# The Hamburg Commissioner for Data Protection and Freedom of Information
Hamburg, 14 February 2024
IMI Reference No. A60IC 521938 / A60DD 581416 / A60FD 606747
National Reference Number: M/2547/2022
In the matter of a complaint, lodged by [REDACTED] France, with the Hamburg Commissioner for Data Protection and Freedom of Information pursuant to Article 77 of the General Data Protection Regulation, concerning [REDACTED]
# FINAL DECISION
The Hamburg Commissioner for Data Protection and Freedom of Information ("Hamburg SA") hereby issues the following decision for the complaint lodged on 20 October 2022 by
Mr [REDACTED], Mâcon, FRANCE ["Complainant"]
against
[REDACTED], [REDACTED] Hamburg, GERMANY ["Controller"]
regarding an alleged violation of personal data:
www.datenschutz-hamburg.de
E-Mail: [email protected]
Confidential information should be transmitted to us by electronic means only in encrypted form.
The public PGP-key is available on the internet (Fingerprint: 0932 579B 33C1 8C21 6C9D E77D 08DD BAE4 3377 5707).
The Hamburg Commissioner for
Data Protection and Freedom of Information
# Decision
The complaint is hereby dismissed.
The controller has not been found in breach of data protection law.
Legal grounds: Art. 5 (1) (d) GDPR, Art. 6 (1) (f), Art. 17 (1), Art. 17 (3) lit. a GDPR, Art. 21 (1) GDPR
# Reasoning
The complainant lodged a complaint with the German Federal Commissioner for Data Protection and Freedom of Information on 20 October 2022, as the controller had allegedly violated his right to erasure and his right to object.
As a cross-border complaint, this case is to be handled in accordance with Art. 60 GDPR. As the controller is based in Hamburg, Germany, the lead supervisory authority is the Commissioner for Data Protection in Hamburg in accordance with Art. 56 (1) GDPR.
The complainant is, together with another partner, managing partner in a Société civile immobilière (SCI) familiale, [REDACTED], a company that is proprietor of real estate and has a pure asset management character, cannot engage in commercial activity and whose partners are all members of one family. Purpose of the company is the acquisition and administration of any property that may be operated under a lease. The managing partners represent the company externally and can conclude contracts, for example with suppliers or craftsmen.
The complainant is moreover president of a société par actions simplifiée, [REDACTED] and of a Société à responsabilité limitée, [REDACTED]. The companies are registered in the commercial register (Registre du Commerce et des Sociétés, RCS) in France.
The controller, [REDACTED], reproduces current and former commercial register information in an online-database. On its database-website https://www.com/ [REDACTED] [REDACTED] [REDACTED], there is an overview over the companies the complainant engages in. Further details to the companies, including register number and the address of the company's respective registered office, are published under
- 2 -
The Hamburg Commissioner for
Data Protection and Freedom of Information
https://www.com
https://www.com
and https://www.com
With regard to the SCI , under https://www.com
, amongst other data, the address of the company's
registered office and the name of the partners and managing partners of the SCI are published.
- 3 -
The Hamburg Commissioner for
Data Protection and Freedom of Information
Extracts of the French commercial register entries are available for paying subscribers of the controller's services, including information about birthday and address of the complainant as authorized representative partner.
The complainant states he is a victim of cyber harassment and therefore wishes to delete his footprints on the internet to reduce visibility and exposure. He claims that disclosing the identities and private details of the owner, such as birthday and address is a breach of privacy. The complainant states that an SCI is a civil, non-commercial company and it does not have clients or customers.
The complainant requested deletion of the information regarding his person. The controller refused to delete the information. Hamburg SA invited the complainant to explain to the controller the circumstances an overriding interest for his objection to the data processing arise from and to send any proof of those circumstances to the controller. The complainant, however, did not put forward any substantial grounds relating to his particular situation.
The controller states that the SAS and the SÀRL are registered in the commercial register and for the SCI there is an obligation to register and publish information in the French company and branch directory SIRENE (Système Informatique pour le Répertoire des ENtreprises et des Etablissements - https://www.sirene.fr and https://avis-situation-sirene.insee.fr/) and that Sirene-data
- 4 -
The Hamburg Commissioner for
Data Protection and Freedom of Information
is qualified as Open Data since 2017 (https://www.sirene.fr/sirene/public/static/acces-donnees, https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000033202746). In contrast to companions of a corporation, partners of an SCI have to be named in the French register entries. Naming of partners of an SCI was in line with data protection laws because from the status as a partner one cannot infer to the partner's personal assets and moreover the partner – unlike a companion of a corporation – is personally liable in different aspects. The complainant's private address is only visible for paying subscribers of the controller's services.
According to Art. 17 (1) lit. c, Art. 17 (3) lit. a, Art. 21 (1) GDPR the data subject has a right to demand erasure of personal data concerning him or her when the data subject objects to the processing in accordance with Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing. This is especially the case when there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject.
Hamburg SA is of the opinion that there are overriding legitimate grounds for the processing. The complainant is president of an SAS and of a SARL and moreover managing partner of an SCI and as such, personally liable for the SCI's liabilities. The SCI is generally able to have contractual relations with third persons (such as suppliers, service providers or craftsmen), within the scope of its activities. The public register has the function to make transparent for third persons, such as contract partners, who is the (natural) person liable for the company's liabilities.
The complainant's statement that the company does not engage in any commercial activity and does not have clients or customers cannot eliminate the interest in information. The company's activities do not have to be of a commercial nature in order for the interest in information to exist. What is essential is that the company has the possibility to enter into contracts with third persons who have an interest in knowing about the (liable) individuals behind the company. What kind of contractual relations the company has, has had or will have in the future cannot be assessed or foreseen. As a consequence, a general interest in the publication of the register information, also with regard to the complainant's company, can be assumed. This interest in information overweighs the complainant's interest in preventing his name being shown in relation to the SCI and the SCI's address. From the data provided by the controller to the general public, there is no indication that the SCI's address is at the same time the complainant's residential address. Register data depicting the complainant's private address is only visible for paying subscribers of the controller's services.
- 5 -
The Hamburg Commissioner for
Data Protection and Freedom of Information
On the other hand, the complainant has not put forward any substantial grounds relating to his particular situation, in accordance with Article 17 (1) lit. c and Article 21 (1) GDPR.
Even if the material scope of the GDPR is opened, thus, the legitimate interest of the controller in processing publicly available information would not be outweighed here by interests of the complainant.
A violation of data protection law cannot be determined.
The complaint should therefore be dismissed.
In accordance with Art. 60 (8) GDPR, when a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged adopts the decision and notifies the complainant and the controller.
Hamburg, 14 February 2024
Hamburg SA
- 6 -