Yesterday the European Court (ECJ) returned again to the Right to be Forgotten in a case referred to Luxembourg from the Corte Suprema di Cassazione (an Italian court). The case is likely to put limits on the Right to be Forgotten. You can find out what the Right to be Forgotten is in our glossary here http://www.corderycompliance.com/eu-data-protection-glossary/.
What was the case about?
In this case, Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni, Mr Manni was a Director of a Company which was awarded a contract for the building of a tourist complex in Italy. He said that the properties in the complex did not sell as well as he would like because the Companies Register showed that he had been the Administrator of another company that went bankrupt in 1992 and was wound up in 2005.
He wanted to exercise his Right to be Forgotten against the Lecce Chamber of Commerce who maintained the Companies Register presumably to enable him to sell the properties more easily.
The first court in Italy to hear the case, the Tribunale di Lecce, ordered the Chamber of Commerce to respect Manni’s Right to be Forgotten request. The Chamber then appealed to the Corte Suprema di Cassazione which asked the European Court in Luxembourg for a preliminary ruling.
What did the ECJ decide?
The ECJ tried to balance the Right to be Forgotten against the need to protect the interests of third parties in relation to limited liability companies. They said that in this case they thought that the need to protect third parties overrode Manni’s Right to be Forgotten. In essence the ECJ said that the Right to be Forgotten was not an absolute right.
How does this affect GDPR?
A statutory Right to be Forgotten (sometimes called a Right to Erasure) is a key feature of the GDPR and is likely to cause difficulties for employers and those maintaining databases on others when the GDPR comes into force in 441 days time.
As we’ve said in our glossary the GDPR right is a little different to the judge-made right the ECJ was dealing with here. There’s background to the original Right to be Forgotten in the Google Spain case here – http://www.corderycompliance.com/european-court-google-ruling/. The key differences between the Judge-made Right to be Forgotten and the Right to be Forgotten under the GDPR are explained in more detail in our GDPR Navigator film (see www.bit.ly/gdprnav).
The GDPR Right to be Forgotten is contained in Article 17 of the GDPR. Article 17 does have limits on the Right to be Forgotten which could in this case also have denied Manni a remedy under the GDPR right once the GDPR is in force in May 2018. This ECJ case may be helpful in acknowledging that a balance needs to be struck between a Right to be Forgotten and the need to have accurate records, especially where those records are maintained in the public interest.
What happens next?
It is important to remember that the European Court has not made a final decision here. It has sent its interpretation of the law back to the Italian court who will take that ruling into account in making their decision.
We will be discussing the Manni case in more detail in our next GDPR Navigator call. GDPR Navigator is an extensive set of resources on GDPR and includes a 15 minute film explaining the Right to be Forgotten and how it will work under the GDPR. You can find more details here www.bit.ly/gdprnav
For more information please contact Jonathan Armstrong or André Bywater who are lawyers with Cordery in London where their focus is on compliance issues.
| Jonathan Armstrong, Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH | André Bywater, Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH | |
| Office: +44 (0)207 075 1784 | Office: +44 (0)207 075 1785 | |
| Jonathan.armstrong@corderycompliance.com | Andre.bywater@corderycompliance.com | |
 |
 |