-1–
Barichgasse 40-42
A-1030 Vienna
Tel.: +43-1-52152
Republic of Austria
Data
protection E-mail: [email protected]
authority
D130.1350 Case officer:
2025-0.378.167
Data protection complaint (right to erasure)
by e-mail:
FINAL DECISION
DICTUM
The DPA decides on the data protection complaint lodged by (complainant) on 9
March 2023 against (respondent) for infringement of the right to erasure as follows:
The complaint is dismissed.
Legal bases: Articles 17, 21, 51(1), 57(1)(f) and 77(1) of Regulation (EU) 2016/679 (General Data
Protection Regulation; ‘the General Data Protection Regulation’): GDPR), OJ L 119, 4.5.2016, p. 1;
Sections 18(1) and 24(1) and (5) of the Data Protection Act (DSG), BGBl. I No 165/1999 as amended.
REASONS
A. Arguments of the parties and course of proceedings
1. The complainant lodged a complaint on the right to erasure on 9 March 2023. The respondent is a
legal person established in Hamburg.
2. After an amicable conciliation attempt initiated by the Data Protection Authority failed, the Data
Protection Authority initiated the procedure under Article 56 et seq. of the GDPR to investigate the lead
supervisory authority, as there was a situation that does not fall under the exclusive competence of the
-2–
DPA and suspended the procedure by decision of 11 October 2023 until the lead supervisory authority
was identified.
3. The Hamburg Commissioner for Data Protection and Freedom of Information has declared itself the
lead supervisory authority in the present case and initiated an investigation.
B. Subject-matter of the complaint
The subject-matter of the appeal is whether the respondent has infringed the respondent's right to
erasure by failing to comply with its request for erasure.
C. Factual findings
The complainant was managing director of an Austrian limited liability company, ,
between 26 November 2019 and 19 July 2022, the date of termination of the company and cancellation
in the Austrian commercial register.
The respondent reproduces current and former commercial register information in an online database.
On its database website , it publishes information on and the
complainant in a graphical overview, including the name, registration number and address of the
company’s registered office, as well as the name and surname of the complainant as managing director
and the country of his residence, Austria, e.g. at
and
(as of screenshot 16 May
2024):
-3–
. .
AUSTRIA+
© Dossier ri Watch
NAME
REGISTER
Poor Book 52381 Ik
C0RP0RATE PURPOSE
Services in automatic data Processing Information techndogy and ielecomm<jnicatbns
HISTORY
M D Kewn I acherw or
2019 Ad juy OcMter 2320 Apii juy Ociatef 2021 Atri OCTXf 2022 Juh DacWi 2023
NETWORK
o
Vantablack GmbH t
o
Managing Cirodof
K"^ln l achoruortor
• AUSTRIA
DATA SERVICES
Unlock the full potential of processed Company data with only API or Quarterly Exports.
3 Dec 2019
Registration 18/11/2019 Managing Director (1) • Deadline forannual balance
31.12. ■ Capital: €35,000 Corporate Purpase
Zb Nov 2019
Registration 22/11/2019 MO- (1) Address Deadline for snnual balance- 31.12
Capital: €35,000 ■ Seat , Austria _
The information that the complainant is no longer the managing director of can be
found on the Respondent's homepage from the information that the company has been dissolved, which
is indicated by the entry ‘Termination’ on the timeline of the company or by a Cross sign (†) is displayed
behind the name of the company (as of screenshot 12 June 2025):
-4–
, ,
B Dossier n Watch
NAME
"
IDENTIFICATION
ADDRESS
, Austria
CORPORATE PURPOSE
Services in automatic data processing, information technology and telecommunications
HISTORY
Registration ⁇ Capital: €35,000 ⁇ MD Termination
2020 2021 2022
The complainant requested the deletion of the information on his personal data in the database on 9
March 2023. The respondent refused to delete the information on the same day.
Evidence assessment: The findings are based on the submission of the Complainant, the
investigation of the Hamburg Commissioner for Data Protection and Freedom of Information and an
official search of the Data Protection Authority on the Respondent's website
D. From a legal point of view, it follows that:
General information on cross-border procedures
The complaint at issue concerns a situation which is not the sole responsibility of the Austrian Data
Protection Authority (cf. Articles 56 and 60 GDPR).
In the present proceedings, the Hamburg Commissioner for Data Protection and Freedom of Information
is thus responsible for the leading responsibility of the supervisory authority in whose jurisdiction the
respondent has its main establishment or sole establishment (cf. Article 56(1) GDPR). The lead
supervisory authority must submit a draft decision to the other supervisory authorities concerned for their
opinion; in the event of a rejection or rejection of a complaint, the supervisory authority to which the
complaint has been lodged must adopt the decision and notify the complainant (see Article 60(3) and
(8) GDPR).
