Italy, Court of Cassation, 17 July 2015 15096/2015

Identification of the case

• Articles 11, 18, 19 legislative decree 196/2003

• CFREU7, CFREU8, Article 3 of the First Council Directive 68/151/EEC of 9 March 1968, Article 6(1)(e) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995

Summary of the case

The claimant had been the administrator of a company, which went bankrupt in 1992. The insolvency procedure ended in 1995. The company was struck off the companies register in 2005.

Meanwhile the claimant had become the sole director of another company, which was concerned with real estate and built up new houses in a resort.

The companies register, managed by the local chamber of commerce, industry, craft trades and agriculture, kept on publishing his name and surname as the cancelled company’s former administrator. The chamber of commerce, industry, craft trades and agriculture denied his request for data erasure.

The claimant alleged that the persistence of his name in the business register caused many people not to buy many of the houses, which had been built by the new company that was administrated by him.

• Civil judicial enforcement

Compensation for the violation of the individual’s rights by the judiciary

Order to erase, anonymise or block the data

1. Must the principle of keeping personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed, laid down in Article 6(1)(e) of Directive 95/46, transposed by Legislative Decree No 196 of 30 June 2003, take precedence over and, therefore, preclude the system of disclosure established by means of the companies register provided for by Directive 68/151 and by national law in Article 2188 of the Civil Code and Article 8 of Law No 580 of 29 December 1993, in so far as it is a requirement of that system that anyone may, at any time, obtain the data relating to individuals in those registers?
2. Consequently, is it permissible under Article 3 of Directive 68/151, by way of derogation from the principles that there should be no time limit and that anyone may consult the data published in the companies register, for the data no longer to be subject to “disclosure”, in both those regards, but to be available for only a limited period and only to certain recipients, on the basis of a case-by-case assessment by the data manager?

The Italian office of the companies register is established by law no 580/1993 in every Chamber of commerce, industry, craft trade and agriculture. Therefore any chamber of commerce has the so called passive legitimacy in any claim filed by a data subject in relation to the processing of data that is collected in said companies register.

Decisions by the judge who is in charge of the maintenance of the companies register do not constitute res iudicata. Therefore no res iudicata issue bars the examination of the merits.

The issue is whether the right to personal data protection obliges the controller, at the data subject’s request, to erase data or anonymize them, or otherwise prevent them from public discovery, not only in the explicit legal hypotheses, but also whenever the data subject invokes an interest to avoid publicity after a certain span of time has elapsed. Specifically, such span of time would be as long as needed to protect the legal aim wherefore the data had been collected, pursuant to its legal regulation.

As EU law currently stands, it is for the Member States to determine whether the data subjects may apply to the controller of the companies register to determine, on the basis of a case-by-case assessment, if it is exceptionally justified, on compelling legitimate grounds relating to their particular situation, to limit, on the expiry of a sufficiently long period after the dissolution of the company concerned, access to personal data relating to them, entered in that register, to third parties who can demonstrate a specific interest in consulting that data.

No such national legal provision exists in Italy. Data written in the companies register is meant to be perpetual, even as far as administrators and liquidators are concerned. The publicity of such data is necessary to adequately protect legal certainty in both economic and social relationships, through a complete and transparent information system throughout the national territory.

The persistence of the data of the administrator of the cancelled company is thus:

• Legal, as compliant with the national relevant law
• Compliant with its legal aim of certainty
• Reasonable, as it imposes a restriction on the personal data protection individuals’ rights, which is proportional to the protection of the economic order and the prevention of crimes.

The collection and maintenance in the companies register of data, relating to the quality of administrator and liquidator, is therefore legal and legitimate. Such legitimacy is not infringed by the bankruptcy, nor by the cancellation of the company from said register. Commercial publicity prevails on the individual’s interest, for the sake of the certainty in economic relationships, which is ensured by the companies register.

Role of the Charter and role of the general principles on enforcement

The CFREU was deemed applicable, because the issue was concerned with the scope of personal data protection and its exceptions.

• Right of every person to be heard, before any individual measure which would affect him or her adversely is taken
• Right to a fair trial
• Right to a public hearing within a reasonable time
• Right to a fair hearing by an independent and impartial tribunal previously established by law.

Article 2188 civil code states the principle of publicity of the national companies register.

Pursuant to art. 8 legge 580/1993, the office of the companies register has its seat in every chamber of commerce, industry, craft trade and agriculture.

Article 2191 civil code sets the rule by which the data collected in the companies register can be erased only if the data has been collected without the legal conditions. No cancellation is provided for the mere existence of a time distance.

The decree of the President of the Republic 581/1995 regulates the procedure leading to the judicial order to process or to erase data contained in the companies register.

1. The main procedural issue was whether the follow-up judgement held after the ECJ preliminary ruling was to include a public hearing.

The General Attorney alleged so, stressing the fact that a new issue was involved.

The Court denied the procedural need for a public hearing. The new civil procedure of the cassation judgement is so shaped, as to avoid as much as possible the public hearing (art. 375 §2 cpc). The right to illustrate the claimant’s and the defendant’s case is duly protected by the possibility for the parties to deposit written statements until ten day before the date of the council chamber decision (art. 380-bis.1 cpc).

2. Reference was made to Art. 8 ECHR. Limits to the right to privacy can be set by Member States, as far as they are required in a democratic society “in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”.

• Effectiveness
• Proportionality

The absence of an explicit legal provision did not prevent the Italian Court of cassation from asking for a preliminary ruling, about the relationship between the EU directives concerning the companies register and the protection of personal data.

Proportionality was the criterion by which the conflict between the right to privacy, invoked by the claimant about his past quality of administrator of a bankrupt company, and the right to public access to data was solved. The Court deemed that the need for certainty in business and social relationships made it fair to ensure the public access to data pertaining the aforesaid quality.

Elements of judicial dialogue

• Direct dialogue between CJEU and National court (preliminary reference)
• Dialogue between high court - lower instance court at national level

• C-131-12, Google Spain

• 25551/2005, Korolev v Russia

Preliminary reference

Proportionality

To prevent a possible conflict of interpretation between two different EU directives.

Fair solution of the issue at stake.