EDPS Opinion 19/2023, on the Proposal for a Directive amending Directives 2009/102/EC and (EU) 2017/1132 as regards further expanding and upgrading the use of digital tools and processes in company law

17 May 2023

Opinion 19/2023

on the Proposal for a Directive amending Directives 2009/102/EC and (EU) 2017/1132 as regards further expanding and upgrading the use of digital tools and processes in company law

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3) ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the proposal for a Directive of the European Parliament and of the Council amending Directives 2009/102/EC and (EU) 2017/1132 as regards further expanding and upgrading the use of digital tools and processes in company law .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 29 March 2023, the European Commission issued the proposal for a Directive of the European Parliament and of the Council amending Directives 2009/102/EC and (EU) 2017/1132 as regards further expanding and upgrading the use of digital tools and processes in company law (‘the Proposal’).

The EDPS takes note of the overall objective of the Proposal, aiming at increasing transparency and trust in the business environment, for companies, consumers and other private stakeholders as well as public authorities. According to settled case-law of the Court of Justice of the European Union, legislation providing for the public disclosure of personal data interferes with the rights to protection of personal life and to personal data. While the EDPS understands that it might be necessary to make certain categories of personal data public to achieve specific and clearly defined objectives of public interest, the objective of transparency cannot be invoked as an end in itself. To ensure compliance with Articles 7 and 8 of the Charter, the EDPS considers that the objectives of public interest justifying disclosure of personal data should be articulated more clearly in the enacting terms of the Proposal. In addition, the categories of personal data to be made publicly available should be specified in an exhaustive manner, having regard to the requirements of necessity and proportionality.

Similarly, the EDPS understands that connecting the different Union level systems of interconnection of registers aims to further increase transparency. However, the establishment of connections between the system of interconnection of registers (BRIS), the beneficial ownership registers interconnection system (BORIS) and the insolvency registers interconnection system (IRI) should correspond to specific objectives, explicitly laid down in the enacting terms of the Proposal.

Finally, the Proposal should clarify the respective roles of Member States and the Commission, in particular in the context of the BRIS, and of the connection between the BRIS and the BORIS and IRI.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 29 March 2023, the European Commission issued the proposal for a Directive of the European Parliament and of the Council amending Directives 2009/102/EC and (EU) 2017/1132 as regards further expanding and upgrading the use of digital tools and processes in company law (‘the Proposal’).

2. The overall objectives of the Proposal are to enhance transparency and trust in the business environment, achieve more digitalised and connected cross-border public services for companies, and easier cross-border expansion for SMEs leading, in turn, to a more integrated and digitalised single market. To achieve this, the Proposal would increase the amount of company data available in business registers and/or Business Registers Interconnection System (BRIS) and improve its reliability. It would also enable direct use of company data available in business registers when setting up cross-border branches and subsidiaries, and in other cross-border activities and situations .

3. The Proposal is in line with the EU digitalisation objectives set out, in particular, in the Commission Communication 2030 Digital Compass: the European way for the Digital Decade . It is also in line with the Commission Communications Updating the 2020 New 6 7 Industrial Strategy and SME Strategy for a sustainable and digital Europe , since it aims to address obstacles to cross-border expansion that small and medium-sized enterprises (SMEs) currently face in the single market. The Proposal is included in the 2023 Commission work programme as one of the key actions under the Commission’s headline ambition of ‘Europe fit for the digital age’ .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 30 March 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 39 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

5. The EDPS takes note that the Proposal provides for the publication of personal data, in order to allow third parties to have access to company information not only from national business registers in their Member State but also in cross-border situations, at EU level.

6. In this regard, the EDPS welcomes the reference to the applicability of Regulation (EU) 2016/679 (‘the GDPR’) in recital 34, when Member States process any personal data about persons that can lawfully represent a company, as well as single shareholders. The EDPS also welcomes the reference to the applicability of the EUDPR in the same recital, when the Commission processes personal data in the context of the Proposal.

7. While recognizing the need for enhancing transparency on companies in the single market in order to protect the interests of third parties and to strengthen trust in business transactions , the EDPS recalls that the objective of transparency does not automatically prevail over the right to protection of personal data .

