In amongst the unsolicited love letters, the pictures of rudely shaped vegetables and simple abuse from those who believe a section 14 FOIA response is a deliberate conspiracy against them, the Panopticon postbag occasionally receives a polite enquiry about why we have not passed comment upon some fascinating information law development. Such a point might be made about Case C-398/15 Camera di Commercio v Manni (ECLI:EU:C:2017:197), in which the CJEU addressed, for only the second time, the ‘right to be forgotten’. Of course, in this case, we have analysed it at great length, but all well-known search engines have delisted it so thoroughly that everyone has forgotten where to find it. So here, like a vexatious requestor or a particularly unpleasant kebab, we are again.Signore Manni had been the sole director of an Italian company called Immobiliare e Finanziara Salentina Srl when it was declared insolvent in 1992, and subsequently removed from the Italian company register in 2005. However, Mr Manni’s involvement with that company remained accessible through the companies register. He said it was being processed by risk assessment companies who do searches of the register, and that was harming the performance of his new construction company busy building Italian dreams in Lecce. He sought erasure of his personal data from the records relating to Immobiliare.

The issue for the CJEU was how to approach the right to erasure (as it will be properly so-called under the GDPR) in the context of companies registers which are themselves required under separate provisions of EU law: Directive 68/151, article 2(1)(d) of which requires compulsory disclosure by companies of at least the appointment, termination of office and particulars of persons who represent the company (i.e. its directors) and article 3 of which requires the transcription of that information in some form of companies register. (Amendments to Directive 68/151 had made clear that Directive 95/46 applied to it.)

The CJEU confirmed, at [42]-[43], that processing of personal data by including it in such a register was compatible with articles 7(c), (e) and (f) of the DP Directive; what we might think of as conditions 3, 5(d) and 6(1) of Schedule 2. But does the fifth data protection principle – processing for no longer than necessary – require erasure of director information on the request of the data subject, after a certain period since a company has ceased to trade, whether through the right to object under article 14 or the right of erasure in article 12: at [44]-[47]?

The Court framed the purpose of the company law Directive in an important way. It said that it sought to protect the interests of third parties, so that they could ascertain who was authorised to bind the company, but without that third party having to show any particular right or interest in order to discover the information. It also held that there was a legal certainty purpose, for much the same reason in the context of inter-State trade. Even after corporate dissolution, rights and obligations relating to it may continue to exist, and the period for which they apply will depend upon the limitation periods provided in national law.

Those national differences, thought the Court, meant that it was not possible to identify one single time limit after the dissolution of a company after which personal data should be erased: at [55]. (Or at least, we think that is what “the considerable heterogeneity in the limitation periods provided for by the various national laws in the various areas of law” means.) Nothing in data protection law required one to be imposed, and failing to do so was not a disproportionate interference with the rights of the data subject: at [57]. The CJEU explained that this was so because the personal data involved was relatively limited, really just to identity and that natural persons who choose to participate in trade through a company take that risk with their eyes open: at [58]-[59]. But, warned the Court, there may be specific situations in which the overriding concerns of the data subject justify exceptional limitation of access to data on the companies register, following expiry of a sufficiently long time, and that was for national legislation and courts to establish: at [60].

What about the fact that Mr Manni’s new company was not able to sell as many properties because of the fact people could find his involvement in a previous failed company? Tough, said the CJEU, who do a very good impression of a group of people who had up until recently been heavy investors in BHS. Purchasers of Mr Manni’s new properties had a legitimate interest in knowing the information: at [63].

What then are the core take-away points from Manni? Probably these:

• The right to be forgotten is not some sort of magic eraser which will work for everyone in all situations. The right can be outweighed.
• The right to be forgotten does not only apply to Google. This ought to be obvious, but it is easily, and very often, forgotten. Any data controller anywhere can face an erasure request. It might be an archive, it might be a database, it might be an indexing resource, it might – as here – be a significant public resource.
• Considering the right requires a balancing exercise “of all the circumstances surrounding the data subject’s particular situation“: at [47]. That is important, because there has sometimes been a temptation to read Google Spain as approving only a very narrow category of factors which might weigh against the request; see particular the reference at [97] of Google Spain to “such as the role played by the data subject in public life“.
• Clearly data held and processed in accordance with a legislative scheme (particularly if it happens to be a scheme derived from EU law) will be more likely to find favour as engaging important counter-interests.
• If the processing comes about because of a deliberate choice on the part of the data subject, in the context of a clear legislative scheme, then there will be less room to complain later.
• Prejudice in the form of reputational damage and even impact on business dealings may not be sufficient to tip the balance.
• Never say never. The CJEU was not prepared – not unfairly – to rule out circumstances where there would come a cut-off point even in for company registers.

An interesting judgment which may mark a little pendulum swing away from Google Spain (oh yes, the right to be forgotten is very important, but we didn’t mean it in this sort of case). A more context-sensitive approach to the balancing exercise is very welcome although, as ever, the greater the emphasis on the balance the harder it is to predict where the scales will fall in every given case. But, for the moment, if you are considering Google Spain, don’t forget to read it with Manni.

Christopher Knight