In a ruling made on Thursday 9 March, the Court of Justice of the EU concluded that EU member states cannot guarantee natural persons, after a certain period after dissolution of the company concerned, the right to be forgotten in respect of personal data contained in the company in question’s register.
The Court therefore highlighted two directives related to this case (C-398/15), the first focuses on the processing of personal data (directive 95/46) and the second on guarantees demanded from the companies (directive 68/151). These two directives do not allow natural persons whose data has been included in the register of a company, to benefit from the right to forget. The reason for this is that to guarantee legal security, it is necessary to guarantee access to such data because questions can arise again many years after a company has ceased to exist.
The Advocate General reached the same conclusion in September 2016 (see EUROPE 11620) except for one detail: the Court does not exclude the possibility that, in specific situations, access to personal data should be limited, upon expiry of a sufficiently long period after the dissolution of the company in question, to third parties who can demonstrate a specific interest in consulting that data. It is for each Member State to decide if it wants such a limitation of access in its national legal system. Such limitation of access to personal data must be based on a case-by-case assessment
In the present case, the Court considers that such a limitation is not justified. The mere fact that the properties of a complex are not selling because potential purchasers have access to the data of the administrator who had them built – and who therefore can see that this was also the administrator of another company that went bankrupt – is not sufficient reason. (Original version in French by Jan Kordys)