The Hamburg Commissioner for
Data Protection and Freedom of Information
Hamburg, 22 September 2025
IMI Reference No. A60IC 654130, A60DD 794029, A60FD 828463
National Reference Number: E/01.01-739/2024
In the matter of a complaint, lodged by , Spain, with the Hamburg
Commissioner for Data Protection and Freedom of Information pursuant to Article 77 of
the General Data Protection Regulation, concerning North Data GmbH
FINAL DECISION
The Hamburg Commissioner for Data Protection and Freedom of Information (“Hamburg SA”)
hereby issues the following decision for the complaint lodged on 9 February 2024 with the Ger-
man Federal Commissioner for Data Protection and Freedom of Information by
, SPAIN [“Complainant”]
against
North Data GmbH, Hermannstraße 22, D-20095 Hamburg, GERMANY [“Controller”]
regarding an alleged violation of personal data:
Decision
The complaint is hereby dismissed.
The controller has not been found in breach of data protection law.
www.datenschutz-hamburg.de
E-Mail: [email protected]
Confidential information should be transmitted to us by electronic means only in encrypted form.
The public PGP-key is available on the internet (Fingerprint: 0932 579B 33C1 8C21 6C9D E77D 08DD BAE4 3377 5707).
The Hamburg Commissioner for
Data Protection and Freedom of Information
Legal grounds: Art. 5 (1) lit. d GDPR, Art. 17 (1), Art. 17 (3) lit. a GDPR, Art. 21 (1) GDPR
Reasoning
The complainant lodged a complaint with the German Federal Commissioner for Data Protection
and Freedom of Information on 9 February 2024, as the controller had allegedly violated his right
to data erasure.
As a cross-border complaint, this case is to be handled in accordance with Art. 60 GDPR. As the
controller is based in Hamburg, Germany, the lead supervisory authority is the Commissioner for
Data Protection in Hamburg in accordance with Art. 56 (1) GDPR.
The complainant is representative of several companies with limited liability (Sociedades de re-
sponsabilidad limitada), S.L.’s in Spain and Great Britain. The controller, North Data GmbH, re-
produces current and former commercial register information in an online-database. When enter-
ing his name in the controller’s database Website ),
the information regarding the complainant is displayed in a list, showing entries under his name
in the Commercial Register in London and in Spain and under his (former)
name in Spain.
–2–
The Hamburg Commissioner for
Data Protection and Freedom of Information
When opening the entry , London
, his relations are shown to the following companies:
. (as director)
. (as director)
When opening the entry Spain
companies:
SL (as officer)
SL (as director)
SL (as director)
SL (as director)
SL (as director).
North Data depicts these relations in a graphic overview:
–3–
The Hamburg Commissioner for
Data Protection and Freedom of Information
Moreover, the controller shows the complainant’s relations under the name of
) to
(as director)
(as director),
(as director)
SL (as director)
SL (as director)
(as director)
–4–
The Hamburg Commissioner for
Data Protection and Freedom of Information
SL (as director)
in graphic overviews:
–5–
The Hamburg Commissioner for
Data Protection and Freedom of Information
–6–
The Hamburg Commissioner for
Data Protection and Freedom of Information
The overviews include the company’s names, register numbers and the address of the company’s
registered offices as well as the name and surname of the complainant as authorised representa-
tive. Moreover, extracts of the Spanish commercial register entries concerning the complainant
are depicted, see e.g. :
On 9 February 2024, the complainant requested deletion of the information regarding his person
or the companies he is authorised representative/administrator of (amongst others,
and , SL), stating the information caused serios reputa-
tional damage. The controller refused to delete the information the same day.
–7–
The Hamburg Commissioner for
Data Protection and Freedom of Information
Hamburg SA heard the controller concerning the information about the complainant depicted with
regard to SL and with regard to
SL as in the overviews information about the complainant’s (sole)
ownership of the corporations where published (“socio único”). The controller deleted the infor-
mation about the complainant’s (sole) ownership and his role as sole director, accordingly. With
regard to SL the controller does not show any reference
to the person of the complainant
in the freely accessible database.
The complainant is of the opinion that the controller is obliged to delete all the information about
himself and the companies he is director / officer of.
According to Art. 17 (1) lit. c, Art. 17 (3) lit. a, Art. 21 (1) GDPR the data subject has a right to
demand erasure of personal data concerning him or her when the data subject objects to the
processing in accordance with Art. 21 (1) GDPR and there are no overriding legitimate grounds
for the processing. This is especially the case when there are compelling legitimate grounds for
the processing which override the interests, rights and freedoms of the data subject.
With regard to the register information about the complainant depicted by the controller there are
overriding legitimate grounds for the processing. The controller can base processing of the data
on Art. 6 (1) lit. f GDPR. There are moreover compelling legitimate grounds for the processing
which override the interests, rights and freedoms of the complainant (see Art. 21 (1) GDPR).
The public register has the function to make transparent for third persons, such as contract part-
ners, who is the (natural) person acting on behalf of the company. Third persons contracting with
the companies on behalf of which he is acting can have a legitimate interest in knowing who is
the authorised representative of the company.
The controller’s processing is in line with the aims of the Directive (EU) 2019/1024 on open data
and the reuse of public-sector information and of the Directive (EU) 2019/1151 on the use of
digital tools and processes in company law. The controller, thus, has a legitimate interest in pro-
cessing the data.