8. The EDPS also notes that, in order to increase transparency, the Proposal provides for the connection of the system of interconnection of registers (BRIS) with the EU Beneficial Ownership Registers Interconnection System (BORIS) , and with the EU Insolvency Registers Interconnection system (IRI) . The EDPS recalls that interoperability should not be an end in itself but should always serve a genuine public interest objective , in order to avoid using the connections beyond the purposes for which they were originally intended.

9. In this Opinion, the EDPS will focus his analysis on the publication of personal data in the context of the Proposal, the establishment of connections between BRIS, BORIS and IRI, as well as the respective roles of the Member States and the Commission when processing data for the purposes of the Proposal.

3. Publication of personal data

3.1. Public accessibility

10. The Proposal provides for the publication of personal data of the following categories of individuals, both in the context of single-member companies and of limited liability companies, partnerships and groups of companies: − as regards single-member companies, where all shares are held by a single person, Article 1 of the Proposal provides that this fact, together with the identity of the sole member, must be recorded in the file or entered in the register as referred to in Article 3(1) and (2) of Directive 68/151/EEC and made publicly available through the BRIS . Article 2 of the Proposal in turn specifies that the BRIS must make publicly available the first name, surname and the date of birth of the persons referred to in Article 3 of Directive 2009/102/EC . − as regards limited liability companies, partnerships and groups of companies, Article 2 of the Proposal specifies in Article 18(4) of Directive (EU) 2017/1132, that the BRIS must make publicly available the first name, surname and date of birth of the persons referred to in Articles 14(d), 14a(j) and (k), 19(2)(g) and 19a(2)(g), 30(1)(e), and 36(3)(f).

11. The EDPS first recalls that, according to settled case-law of the Court of Justice of the European Union, legislation providing for the public disclosure of personal data interferes with the rights to protection of personal life and to personal data. Any requirement to publish personal data should, in addition to being provided by law, also fulfil the other requirements arising from Article 52(1) of the Charter and Article 6(3) of the GDPR, and in particular must meet an objective of public interest and be proportionate to the legitimate aim pursued.

12. In its judgment of 9 March 2017, the Court of Justice of the European Union (‘CJEU’) considered that the public nature of the company register in question was intended to ensure legal certainty in dealings between companies and third parties and to protect, in particular, the interests of third parties in relation to joint stock companies and limited liability companies . The Court considered that the interference with the fundamental rights of the persons concerned (in particular the right to respect for private life and the right to protection of personal data guaranteed by the Charter of Fundamental Rights of the Union) was not disproportionate in so far as disclosure was required only for a limited number of personal data items, and the only safeguards that joint-stock companies and limited liability companies offer to third parties were their assets. Therefore, the CJEU considered it justified that natural persons who choose to participate in trade through such a joint stock company or limited liability company should be required to disclose data relating to their identity and functions within that company.

13. Against this background, the EDPS considers that the publication of personal data envisaged by the Proposal should be duly justified in light of the criteria of necessity and proportionality.

14. The EDPS acknowledges that the Proposal builds on and extends the use of the BRIS without altering its functioning, which means that a number of personal data at stake are already made public . This is in particular the case with data related to the identity of the sole member of single-member companies, since the former Article 3 of Directive 2009/102/EC already laid down their accessibility to the public . However, one of the objectives of the Proposal is to increase the amount of publicly available company data in business registers and/or through the system of interconnection of registers, which requires the demonstration of an objective of public interest.

15. The Proposal also mentions in several recitals the need to improve the reliability and trustworthiness of company information in the registers in order to facilitate its use without further formalities in a cross-border context. In addition, recital (5) of the Proposal indicates that “[a]ll stakeholders, including companies themselves, authorities and the public at large need to be able to rely on information about companies for their business purposes or in administrative procedures or court proceedings”.

16. The EDPS notes that the rationale for the different publication requirements is closely linked to the “stronger calls for transparency, from investors, creditors, consumers or companies themselves” . While the EDPS understands that it might be necessary to make certain categories of personal data public to achieve specific and clearly defined objectives of public interest, the objective of transparency cannot be invoked as an end in itself .

17. Given the interference to the fundamental rights to privacy and data protection stemming from the publication of personal data, the EDPS considers that the objectives that justify the public accessibility of those data should be clearly set out in the enacting terms of the Proposal as such. Moreover, the EDPS considers that a general reference to ‘business purposes’ without further qualification or explanation does not constitute a clearly defined objective of public interest justifying public accessibility. To ensure compliance with Articles 7 and 8 of the Charter, the EDPS considers that the objectives of public interest justifying disclosure of personal data should be articulated more clearly in the enacting terms of the Proposal.

