The personal data of the commercial company manager

January 18, 2022

Updated Nov 24, 2022

 

At the time of personal data protection (Directive 95/46/EC of the European Parliament and of the Council, of 24 October 1995, on the protection of individuals with regard to the processing of personal data and on the free movement of such data; REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (general regulation on data protection), the manager of a commercial company can legitimately consider it abnormal to see his personal data published and repeated in multiple parasitic directories.

See as well : The negative opinion

These parasitic directories "pump" the commercial register to attract web traffic and advertising revenue, under the pretext of providing more or less muddy services, such as the collection of opinions and ratings on companies, or referencing on the internet against hard cash.

When the manager's personal data is concerned, there is an invasion of the privacy of these persons.

Especially since the publication of the personal data of the leader is useless if not to stir up the unhealthy curiosity of people.

There are indeed many other ways to reach a leader in case of debt or abuse on his part.

However, the case law is reluctant to sanction the platforms, on the pretext of a certain conception of freedom of expression, or of an alleged need in the general interest to publish the personal data of the leader.

Thus, in a CJEU judgment, March 9, 2017, case n°C 398/15, the Court of Justice of the Union considers that the publication of personal data in the register meets a legal obligation and an interest in the protection and transparency of trade, and must therefore compromise, with some exceptions, the right to be forgotten recalled by the judgment Google Spain C-131/12 of May 13, 2014 which established the right not to be indefinitely filed and sued by Google in defiance of the objectives of social reintegration provided for by law.

The Court lays down the only limit that the processing of personal data does not exceed the "[duration] necessary for the achievement of the purposes for which they are collected or for which they are subsequently processed”.

The concept is very vague, especially since some personal data of the leader, in particular his personal address, are often obsolete and useless.

Certain national laws, including France, impose the publication of the personal address of the leader, and even though Union law only imposes the publication of the name and functions (Dir. 68/151/CEE , Article 3, which aims to allow all interested third parties to be informed, without them having to prove a right or an interest requiring protection (ECJ, n° C-97/96, Judgment of the Court, Verband deutscher Daihatsu-Händler eV v Daihatsu Deutschland GmbH, 4 December 1997).

Article 8 of the European Convention on Human Rights (hereinafter the “Convention” or the “ECHR”) prohibits state interference with privacy when it is not necessary for the prosecution of certain Goals, even if it is provided for by law, in these terms: 

“Right to respect for private and family life

• Everyone has the right to respect for his private and family life, his home and his correspondence.

• There may be interference by a public authority with the exercise of this right only insofar as such interference is prescribed by law and constitutes a measure which, in a democratic society, is necessary for national security, public safety, the economic well-being of the country, the preservation of order and the prevention of criminal offences, the protection of health or morals, or the protection of the rights and freedoms of others .”

There can be interference by “public authority” in the exercise of this right only under certain conditions.

According to the Convention, an interference by a public authority is only admissible if it fulfills two criteria: 

an organic criterion:

•  the interference must be “prescribed by law”; (but here the CJEU considers that it is any text of the public authorities, and not the only "Law")

a proportionality criterion according to well-defined objectives which are: 

• national security
• public safety
• the economic well-being of the country
• the defense of order 
• the prevention of criminal offenses
• the protection of health or morals
• the protection of the rights and freedoms of others

• The French practice of disclosure by the services of the trade and companies register of the personal address constitutes an “interference by public authority”;  

According to the European Court of Human Rights: 

A person's home address constitutes personal information relating to private life and which, as such, enjoys the protection afforded by Article 8 (Alkaya v. Turkey, § 30).

The services of the registry of the commercial and companies court have the practice of systematically collecting and communicating on request, in particular via a simple order of Kbis extract, the personal address of the manager.

The public and systematic disclosure of the manager's personal address obviously infringes his private life, since it designates a priori his place of family life, his "domicile" as mentioned in Article 8 (1) aforementioned.

This public and systematic disclosure is to be distinguished from the simple collection of the personal address, which in itself is justified by a need to preserve an indication of the location of the person of the manager which can be communicated on presentation of a legitimate reason.

It is commonly accepted that the personal address of a natural person is not necessary in itself for his identification, only his date and place of birth are usually considered necessary for this purpose.

On the other hand, the designation of the manager's personal address to the public necessarily infringes the privacy of the manager when the latter expresses his wish that his address not be disclosed, and whatever the motivation of the leader, the latter being in the best position to assess the impact of such disclosure on his private life, and secrecy being inherent in the notion of respect for private life.

There is therefore an invasion of private life, that is to say “interference by a public authority with the exercise of the right to respect for private and family life” to use the terms of the Convention.

