from the GDPR. Thus, it is for the Member States to ensure that the objectives of legal certainty and protection of the interests of third parties, pursued by Directive 2017/1132, are reconciled with the rights enshrined in the GDPR.
Therefore, it cannot be held that the making available to the public, online, in the commercial register, of personal data not required by Directive 2017/1132 or by the national legislation at issue in the main proceedings contained in a company’s constitutive instrument subject to compulsory disclosure under that directive and transmitted to the Agency, is justified by the requirement to ensure disclosure of the documents referred to in that directive and, that, therefore, that making available is the result of a legal obligation laid down by EU law. In addition, the lawfulness of the processing concerned does not appear to be based, subject to verification by the referring court, on a legal obligation laid down by national law.
Second, as regards the necessity of the processing concerned for the purposes of performing a task carried out in the public interest, (
9
) the Court observes that that processing does indeed appear to occur when such a task is performed. However, it appears to go beyond what is necessary in order to achieve the objectives of general interest pursued.
In that regard, the Court notes that the requirement to preserve the integrity and reliability of company documents – subject to compulsory disclosure under Directive 2017/1132 – which requires the publication of those documents in the form in which they were sent to the authorities responsible for maintaining the commercial register, cannot systematically prevail over the right to protection of personal data, if it is not to render that protection purely illusory. In particular, that requirement cannot impose that personal data not required by Directive 2017/1132 or by national law remain available to the public, online, in that register when the Agency could itself draw up a copy of the instrument of the company concerned – having redacted the data not required – provided for by that law, with a view to making it available.
In the second instance, the Court points out that, if the referring court were to conclude, following its assessment, that the processing in question is not lawful, it would be for the Agency, as controller, to erase the data concerned without undue delay.
However, if that court were to conclude that that processing is indeed necessary for the performance of a task carried out in the public interest, in particular in so far as the making available to the public, online, in the commercial register of data not required by Directive 2017/1132 or by national legislation was necessary in order to avoid delaying the registration of the company concerned, in the interest of the protection of third parties, it would be necessary to examine whether there were compelling legitimate grounds which may override the interests, rights and freedoms of the data subject and to refuse to grant the request for erasure. (
10
)
Thus, the Court observes that Directive 2017/1132 and the GDPR must be interpreted as precluding a Member State’s legislation or practice which leads the authority responsible for maintaining the commercial register of that Member State to refuse any request for erasure of personal data not required by that directive or by the law of that Member State, contained in a company’s constitutive instrument published in that register, where a copy of that instrument in which those data have been redacted has not been provided to that authority, contrary to the procedural rules laid down by that legislation.
Last, ruling on the liability regime under the GDPR and, more specifically, on the effect, in that context, of an opinion issued by the supervisory authority of a Member State, the Court points out that, under the GDPR, (
11
) the issuing of such an opinion falls within the scope of the advisory powers of the supervisory authority, and not within that of its authorisation powers. Moreover, the terms used indicate that that opinion is not, under EU law, legally binding. Thus, the opinion concerned cannot, in itself, demonstrate that that damage is not attributable to the controller and, therefore, is not sufficient to exempt it from liability under the GDPR. Consequently, such an opinion is not sufficient to exempt from liability the authority responsible for maintaining the commercial register of a Member State which has the status of controller.
(
1
)	Directive (EU) 2017/1132 of the European Parliament and of the Council of 14 June 2017 relating to certain aspects of company law (OJ 2017 L 169, p. 46).
(
2
)	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (‘the GDPR’).
(
3
)	Under Article 82 of the GDPR.
(
4
)	Article 21(2) of Directive 2017/1132.
(
5
)	Pursuant to Article 14 of Directive 2017/1132.
(
6
)	Within the meaning of Article 4(7) and Article 4(9) of the GDPR, respectively.
(
7
)	Under Article 17 of the GDPR.
(
8
)	Ground for lawfulness laid down in point (c) of the first subparagraph of Article 6(1) of the GDPR.
(
9
)	Ground for lawfulness laid down in point (e) of the first subparagraph of Article 6(1) of the GDPR.
(
10
)	Under Article 17(1)(c) of the GDPR, read in conjunction with Article 21(1) of the GDPR.
(
11
)	Article 58(3)(b) of the GDPR.