DATA PROTECTION
EU Court of Justice: conditions for exercising the right to delete personal data from the Business Register held by a Member State and for claiming compensation for non-material damage in the event of a refusal.
The Court of Justice of the European Union (CJEU) published its judgment in Case C‑200/23, concerning the Agentsia po vpisvaniyata's (the Registry Entries Agency of Bulgaria) refusal to delete certain personal data concerning an individual contained in a partnership agreement published in the commercial register under the General Data Protection Regulation (GDPR).
The CJEU outlined that the individual was a partner of a limited liability company under Bulgarian law. On July 8, 2021, the individual asked the Agency to delete the personal data concerning them contained in the said partnership agreement, specifying that they wanted to withdraw consent. In the absence of a response from the Agency, the individual brought the matter before the Administrative Court of Dobrich which annulled the Agency's implied refusal to delete the data and referred the case back to the Agency for a new decision. The Agency indicated, by a letter, a certified copy of the relevant partnership agreement concealing the individual's personal data, with the exception of that required by law. The individual again brought an action before the Administrative Court seeking the annulment of the letter and an order against the Agency to compensate it for the non-pecuniary damage of the letter, which infringed the rights conferred by the GDPR. The Administrative Court annulled the letter and ordered the Agency to compensate the individual for non-pecuniary damage, pursuant to Article 82 of the GDPR. The Agency appealed to the Supreme Administrative Court which subsequently referred the case to the CJEU.
The CJEU found, among other things, that Directive 2017/1132 must be interpreted as meaning that it does not impose on a Member State an obligation to authorize the publication, in the commercial register, of a partnership contract subject to the mandatory publication provided for by the Directive and containing personal data other than the minimum personal data required, the publication of which is not required by the law of that Member State.
Additionally, the CJEU found that Articles 4(7) and 4(9) of the GDPR must be interpreted as meaning that the authority keeping the commercial register of a Member State which publishes, in that register, the personal data contained in a partnership contract subject to the mandatory publication provided for by the Directive, which was sent to it in the context of an application for registration by the company, is both the recipient of the data and, in particular in so far as it makes them available to the public, the controller of that data, even where that contract contains personal data not required by the Directive or by the law of that Member State.
Moreover, the CJEU held that Article 82(1) of the GDPR must be interpreted as meaning a loss of control for a limited period by the data subject over their personal data due to the making available to the public of such data online in the commercial register of a Member State which may be sufficient to cause 'non-material damage,' provided that that person demonstrates that they actually suffered such damage, however minimal, without that concept of 'non-material damage' requiring the demonstration of the existence of additional tangible negative consequences.
The CJEU outlined that the individual was a partner of a limited liability company under Bulgarian law. On July 8, 2021, the individual asked the Agency to delete the personal data concerning them contained in the said partnership agreement, specifying that they wanted to withdraw consent. In the absence of a response from the Agency, the individual brought the matter before the Administrative Court of Dobrich which annulled the Agency's implied refusal to delete the data and referred the case back to the Agency for a new decision. The Agency indicated, by a letter, a certified copy of the relevant partnership agreement concealing the individual's personal data, with the exception of that required by law. The individual again brought an action before the Administrative Court seeking the annulment of the letter and an order against the Agency to compensate it for the non-pecuniary damage of the letter, which infringed the rights conferred by the GDPR. The Administrative Court annulled the letter and ordered the Agency to compensate the individual for non-pecuniary damage, pursuant to Article 82 of the GDPR. The Agency appealed to the Supreme Administrative Court which subsequently referred the case to the CJEU.
The CJEU found, among other things, that Directive 2017/1132 must be interpreted as meaning that it does not impose on a Member State an obligation to authorize the publication, in the commercial register, of a partnership contract subject to the mandatory publication provided for by the Directive and containing personal data other than the minimum personal data required, the publication of which is not required by the law of that Member State.
Additionally, the CJEU found that Articles 4(7) and 4(9) of the GDPR must be interpreted as meaning that the authority keeping the commercial register of a Member State which publishes, in that register, the personal data contained in a partnership contract subject to the mandatory publication provided for by the Directive, which was sent to it in the context of an application for registration by the company, is both the recipient of the data and, in particular in so far as it makes them available to the public, the controller of that data, even where that contract contains personal data not required by the Directive or by the law of that Member State.
Moreover, the CJEU held that Article 82(1) of the GDPR must be interpreted as meaning a loss of control for a limited period by the data subject over their personal data due to the making available to the public of such data online in the commercial register of a Member State which may be sufficient to cause 'non-material damage,' provided that that person demonstrates that they actually suffered such damage, however minimal, without that concept of 'non-material damage' requiring the demonstration of the existence of additional tangible negative consequences.
