# The Hamburg Commissioner for Data Protection and Freedom of Information
Hamburg, 14 February 2023
IMI Reference No. A60IC 482567 / A60DD 566852 / A60FD 606822
National Reference Number: M/745/2022
In the matter of a complaint, lodged by [REDACTED], Austria, with the Hamburg Commissioner for Data Protection and Freedom of Information pursuant to Article 77 of the General Data Protection Regulation, concerning [REDACTED]
# FINAL DECISION
The Hamburg Commissioner for Data Protection and Freedom of Information ("Hamburg SA") hereby issues the following decision for the complaint lodged on 4 March 2022 by
[REDACTED], Altmünster, AUSTRIA ["Complainant"]
against
[REDACTED] [REDACTED] Hamburg, GERMANY ["Controller"]
regarding an alleged violation of personal data:
www.datenschutz-hamburg.de
E-Mail: [email protected]
Confidential information should be transmitted to us by electronic means only in encrypted form.
The public PGP-key is available on the internet (Fingerprint: 0932 579B 33C1 8C21 6C9D E77D 08DD BAE4 3377 5707).
The Hamburg Commissioner for
Data Protection and Freedom of Information
# Decision
The complaint is hereby dismissed.
The controller has not been found in breach of data protection law.
Legal grounds: Art. 5 (1) (d) GDPR, Art. 6 (1) (f) GDPR, Art. 17 (1), Art. 17 (3) (a) GDPR,
Art. 21 (1) GDPR
# Reasoning
The complainant lodged a complaint with the German Federal Commissioner for Data Protection
and Freedom of Information on 4 March 2022, as the controller had allegedly violated his right to
data correction.
As a cross-border complaint, this case is to be handled in accordance with Art. 60 GDPR. As the
controller is based in Hamburg, Germany, the lead supervisory authority is the Hamburg SA in
accordance with Art. 56 (1) GDPR.
The complainant is – together with his wife – partner in the Austrian general partnership
, a company comprised of two or more persons who are jointly and
personally liable for the company's liabilities. Its name contains the surname of the partners
". The company was founded for the acquisition of a private property and is registered in the
Austrian commercial register. The company's registered office is also the private residential address. For this private residential address, there is an information block in the Central Register of
Residents in accordance with the Registration Act (Meldegesetz) due to a proven legitimate interest.
The controller reproduces current and former commercial register information in an online-database. On its database-website https://www.de
, the information regarding the company is published in
a graphic overview including the company's name, register number and the address of the company's registered office. Extracts of the Austrian commercial register entries are available for
- 2 -
The Hamburg Commissioner for
Data Protection and Freedom of Information
paying subscribers of the controller's services, including the name and surname of the complainant as authorized representative shareholder.
In the respondent's database, when entering the complainant's name and surname, references to four other companies are shown in a graphic overview where the complainant has been managing director in the last years (see https://com/...). No reference to the ... is made here.
The complainant requested deletion of the information regarding the ... under the URL https://www...de/... stating that the company had been established for acquisition of a private property, does not engage in any commercial activity and contained his – the complainant's – surname in the company's name as well as his private residential address. He pointed out that for his – the complainant's – residential address there was a block on information in the Central Register of Residents.
The controller refused to delete the information regarding the ... and pointed him to the possibility to change the company's address in the commercial register (https://help.com/en/center/how-can-i-prevent-my-private-address-from-being-shown-1). In this case, the controller would not show the former address any more.
The complainant is of the opinion that the controller is obliged to delete all the information about the company. He states that commercial register information was not publicly available as it was accessible only after payment of a fee or for certain professional groups, such as attorneys and notaries.
According to Art. 17 (1) lit. c, Art. 17 (3) lit. a, Art. 21 (1) GDPR the data subject has a right to demand erasure of personal data concerning him or her when the data subject objects to the processing in accordance with Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing. This is especially the case when there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject.
The Hamburg SA is of the opinion that there are overriding legitimate grounds for the processing. The complainant is authorized representative shareholder and as such, personally liable for the
– 3 –
The Hamburg Commissioner for
Data Protection and Freedom of Information
general partnership’s liabilities. The company is generally able to have contractual relations with third persons (such as service providers or property sellers), within the scope of its (business) activities. Generally, the commercial register has the task of ensuring the disclosure of facts and legal relationships that are essential for legal transactions (see *CJEU*, judgement of 9 March 2017 – C-398/15, *Manni*). This includes disclosure of who is the (natural) person liable for the company’s liabilities and who has got the power of representation. The complainant’s statement that the company had been established for acquisition of a private property and does not engage in any commercial activity, cannot eliminate the interest in information. The company’s activities do not have to be of a commercial nature in order for the interest in information to exist. What is essential is that the company has the possibility to enter into contracts with third persons who have an interest in knowing about the (liable) individuals behind the company. What kind of contractual relations the company has, has had or will have in the future cannot be assessed or foreseen. As a consequence, a general interest in the publication of commercial register information, also with regard to the complainant’s company, can be assumed. This interest in information overweighs the complainant’s interest in preventing his private address from becoming publicly visible in relation to his surname. The complainant deliberately chose this company form as well as the company name, which contains his surname. He had also decided to register this company under his private address. When registering the company, he himself made his residential address public in relation to his name “[REDACTED]” and his company. Contrary to the complainant’s opinion, the commercial register (Firmenbuch) is publicly available, as any person can have access. Short information regarding a company can be retrieved for free, complete excerpts can be obtained for a fee by any person interested. Information published in the commercial register, thus, is less worthy of protection, even though there may be a block on information in the Central Register of Residents in accordance with the Registration Act for the complainant’s private address.
The complaint must be examined against the background of recital 14, which states that the Regulation does not apply to legal persons. According to this view, this exception covers not only legal entities, but also partnerships with legal capacity. Information regarding a company address – even when at the same time being place of residence of the natural person – is, under the same conditions, not to be considered as personal data as in the case of legal entities without a name reference, as long as there is a clear reference to the company and no context to the natural person. This is the case here due to the entry in the commercial register. From the register, there is no indication that the company address is at the same time the complainant’s residential address.
– 4 –
The Hamburg Commissioner for
Data Protection and Freedom of Information
Even if the material scope of the GDPR is opened, thus, the legitimate interest of the controller in
processing publicly available information, Art. 6 (1) (f) GDPR, would not be outweighed here by
interests of the complainant.
Taking account of the complainant's situation, though, the controller excepts the information re-
garding the from being shown when searching for the
complainant's name in the controller's Database-Services and in its overviews regarding the com-
plainant. As a consequence, the information regarding his private address is not shown when
searching for his person. It is only shown when specifically searching for the
. The controller, thus, has taken reasonable measures to prevent
third persons to draw conclusions from the complainant's person to the
and thus, to the complainant's private address.
A violation of data protection law cannot be determined.
The complaint is therefore dismissed.
Hamburg SA
- 5 -