Single-member private limited liability companies

Opinion of the European Data Protection Supervisor

on the Commission Proposal for a Directive of the European Parliament and of the Council on single-member private limited liability companies

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of 2 such data, and in particular Article 28(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION 1.1. Consultation of the EDPS

1. On 9 April 2014, the Commission adopted a proposal for a Directive of the European Parliament and of the Council on single-member private limited liability companies ('the Proposal'). On the same day, the Commission sent the Proposal to the EDPS for consultation. 1.2. Objective and scope of the Proposal

2. The overall objective of the Proposal is to ‘make it easier for any potential company founder, and in particular for SMEs, to set-up companies abroad’. To this end, the Proposal aims to ‘harmonise the conditions of setting-up and operation of singlemember limited liability companies’. The Proposal provides for ‘the possibility of online registration, with the standard template for the articles of association, a minimum capital requirement of EUR 1, accompanied by a balance sheet test and a solvency statement.’ To help ensure transparency, it also requires disclosure of certain information about the single-member company in a register accessible to the public.

2. ANALYSIS OF THE PROPOSAL 2.1. Personal data processed under the Proposal

3. Although the processing of personal data is not the main focus of the Proposal, the Proposal nevertheless requires processing of a significant amount of personal data. These typically relate to the single-members of the companies, if they are individuals, as well as to the individuals who are representing the companies. The following provisions of the Proposal are particularly relevant from the data protection perspective: Registration requirements  Article 13 requires certain data about the company, its single-member and its representatives to be registered. These include, in relevant part, the name, address, and other identifying information about the founding member, beneficial owner, and representative that registers the company; as well as names, addresses and other identifying information about the persons authorised to represent the company, along with information about whether or not the representatives of the company have been disqualified from serving as such. Information exchange via the internal-market information system (‘IMI’)  Recital 17 and Articles 14 and 22 provide for the possibility to exchange information in connection with the registration process via IMI. This also includes information about the identity of the founder and about the disqualification of the proposed representatives. Public disclosure requirements  Recital 2 and Article 3 require the compulsory disclosure of the identity of the single member in a publicly available register. This includes personal data in case the single-member is an individual.  Recital 14 refers to compulsory public disclosure of all other registered documents related to the company. 2.2. References to applicable data protection law and to the EDPS consultation

4. In light of the processing of personal data outlined above, we recommend that a substantive provision, or at least a recital, be added to refer to applicable data protection legislation, including national law implementing Directive 95/46/EC.

5. Further, we recommend that the preamble refer to the fact that the EDPS has been consulted. 2.3. Registration requirements (Chapter 4)

6. Article 13 requires certain data about the company, its single-member and its representatives to be registered in the register of companies maintained by the competent body of the Member State concerned. These include, in relevant part, the name, address, and other identifying information about the founding member; as well as information about whether or not the representatives of the company have been disqualified from serving as such.

7. Making available this information to the entities responsible for registration prima facie appears to be adequate, relevant and not excessive in relation to the purpose of registering the single-member companies in question, and thus, complies with Article 6(1)(c) of Directive 95/46/EC. Therefore, the EDPS raises no objections regarding the data to be collected, even if this may include significant amount of personal data. This is a matter distinct from the issue of what personal data may be made publicly available via the registry, which we will discuss in Section 2.5 below. 2.3. Information exchange via IMI

8. Recital 17 and Articles 14 and 22 provide for the possibility to exchange information in connection with the registration process via IMI. This also includes information about the identity of the founder and about the disqualification of the proposed representatives.

9. We welcome the fact that the Commission considers the use of an existing information exchange tool such as IMI, taking into account that it has already invested significant efforts in ensuring that IMI is developed taking into account the principle of data protection by design.

10. At the same time, we would welcome further clarifications in the Proposal regarding what personal data may be exchanged via IMI. In particular, it is not clear from the Proposal whether personal data will be exchanged routinely, as a standard practice to verify the identity of the founder of the single-member company to be registered or only in case doubts arise as to the identity of the founder.

11. Similarly, it is not clear whether the intention is to routinely check on each occasion via IMI whether the statements regarding lack of disqualification of the representatives of the company are truthful, or whether this is done only in case of doubt.

12. It is also not clear whether IMI can be used only to check whether a statement regarding disqualification is truthful (yes or no) or also whether it can be used to require further details regarding the reasons for the disqualification.

13. We recommend that these points be clarified in the text of the Proposal itself, in order to ensure legal certainty, and prevent potential inconsistent practice arising out of different implementation in the Member States concerned.

14. The EDPS would also welcome a general reference in the text of the Proposal to the requirement that any personal data exchanged must be proportionate to the objective of the information exchange, in accordance with Article 6(1)(c) of Directive 95/46/EC. 2.5 Public disclosure requirements

15. Recital 2 and Article 3 require the compulsory disclosure of the identity of the single member in a public register (or in a register kept by the company and accessible to the public). This includes personal data in case the single-member is an individual.

16. In addition, Recital 14 suggests that ‘in order to ensure a high level of transparency, all documents registered at the register of companies should be made publicly available via the system of interconnection of registers referred to in Article 4(a)2 of Directive 2009/101/EC’. These data, in relevant part, may include the name, address, and other identifying information about the founding member, beneficial owner, and representative that registers the company; as well as names, addresses and other identifying information about the persons authorised to represent the company, along with information about whether or not he or she has been disqualified from serving as such. Balancing transparency and data protection/privacy

17. The EDPS acknowledges the importance of the objectives of transparency and accountability, which these provisions serve.

18. With regard to the interplay between EU law and national law in this regard, the EDPS would like to underline that unlike data protection laws, which are harmonised to a certain degree based on Directive 95/46/EC, access to information laws significantly diverge across EU Member States. Same is true for laws regulating what information is to be published in trade registers, and in registers held by the companies themselves, and in what way the public is given access to this information.