In the matter
Pursuant to Article 17(1)(c), Article 17(3)(a), Article 21(1) of the GDPR, the data subject has the right to
request the erasure of personal data concerning him or her if the data subject objects to the processing
pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing.
This is particularly the case if there are compelling legitimate grounds for the processing that outweigh
the interests, rights and freedoms of the data subject.
-5–
The complainant was the managing director of an Austrian limited liability company ( . As such,
he was the authorised representative of the company, which could have contractual relations with third
parties in the context of their respective (business) activities.
The commercial register is public according to § 10 UGB (German Commercial Code) and everyone is
authorized to consult the commercial register according to § 9 UGB (German Commercial Code). The
purpose of the disclosure of the register data is to be able to inform all interested third parties without
them having to prove a right or interest worthy of protection (cf. CJEU, judgment of 9 March 2017, C-
398/15). Third parties, e.g. when entering into business (contractual) relations with a company, must be
able to verify the power of representation of the natural person with whom they come into contact.
The company register thus has the function of making transparent to third parties, such as contractual
partners, who is the (natural) person acting on behalf of legal persons, such as representatives.
Consequently, there is a general interest in the publication of company register information, also with
regard to the role of the complainant as a (sole) legal representative.
This also applies to dissolved corporations such as the Austrian limited liability company ( ).
Former business partners and creditors may have claims against the company that become known only
after the company has ended. Accordingly, claims against a terminated company may arise in the future.
The limitation period for compensation/damage claims, e.g. for claims of the company against a
managing director, is five years (§ 25 para. 6 GmbHG). These claims can be asserted by (former)
business partners and creditors of the company. At least for this period of five years, there is a high
public interest in having access to information about the person of the complainant as managing director
of the company.
The Hamburg Commissioner for Data Protection and Freedom of Information considers that this interest
in information outweighs the complainant's interest in preventing his name and role as former managing
director of the dissolved from becoming publicly visible in connection with his name.
Following the termination of the complainant’s post as Managing Director of on 19
July 2022, there is still a high level of public interest in the information about him. The respondent has a
legitimate interest under Article 6(1)(f) GDPR in the provision of publicly available company register data
to the interested public in the context of its business activities and freedom to conduct a business. Only
the name, country of residence and the position of the complainant as (former) managing director are
listed in the overviews of controllers. His place of residence or other residential information as well as
details of his date of birth, which are published in the company register entry, are not shown in the freely
accessible overviews of the respondent. The Respondent's interference with the complainant's rights is
minor, as the information is already publicly available.
Even if the material scope of the GDPR is opened, the legitimate public interest and the interest of the
respondent in the processing of publicly available company register data outweigh the interests of the
-6–
complainant.
The Data Protection Authority points out that this is in line with the current case law of the Data Protection
Authority (cf. e.g. decision of 8 October 2021 on ref. 2021-0.698.184) published in the RIS.
It was appropriate to decide.
LEGAL AFFAIRS
This decision may be appealed in writing to the Federal Administrative Court within four weeks of
service. The complaint must be submitted to the Data Protection Authority and must:
- the name of the contested decision (CJ, subject)
- the name of the respondent authority;
- the grounds on which the allegation of illegality is based;
- Desire and
- contain the information necessary to assess whether the complaint has been lodged in a timely
manner.
The data protection authority may, within two months, either amend its decision by means of a
preliminary decision on the complaint or submit the complaint with the files of the proceedings
to the Federal Administrative Court.
The complaint against this decision is subject to a fee. The fixed fee for such an entry, including
supplements, shall be EUR 30. The fee must be paid to the account of the Austrian Tax Office, stating
the intended purpose.
In principle, the fee must be paid electronically using the ‘Finance Office payment’ function. The recipient
must be the Austrian Tax Office - Service for Special Responsibilities (IBAN: AT83 0100 0000
0550 4109, BIC: BUNDATWW). Furthermore, they are
Tax number/tax account number 10 999/9102, type of tax ‘EEA-complaint fee’, the date of the decision
as a period and the amount.
If the e-banking system of your credit institution does not have the function ‘Finance Office payment’,
the eps procedure can be used in FinanzOnline. An electronic transfer can only be excluded if no e-
banking system has been used so far (even if the taxpayer has an internet connection). Then the
payment must be made by means of a payment order, paying attention to the correct allocation. Further
information can be obtained from the tax office and from the manual ‘Electronicpayment and notification
of payment of self-assessment levies’.
The payment of the fee must be proved when the complaint is lodged with the data protection
authority by means of a proof of payment to be attached to the submission or a print-out of the payment
order issued. If the fee is not paid or not paid in full, a report shall be sent to the competent tax office.
-7–
A timely and admissible appeal to the Federal Administrative Court shall have suspensive effect. The
suspensive effect may have been excluded in the ruling of the decision or may be excluded by a separate
decision.