The Open Data Directive (EU) 2019/1024 for government bodies aims to support the reuse of
documents that are associated with important socio-economic benefits and are of particularly high
–8–
The Hamburg Commissioner for
Data Protection and Freedom of Information
value for the economy and society. This should also include data from the company register
(companies and ownership structures of companies) (recital 66 Open Data Directive). The aim is
also to facilitate the further use of data qualified as open data by third parties, as this supports
developers and start-ups in the development of new services and products (recitals 32 and 9 ff.
Open Data Directive). To this end, the EU legislator recommends to the member states:
“Dynamic data […] shall be made available via an application programming interface
(hereinafter “API”) immediately after collection or, in the case of a manual update,
immediately after modification of the data set, in order to enable Internet, mobile and
cloud development - Facilitate applications based on such data. If this is not possible
due to technical or financial limitations, public bodies should make the documents
available within a period that allows their full economic potential to be exploited."
(recital 31 Open Data Directive).
According to the Implementing Regulation (EU) 2023/138 register data containing basic company
information and company ownership information are to be considered high quality data sets. The
Implementing Regulation aims to maximise the availability and usability of public data to achieve
economic, social and environmental benefits, increase administrative efficiency and improve the
transparency and accountability of public bodies.
The Digitalisation Directive (EU) 2019/1151 moreover, aims at making register information easier
to be found and used for investors, stakeholders and business partners, among others, by storing
it by registers in a machine-readable and searchable format or as structured data. This is intended
to enable software applications to easily identify, recognize and extract concrete data and its
internal structure. This also expressly includes information about the persons who are authorized
to represent the company as a body or as members of a corresponding body (recitals 27 and 30
Digitalisation Directive).
Consequently, the information about the complainant as authorised representative of the compa-
nies is provided online for reuse and for the development of new services and products by the
registers (in Spain https://opendata.registradores.org/, see e.g.
), where the infor-
mation about the complainant can be found without any restrictions to access (e.g. proof of a
legitimate interest) or need for identification of the person accessing the data.
–9–
The Hamburg Commissioner for
Data Protection and Freedom of Information
Likewise, the UK Companies House publishes information about the complainant regarding the
companies he is director of that are registered in the UK (see
and
).
This interest in information overweighs the complainant’s interest in preventing his name from
becoming publicly visible in relation to the companies he acts as representative/director of. The
Spanish commercial register information (Registro Mercantil Central ) is publicly available, so that
any person can have access. Information published in the commercial register, thus, is less wor-
thy of protection.
The controller’s aim to increase transparency with regard to company register information and to
offer easy access to information about the companies and its authorised representative is in the
interest of (former) contract partners or other persons who were in contact with the LLP in the
context of its business activities.
In the balancing test under Art. 6 (1) f GDPR, the complainant’s fundamental rights to respect for
his private life and protection of personal data (Art. 7 and Art. 8 CFR) cannot be determined to
predominate over the public interest in information (Art. 11 CFR) and the controller’s freedom to
conduct its business (Art. 16 CFR).
It has to be taken into consideration that the function to show information about company repre-
sentatives by searching for their names in the controller’s public register search engine and the
fact that the controller’s websites are shown when searching for the representative’s names in an
online search engine, leads to an easier public findability than it is the case when information
about company representatives can only be found by searching for the company’s name in an
internet search engine or in the relevant register’s search engine. This increases the impairment
of the complainant’s fundamental rights.
This increase in the impairment, though, does not have the effect that the complainant’s rights
would automatically, nor in this specific case overweigh the public interest in information and the
controller’s right to conduct its business.
The information about the complainant’s function as director of several companies does not touch
the core of the complainant’s fundamental rights. There is no indication that the information about
– 10 –
The Hamburg Commissioner for
Data Protection and Freedom of Information
the companies refers in any way to information of a personal, private nature, providing information
about his private life, e.g. his private place of residence. The information rather only refers to his
professional activity, thus. The controller, moreover, only publishes information about the com-
plainant that is subject to compulsory disclosure and, thus, relevant e.g. for contracting partners
(see also CJEU, judgment of 4 October 2024 C 200/23).
In the case at hand, there are overriding legitimate grounds for the processing. The complainant
is authorized representative / director and as such, represents the companies when they are
entering into contractual relations with third persons, within the scope of their respective (busi-
ness) activities. The commercial register has the function to make transparent for third persons,
such as contract partners, who is the (natural) person acting as representative on behalf of legal
entities. As a consequence, a general interest in the publication of commercial register infor-
mation, also with regard to the complainant’s role as legal representative, has to be assumed.
The controller, through its services, reveals other information that may be of relevance for con-
tractual partners and creditors of the companies the complainant is director of. Potential contrac-
tual partners (e.g. creditors or employees) may, for example be interested in the fact that he is
director of a large number of companies, partly with similar corporate purposes.
From the controller’s overviews it moreover becomes clear that the complainant, in the past had
acted as representative under the name of , whereas today he
is acting as representative under the name of . The information that he has
changed his name may be of interest for any creditors that may have claims against the com-
plainant due to any acting as a business representative under his former name.
Even if the material scope of the GDPR is opened, thus, the legitimate interest of the controller in
processing publicly available information would not be outweighed here by interests of the com-
plainant.
A violation of data protection law cannot be determined.
The complaint is therefore dismissed.
Hamburg, 22 September 2025
on behalf of Hamburg SA
– 11 –
The Hamburg Commissioner for
Data Protection and Freedom of Information
Legal appeal:
An action against this decision can be filed with the Hamburg Administrative Court (Lübeckertor-
damm 4, 20099 Hamburg) within one month of its announcement.
– 12 –