# The Hamburg Commissioner for Data Protection and Freedom of Information
Hamburg, 15 April 2024
IMI Reference No. 605734, 628502
National Reference Number: M/3286/2023
In the matter of a complaint, lodged by [REDACTED], Luxembourg, with the Hamburg Commissioner for Data Protection and Freedom of Information pursuant to Article 77 of the General Data Protection Regulation, concerning North Data GmbH
# FINAL DECISION
The Hamburg Commissioner for Data Protection and Freedom of Information ("the HmbBfDI") hereby issues the following decision for the complaint lodged on 17 November 2023 by
[REDACTED], [REDACTED], LUXEMBOURG ["Complainant"]
against
North Data GmbH, Hermannstraße 22, D-20095 Hamburg, GERMANY ["Controller"]
regarding an alleged violation of personal data:
www.datenschutz-hamburg.de
E-Mail: [email protected]
Confidential information should be transmitted to us by electronic means only in encrypted form.
The public PGP-key is available on the internet (Fingerprint: 0932 579B 33C1 8C21 6C9D E77D 08DD BAE4 3377 5707).
The Hamburg Commissioner for
Data Protection and Freedom of Information
# Decision
The complaint is hereby dismissed.
The controller has not been found in breach of data protection law.
Legal grounds: Art. 5 (1) lit. d GDPR, Art. 6 (1) f) GDPR, Art. 17 (1), Art. 17 (3) lit. a GDPR,
Art. 21 (1) GDPR
# Reasoning
The complainant lodged a complaint with the German Federal Commissioner for Data Protection
and Freedom of Information on 17 November 2023, as the controller had allegedly violated his
right to data erasure.
As a cross-border complaint, this case is to be handled in accordance with Art. 60 GDPR. As the
controller is based in Hamburg, Germany, the lead supervisory authority is the Commissioner for
Data Protection in Hamburg in accordance with Art. 56 (1) GDPR.
The complainant is director of
All of
the companies are seated
The company's registered office is also the complainant's private residential address.
The controller, North Data GmbH, reproduces current and former commercial register information
in an online-database. On its database-website www.northdata.com, the controller publishes in-
formation about the companies and the complainant in a graphic overview including the com-
pany's name, register number and the address of the company's registered office as well as the
name and surname of the complainant as director / managing director, e.g. under
- 2 -
The Hamburg Commissioner for
Data Protection and Freedom of Information
In the controller's database, when entering the complainant's name and surname, references to
four other companies are shown in a graphic overview where the complainant is director / man-
aging
director
(see
The complainant requested deletion of the information regarding his name from the database. He
states that in 2012, he had moved his place of living due to a death threat and he does not want
his name to be mentioned in relation to the companies he is (managing) director of.
The controller removed the information about the complainant's place of residence from the freely
accessible database information. It refused to delete the information regarding the complainant's
name as director / managing director and pointed him to the possibility to change the company's
address in the commercial register
). In this case, the controller would not show the former company's address any more.
According to Art. 17 (1) lit. c, Art. 17 (3) lit. a, Art. 21 (1) GDPR the data subject has a right to
demand erasure of personal data concerning him or her when the data subject objects to the
processing in accordance with Art. 21 (1) GDPR and there are no overriding legitimate grounds
for the processing. This is especially the case when there are compelling legitimate grounds for
the processing which override the interests, rights and freedoms of the data subject.
The HmbBfDI is of the opinion that there are overriding legitimate grounds for the processing.
The complainant is director of a Société anonyme (SA), a Société de gestion de patrimoine familial (SPF) and managing director of two Sociétés en commandite simples (SECS). As a director/managing director he is authorized representative of the companies, which are able to have
contractual relations with third persons, within the scope of their respective (business) activities.
The commercial register has the function to make transparent for third persons, such as contract
partners, who is the (natural) person acting as representative on behalf of legal entities such as
corporations. As a consequence, a general interest in the publication of commercial register information, also with regard to the complainant's role as (sole) legal representative, has to be
assumed.
- 3 -
The Hamburg Commissioner for
Data Protection and Freedom of Information
This interest in information overweighs the complainant's interest in preventing his private address from becoming publicly visible in relation to his name. The complainant deliberately chose to register the companies under his private residential address. When registering the companies, he himself made his residential address public in relation to the companies he is (managing) director of. From the information publicly provided by the controller, however, there is no indication that the company's registered office is at the same time the complainant's private residential address.
The commercial register information is publicly available in the Luxembourg Registre de Commerce et des Sociétés, so that any person can have access to the data. In the register data – as opposed to the data displayed by the controller – the complainant's private residential address is displayed, as well (see e.g.
The purpose of disclosing the register data is to be able to inform all interested third parties without them having to prove a right or interest that requires protection (CJEU, judgment of March 9, 2017 - C-398/15). The complaint must be examined against the background of recital 14, which states that the Regulation does not apply to legal persons. A company address at the place of residence of the natural person is, under the same conditions, not to be considered as personal data as in the case of legal entities without a name reference, as long as there is a clear reference to the company and no context to the natural person. This is the case here due to the entry in the controller's database. From the database information, there is no indication that the company address is at the same time the complainant's residential address.
Even if the material scope of the GDPR is opened, thus, the legitimate interest of the controller in processing publicly available commercial register information would not be outweighed here by interests of the complainant.
A violation of data protection law cannot be determined.
The complaint is therefore dismissed.
- 4 -
The Hamburg Commissioner for
Data Protection and Freedom of Information
Hamburg, 15 April 2024
on behalf of Hamburg SA
Legal appeal:
An action against this decision can be filed with the Hamburg Administrative Court (Lübeckertor-
damm 4, 20099 Hamburg) within one month of its announcement.
- 5 -