The Bottom Line
- Due Diligence at Risk: A ruling in favor of data erasure could significantly complicate background checks and due diligence on potential business partners, making it harder to assess a director’s history.
- A New GDPR Frontier: This case will define the reach of the “right to be forgotten” into official public records, potentially setting a precedent that impacts transparency obligations across various sectors.
- Compliance Overhaul: Companies that scrape or rely on commercial register data for their own compliance, credit scoring, or risk management may need to fundamentally change their data retention policies.
The Details
The case before the Court of Justice of the European Union (CJEU) pits two fundamental principles against each other: an individual’s right to privacy under the GDPR and the public’s need for corporate transparency. The dispute originated in Germany, where a former managing director of a company demanded that her personal data be removed from the publicly accessible electronic commercial register. She argued that since she was no longer involved with the company, there was no legal basis to continue processing her data, invoking her “right to be forgotten” under Article 17 of the GDPR.
The core legal question is whether the powerful data erasure rights granted by the GDPR can override the legal obligations set by the EU’s Company Law Directives. These directives mandate the public disclosure of such information to ensure legal certainty and protect third parties—like creditors, investors, and business partners—who rely on the register to make informed decisions. The German court, uncertain how to balance these competing EU laws, has asked the CJEU to clarify whether a director’s right to privacy eventually outweighs the public’s interest in a permanent, transparent corporate record.
While not the final verdict, the Advocate General’s upcoming opinion serves as a crucial recommendation that heavily influences the Court’s ultimate judgment. The opinion will signal the likely direction of EU law on a critical issue: Is there a time limit on corporate transparency? The final ruling will have profound implications, establishing whether personal data in official registers must be retained indefinitely or if it should be anonymized or deleted after a certain period. Businesses across the EU are watching closely, as the outcome will reshape the landscape of corporate transparency and data privacy.
Source
Court of Justice of the European Union