The Court of Cassation ruled that:

"Disclosure of an agent's address by the Administration without his consent would constitute an invasion of privacy" (Cass. Civ. 1re, 6 November 1990, Bull. civ. I, no. 238).

National and European case law, which will be discussed below, confirms that the non-consensual disclosure of the personal address constitutes an invasion of privacy.

 

 

• This interference is unconventional because it is not "necessary", in the sense that neither the national or Community rules, nor the parliamentary proceedings, indicate in what way the disclosure of the leader's personal address is "necessary" for the pursuit of an objective set in 2° of 8 of the European Convention on Human Rights, which therefore suggests that this interference does not pursue any of the objectives set by 2° of 8° of the ECHR and is totally disproportionate ;  

 

French case law and decisions or opinions of administrative authorities

The non-disclosure to the public of the personal address does not otherwise affect the right of a third party to be provided with the personal address of the manager upon presentation of a legitimate reason, provided for by the Béteille law.

The judgment of the Court of Cassation rendered on March 19, 1991:

"if any person is entitled, in particular to escape indiscretion or malice, to refuse to reveal the place of his domicile or residence, so that in principle his will must be respected on this point by third parties , it is different when this concealment is dictated to him by the sole illegitimate intention of evading the performance of his obligations and defeating the rights of his creditors; that it is up to the judge in chambers to put an end to such a fraudulent maneuver, as soon as it is manifest” (Cass. Civ. 1ère, March 19, 1991, appeal no. 89-19.960) 

Today, law n° 2010-1609 of December 22, 2010 known as the Béteille law goes further by widening the access to information of the judicial officer in charge of enforcement and holder of an enforceable title, by allowing him to obtain information directly from the third parties who hold it without going through the President of the Court.

Thus, the administrations of the State, the regions, the departments and the municipalities, the companies conceded or controlled by the State, the regions, the departments and the municipalities, the public establishments or organizations controlled by the administrative authority must communicate to the bailiff in charge of enforcement, holder of an enforceable title, the information they hold allowing the debtor's address to be determined, the identity and address of his employer or any third-party debtor or custodian of liquid or payable sums and the composition of its real estate assets, to the exclusion of any other information, without being able to oppose professional secrecy. (Article L 152-1 of the Code of Civil Enforcement Procedures).

However, this information is strictly limited to the legal framework. They may only be used to the extent necessary for the performance of the title(s) for which they were requested. It is in particular forbidden for the judicial officer to communicate them to a third party (Cass. Civ. 1ère, March 22, 2012, n° 10-25811) or to combine them in a personal file. 

“The address belongs to privacy. When the interest in knowing the address without the consent or even against the opposition of the person is of less value than the protection of privacy, the latter prevails. (CA Toulouse, ch. soc. 4, sect. 1, September 25, 2015, n° 13/01895: JurisData n° 2015-021972)

“Thus in the present case, after recalling that the personal address is information which is a matter of private life (see also e.g. Cass. 1st civ., March 19, 1991, n° 89-19.960: JurisData n° 1991-000768 – Cass. 1st civ., June 30, 1992, No. 90-18.458: JurisData No. 1992-001674; Bull. civ. 1992, I, No. 213), the Court of Appeal investigated whether a interest here superior to the right to respect for the employee's private life justified revealing her address without her consent. “

The CADA believes that the merchant's home address should be concealed: 

“The commission for access to administrative documents examined in its meeting of February 7, 2013 your request for advice relating to the communicable nature of a list of traders from an external market, showing the type of trade and their seniority.

The commission recalls, as a preliminary point, that if the name of a merchant, necessarily registered in the trade and companies register, is information the disclosure of which is not contrary to the provisions of II of article 6 of the law of July 17, 1978 relating to statements covered by the secrecy of private life, is however prohibited, by these provisions, the disclosure of documents revealing the working hours and the dates of holidays of merchants as well as any statement relating, for example, to the seller's address, date of birth or identity card number.

It also considers that are covered by the commercial and industrial secrecy protected by II of article 6 of the 1978 law, the documents which would

display any data relating to the commercial strategy of the businesses concerned, such as, for example, the dates and times of opening of the stalls.

The commission considers, in application of these principles, that the list of merchants on the external market of the municipality, which shows the type of products sold and the seniority of the businesses, is communicable, subject to the prior concealment of the address traders, as well as the indication of their days of presence on the market, which are likely to infringe the protection of the privacy of the interested parties or commercial and industrial secrecy.