3.2. Categories of personal data

18. The EDPS recalls that personal data is defined under the GDPR as any information relating to an identified or identifiable natural person (‘data subject’). Thus, the GDPR does not cover the processing of data concerning legal persons and in particular undertakings established as legal persons (including the name and the form of the legal person and the contact details of the legal person). However, “the fact that information [is] provided as part of a professional activity does not mean that it cannot be characterised as a set of personal data” .

19. In this context, the EDPS notes that the Proposal does not specify in an exhaustive manner which categories of personal data must be processed in the national registers and in the BRIS. According to Article 2 of the Proposal, Member States must ensure compulsory disclosure by companies of “at least” documents and particulars listed in Articles 14a and 14b . The EDPS understands that such a wording is intended to provide Member States a certain a degree flexibility when implementing the Directive. However, from a data protection perspective, and as stressed by the CJUE in Joined Cases C-37/20 and C-601/207 , the use of the expression ‘at least’ entails that those provisions would allow for data to be made available to the public which are not sufficiently defined and identifiable. Consequently, the substantive rules governing interference with the rights guaranteed in Articles 7 and 8 of the Charter do not meet the requirement of clarity and precision. The EDPS considers that all categories of personal data that are to be made publicly available should be specified exhaustively in the Proposal, having regard to the requirements of necessity and proportionality.

20. The Proposal refers, in several of the proposed amendments to articles of Directive (EU) 2017/1132, to the notion of “particulars” to be disclosed. Given the present opportunity to amend Directive (EU) 2017/1132, the EDPS recommends to specify what is meant by ‘particulars’ (for instance by providing a definition in the Proposal).

21. The EDPS welcomes on the other hand the justification provided by the Commission, in Recital 33, for the disclosure of the date of birth of the persons concerned, in order to ensure certainty about the exact identity of such persons, in particular in cross-border situations.

4. Connection of BRIS with BORIS and IRI

22. According to Article 2 of the Proposal, connections must be established between the system of interconnection of registers (BRIS), the beneficial ownership registers interconnection system (BORIS) and the insolvency registers interconnection system (IRI). The amended Article 22 of Directive (EU) 2017/1132 would provide that the establishment of connections “shall not alter or circumvent the rules and requirements related to the access of the information set out under the relevant frameworks establishing those registers and interconnections”. Recital 29 clarifies that “for example, this means that a user of BRIS should only be able to access BORIS if that user is entitled to access BORIS under its respective rules and requirements”.

23. The EDPS welcomes the clarification provided as regards the modalities of access to those registers. However, the enacting terms of the Proposal do not clearly specify purposes of the connections to be established. Connection between the systems of interconnection of registers cannot be considered a purpose in itself. The EDPS consider it is necessary to amend Article 22 in order clearly define the specific purposes of the connections in the enacting terms of the Proposal.

5. Roles and responsibilities

24. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who is responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice.

25. The EDPS notes that the Proposal does specify the roles of the Member States and the Commission under EU data protection law. The EDPS considers that the Proposal should clarify the respective roles of Member States and the Commission, in particular in the context of the BRIS, and of the connection between the BRIS and the BORIS and IRI. Ensuring clarity of roles and responsibilities is particularly important in a context where multiple registers are interconnected to ensure transparency towards the individuals affected.

6. Conclusions

26. In light of the above, the EDPS makes the following recommendations: (1) to articulate the objectives of public interest justifying public disclosure more clearly, and to do so in the enacting terms of the Proposal, (2) to specify exhaustively in the Proposal all categories of personal data that are to be made publically available, (3) to specify what is meant by the use of the term ‘particulars’, 9 (4) to specify in the enacting terms of the Proposal the specific purposes of the connection between the system of interconnection of registers, the beneficial ownership registers interconnection and the insolvency registers interconnection, (5) to clarify the respective roles of Member States and the Commission, in particular in the context of the connections to be established between between the system of interconnection of registers, the beneficial ownership registers interconnection and the insolvency registers interconnection. Brussels, 17 May 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI p.o Leonardo CERVERA NAVAS Acting Head of EDPS Secretariat 10