Mr. Manni was the sole director of Italiana Costruzioni Srl, an Italian building company which was awarded a contract for the construction of a tourist complex.

In 2007, he brought proceedings before the Lecce Court (Italy) against the Lecce Chamber of Commerce, claiming that the complex buildings were not selling. This was due to the fact that it appeared from the companies register that he had been, in the past, the sole director and liquidator of another company, Immobiliare e Finanziaria Salentina Srl, which had been declared insolvent in 1992 and struck off the companies register, following liquidation proceedings, on 7 July 2005.

By judgment of 11 August 2011, the Lecce Court ordered the Lecce Chamber of Commerce to anonymise the data linking Mr. Manni to the liquidation of the first company and to pay compensation for damages suffered by him.

The Lecce Chamber of Commerce appealed the decision before the Italian Corte suprema di cassazione (Court of Cassation), which decided to stay the proceedings and refer several questions to the European Court of Justice (“ECJ”), asking, in substance, if the provisions of Directive 68/151 (the first Company Law Directive) and Directive 95/46 ( the EU Data Protection Directive which will be repealed by the EU GDPR as of 25 May 2018)  must be interpreted as meaning that it is mandatory, or, on the contrary, that it is prohibited, for personal data appearing in the register of companies, after a certain period has elapsed and upon the request of the person concerned, to be removed, anonymised or blocked, or made accessible only to a restricted category of third parties, namely those who can demonstrate a legitimate interest in having access to such data.

First of all, ECJ reminded that for a public authority to maintain a companies register was considered “processing data” and that said authority was to be considered the “controller” under the EU Data Protection Directive.

The ECJ then noted that such processing was legitimate as it was satisfying several grounds for legitimation as foreseen in the EU Data Protection.

Finally, the ECJ analysed whether the authority responsible for keeping the register should, after a certain period has elapsed since a company ceased to trade, and on the request of the data subject, either erase or anonymise that personal data, or limit their disclosure.

The ECJ noted that the purpose of the disclosure of information contained in an official company register public is to protect the interests of third parties in relation to joint stock companies and limited liability companies, since the only safeguards these companies offer to third parties are their assets. The ECJ also reminded that the purpose of the First Company Directive was to provide legal certainty in relation to dealings between companies and third parties.

The ECJ also found that, even after the dissolution of a company, the rights and legal relations relating to this company continue to exist. In the event of a dispute, this data may be necessary to assess the legality of an act carried out on behalf of that company during the period of its activity or so that third parties can bring an action against the members of the organs or against the liquidators of that company.

In those circumstances, the ECJ said, Member States cannot guarantee that people whose data is included in the company register have the right to have their personal data erased after a certain period of time has passed.

In this case, the ECJ considered that the mere fact that, the properties of the tourist complex built by Mr. Manni’s company do not sell because of the fact that potential purchasers of those properties have access to that data in the company register, cannot be regarded as constituting as a sufficient legitimate interest to limit third parties’ access to data concerning Mr. Manni.

Nevertheless, the ECJ did not completely exclude the possibility that, in specific situations, overriding and legitimate reasons relating to the specific case of the person concerned may justify, exceptionally, that access to personal data concerning him/her should be limited.

National Courts, facing a similar case in the future, will need to assess, having regard to all the relevant circumstances and taking into account the time elapsed since the dissolution of the company concerned, the possible existence of legitimate and overriding reasons which, as the case may be, exceptionally justify limiting third parties’ access to the data.