19. In principle, access regimes typically call for a balancing test that compares the interests protected by privacy and data protection rules against the benefits of openness and transparency. Considering the divergences, the outcome of the balancing exercise may be different in the different EU Member States. For example, trade registers in some Member States may publish the addresses of company’s representatives, whereas another Member State would consider this as information that, in general, while registered, should not be made publicly available.

20. That being said, national legislation must comply with Article 8 of the European Convention on Human Rights (‘ECHR’) as well as Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘EU Charter’) when implementing EU law. This implies, as the European Court of Justice held in the sterreichischer Rundfunk and Schecke cases that it should be ascertained that the disclosure is necessary for and proportionate to the legitimate aim pursued by the law.

21. In view of the lack of harmonisation on these issues at EU level, the EDPS would have welcomed more clarity and legal certainty in the text of the Proposal and more detailed and more specific consideration of alternatives in the Impact Assessment. That said, he does not, in principle, have objections against the possibility of public disclosure of registration information, so long it is clear what data will be made publicly available and further provided that any public disclosure is made taking into account the principle of proportionality, and subject to appropriate safeguards under the Proposal and/or under national law. This should be made clear in the text of the Proposal. What registration data should be publicly disclosed and subject to what safeguards?

22. Recital 14 appears to require publication of all ‘registered documents’ via the common European platform it refers to. At the same time, the Proposal has no substantive provision among its articles that would clearly specify this requirement. Only with respect to the identity of the sole member, Article 3 provides for a substantive provision.

23. We recommend that Recital 14 be revised to specifically refer to the documents to be made available publicly - rather than simply saying ‘all’ must be public. We also recommend that a substantive provision, similar to Article 3, be added to this effect to ensure legal certainty.

24. Finally, we also recommend that with regard to publication of addresses and identifying information of individuals (be them the founders, beneficial owners or representatives), legislators make a careful assessment as to the proportionality of public disclosure of any personal data, and also that the Proposal provide that any publication will be made subject to data protection safeguards under national law. Information regarding disqualification

25. The EDPS welcomes the fact that Article 22(6) limits the registration and public disclosure of information regarding disqualification to cases when the disqualification is currently in effect. In other words, no information has to be provided during the registration process (or publicly disclosed) with regard to any past disqualification that is no longer in effect (or that has not yet come into effect). Purpose limitation and limitations on accessibility

26. As an additional safeguard, the EDPS calls attention to the principle of purpose limitation set forth in Article 6(1)(b) of Directive 95/46/EC. He recommends that the Proposal clearly specify that the personal data made publicly available under the Proposal may be used for purposes of transparency and accountability and shall not be used (by anyone) for any incompatible purposes (such as, for example, for marketing to these individuals, or creating profiles of these individuals).

27. As a related point, the EDPS recalls that once data have been made publicly available, especially if this has been done via the internet, it is very difficult, if not impossible, to have any definitive control over what will happen to that information. For example, it will not be possible to definitely ensure deletion or inaccessibility of the data after a certain period of time.

28. Nevertheless, considering that the information published, in principle, will not serve its intended purposes after an appropriate, limited period of time , we recommend that the Proposal require that Member States ensure that the companies/registers take appropriate technical and organisational measures to limit the accessibility of personal data after an appropriate period of time. For example, measures can ensure that the companies/registers concerned will either take off from their websites information relating to out-dated information, or that the personal data available in the archives of the registry will not be searchable by the names of the single-members concerned, and not be available for search by external search engines either in this manner.

29. Accurate and prompt updates are particularly important with regard to information of more sensitive nature, such as disqualification. It is also essential to ensure that the accessibility of the name, address and any other identifier of the single member, if an individual, will be limited to the extent possible once they are no longer singlemembers. Data subjects rights, including information to the data subjects

30. Sections IV to VII of Directive 95/46/EC require that certain information be given to the data subjects and also give certain rights to the data subjects, including rights of access, and the right to object.

31. With regard to the information given to data subjects, we note that, as discussed elsewhere, it is essential that some information be already provided in the Proposal and/or in national law, such as the types of data to be processed (registered, exchanged via IMI or published, as the case may be) and the purposes of processing (accountability and transparency in case of publication). Additional information should also be provided to the individuals concerned by the controllers (companies, company registers, as the case may be) about the processing of their personal data, in accordance with Articles 10 and 11 of Directive 95/46/EC (such as the time limit for retention of personal data and information on how individuals can exercise their rights).

3. CONCLUSIONS  We welcome the consultation of the EDPS on this Proposal and the fact that the Proposal limits the collection of data on disqualifications currently in effect, and that it specifies that information exchanges could be carried out under the IMI system.  In the present Opinion we recommend the following further improvements:  A substantive provision, or at least a recital, should be added to refer to applicable data protection legislation, including 'national law implementing Directive 95/46/EC’.  The preamble should refer to the fact that the EDPS has been consulted.  The Proposal should be more explicit on what personal data may be exchanged via IMI, including whether additional information can be collected with regard to disqualifications.  The Proposal, in a substantive provision, should more clearly specify the documents to be made available publicly, subject to a careful assessment of proportionality, and should also specify that any publication will be made subject to data protection safeguards under national law.  Further, the Proposal should specify that the personal data made publicly available under the Proposal may be used for purposes of transparency and accountability and shall not be used for any incompatible purposes .  Finally, the Proposal should also require the registers/companies to ensure that technical and organisational measures are put in place to limit accessibility of the information regarding individuals (such as single-members or company representatives) after a certain period of time. Done in Brussels, 23 July 2014 (signed) Giovanni BUTTARELLI