Data Protection and Company Registers

Some of you will be aware that Companies House is proposing to reduce the amount of time its records are retained from twenty years to six, citing various drivers including data protection concerns. This has caused a certain amount of consternation and pooh-pooing in the press, for understandable journalistic reasons. But on 8 September 2016, AG Bot handed down an Opinion in Case C-398/15, Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Mnni in which he appears to have given a certain grist to the Companies House mill by concluding that the data protection principle of retention of personal data for no longer than necessary must take precedence over and, therefore, preclude the system of disclosure through the registers provided for by Directive 68/151. That regime, under Italian law, appears to have allowed for unrestricted permanent access to the register. The AG appears to have endorsed a principle that disclosure should be managed on a case-by-case basis by the data controller; a view which if applied in the UK would pose colossal resource implications for an already stretched Companies House. Unfortunately, AG Bot’s Opinion is not currently available in English, so the nuances escape this parochial reader, but the eventual ruling of the CJEU will certainly be worth watching out for.

Christopher Knight