European Union law

Directive (EU) 2017/1132 of the European Parliament and of the Council of June 14, 2017 relating to certain aspects of company law, taking over from Council Directive 68/151/EEC of March 9, 1968, aimed at coordinating, to make them equivalent, the guarantees which are required, in the Member States, of companies within the meaning of the second paragraph of Article 58 of the Treaty, in order to protect the interests both of the members and of third parties, require that the directors be "identified" but never mentions their home address.

In case C-398/15 of 9 March 2017, the Court, without evading the ability of Member States to provide for the provisions they wish with regard to the collection of personal data by commercial registers, specifies that only the collection of the identity of the directors is required: 

32 In that regard, it should first be noted that, under Article 2(1)(d) of Directive 68/151, Member States must take the necessary measures to ensure that advertising mandatory relating to companies relates at least to the appointment, the termination of functions as well as the identity of the persons who, as a legally provided for body or members of such a body, have the power to commit the company concerned with regard to third parties and to represent it in court or participate in the administration, supervision or control of this company. In addition, according to the same Article 2(1)(j), the appointment and identity of the liquidators as well as, in principle, their respective powers must also be made public..”

Latvia no longer requires the ruler's home address (Ruķers M., Kā izpaužas tiesības uz personas datu aizsardzību publiski pieejamā reģistrā. Jurista Vārds, 26.jūnijs 2012/NR.26(725). 

Same in Dutch law, 

Section 16 of the Commercial Register Act 1996 provides for the possibility of restricting the publication of certain personal data for privacy purposes. In this regard, Article 32 of the 1996 Order on the Commercial Register stipulates that a manager of a legal entity may request that the mention of the domicile address of the said manager be blocked under certain conditions.

The Commercial Register Law of 2007 entered into force on 1 July 2008. The Commercial Register Order of 2008 provides in Article 51 for a limitation of the publication of certain personal data for the purposes of compliance with the private life. According to paragraph 1 of this provision, the mention of the address of the domicile of a manager, a commissioner, a representative, a sole shareholder, a holder of shares not fully paid up, a liquidator or a manager of a foreign company, cannot be consulted by third parties. However, there is an exception for, in particular, administrative authorities, lawyers, bailiffs, notaries and certain supervisory authorities. A natural person may request that the publication of his domicile address be blocked under certain conditions pursuant to Article 51(3) of the aforementioned decree. 22

Same in the UK: 

Although most of the information held at Companies House is made available to the general public, some information, such as private addresses and full dates of birth, is not entered on the register but is shared with certain specified public authorities, such as as the police, as well as credit reference agencies. The legislator considers that the non-disclosure of the day of birth strikes a fair balance between the principles of transparency and confidentiality.

-Small Business and Enterprise and Employment Act 2015. Following complaints of identity theft, since October 2015 only the month and year of birth appear on the public register, “Great news – we're listening to our customers and making changes”, Companies House Blog, 17 June 2015, https://com panieshouse.blog.gov.uk/2015/06/17/great-news-were-listening-to-ourcustomers-and-making-changes/. It appears from the same article that, from now on, the day of birth will be redacted from the copies of the documents transmitted to the register in paper format. Regarding past transmissions, Companies House is working on an effective solution

-“Restricting the disclosure of your information”, Companies House March 2016, p. 3 and 5. 9

-“Our register: advice on protecting your personal information”, Companies House Blog, 21 January 2016, https://companieshouse.blog.gov.uk/2016/01/21/our-register-advice-on-protectingyour-personal -information/.

• The national judge can set aside an unconventional national standard; 

Even in the event that the Constitutional Council has declared a legislative provision to be in conformity with the Constitution, the judicial and administrative courts always retain the possibility of setting aside its application when they deem it contrary to the Convention (See for example Cass., Full Ass. April 15, 2011 No. (10-30.316)…hope is born.

We will lynch you: the right to be forgotten on the internet

 

We welcome the judgment of November 22, 2022, the Court of Jusitce (Judgment of the Court in joined cases C-37/20 | Luxembourg Business Registers and C-601/20 | Sovim) which goes towards more protection of life privacy by noting the invalidity, under the Charter, of the
provision of the Anti-Money Laundering Directive requiring Member States to ensure that
information on the beneficial owners of companies and other legal entities incorporated in their territory
are accessible in all cases to any member of the general public.

According to the Court, public access to beneficial ownership information constitutes a serious interference
in the fundamental rights to respect for private life and the protection of personal data
staff, respectively devoted to Articles 7 and 8 of the Charter. In fact, the information disclosed
allow a potentially unlimited number of people to learn about the material and financial situation
of a beneficial owner. Furthermore, the potential consequences for data subjects resulting from any misuse of their personal data are aggravated by the fact that, once
available to the general public, these data can not only be freely consulted, but also
be stored and disseminated.