{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-200-23-62023cj0200","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-200-23-62023cj0200)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-15","fingerprint":"ewai:eu:8d311e","proof":"sha256:bddeb1f675e37382872615c96ec9c5fac137a1337258824ed9fbe796a44c0b80","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-200-23-62023cj0200","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62023CJ0200","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (First Chamber)","paragraphs":[]},{"title":"4 October 2024 (\n *1\n )","paragraphs":["para_4","para_5","para_6"]},{"title":"Agentsia po vpisvaniyata","paragraphs":["para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27","para_28","para_29","para_30","para_31","para_32","para_33","para_34","para_35","para_36","para_37"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_40"]},{"title":"2","paragraphs":["para_42"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"Directive (EU) 2017/1132","paragraphs":[]},{"title":"3","paragraphs":["para_47"]},{"title":"4","paragraphs":[]},{"title":"Recitals 1, 7, 8 and 12 of Directive 2017/1132 state:","paragraphs":["para_50","para_51","para_52"]},{"title":"(7)","paragraphs":["para_54"]},{"title":"(8)","paragraphs":["para_56","para_57"]},{"title":"(12)","paragraphs":["para_59"]},{"title":"5","paragraphs":["para_61","para_62","para_63"]},{"title":"(i)","paragraphs":["para_65","para_66"]},{"title":"6","paragraphs":["para_68"]},{"title":"7","paragraphs":[]},{"title":"Under Article 13 of that directive, entitled ‘Scope’:","paragraphs":["para_71"]},{"title":"8","paragraphs":["para_73","para_74"]},{"title":"(a)","paragraphs":["para_76"]},{"title":"(b)","paragraphs":["para_78"]},{"title":"(c)","paragraphs":["para_80"]},{"title":"(d)","paragraphs":["para_82"]},{"title":"(i)","paragraphs":["para_84"]},{"title":"(ii)","paragraphs":["para_86","para_87"]},{"title":"9","paragraphs":["para_89","para_90"]},{"title":"10","paragraphs":[]},{"title":"Under Article 16 of that directive, entitled ‘Disclosure in the register’:","paragraphs":["para_93","para_94","para_95","para_96","para_97","para_98","para_99","para_100","para_101","para_102","para_103","para_104","para_105","para_106","para_107"]},{"title":"11","paragraphs":["para_109","para_110","para_111","para_112","para_113","para_114","para_115","para_116"]},{"title":"12","paragraphs":[]},{"title":"Under Article 161 of that directive, entitled ‘Data protection’:","paragraphs":["para_119"]},{"title":"13","paragraphs":[]},{"title":"Article 166 of that directive, headed ‘Repeal’, provides:","paragraphs":["para_122","para_123"]},{"title":"14","paragraphs":["para_125"]},{"title":"15","paragraphs":["para_127"]},{"title":"Directive (EU) 2019/1151","paragraphs":[]},{"title":"16","paragraphs":["para_130","para_131","para_132"]},{"title":"(6) Article 16 is replaced by the following:","paragraphs":["para_134"]},{"title":"Disclosure in the register","paragraphs":["para_136","para_137","para_138","para_139","para_140","para_141","para_142","para_143","para_144","para_145","para_146","para_147"]},{"title":"(7) the following Article is inserted:","paragraphs":["para_149"]},{"title":"Access to disclosed information","paragraphs":["para_151","para_152"]},{"title":"(19) Article 161 is replaced by the following:","paragraphs":["para_154"]},{"title":"Data protection","paragraphs":["para_156"]},{"title":"17","paragraphs":[]},{"title":"Article 2 of Directive 2019/1151, entitled ‘Transposition’, provides:","paragraphs":["para_159","para_160","para_161","para_162"]},{"title":"The GDPR","paragraphs":[]},{"title":"18","paragraphs":[]},{"title":"Recitals 26, 32, 40, 42, 43, 50, 85, 143 and 146 of the GDPR state:","paragraphs":["para_166","para_167","para_168"]},{"title":"(32)","paragraphs":["para_170","para_171"]},{"title":"(40)","paragraphs":["para_173","para_174"]},{"title":"(42)","paragraphs":["para_176"]},{"title":"(43)","paragraphs":["para_178","para_179"]},{"title":"(50)","paragraphs":["para_181","para_182"]},{"title":"(85)","paragraphs":["para_184","para_185"]},{"title":"(143)","paragraphs":["para_187","para_188"]},{"title":"(146)","paragraphs":["para_190"]},{"title":"19","paragraphs":[]},{"title":"Article 4 of the GDPR, entitled ‘Definitions’, provides:","paragraphs":["para_193"]},{"title":"(1)","paragraphs":["para_195"]},{"title":"(2)","paragraphs":["para_197","para_198"]},{"title":"(7)","paragraphs":["para_200","para_201"]},{"title":"(9)","paragraphs":["para_203","para_204"]},{"title":"(11)","paragraphs":["para_206","para_207"]},{"title":"20","paragraphs":["para_209","para_210","para_211"]},{"title":"(b)","paragraphs":["para_213"]},{"title":"(c)","paragraphs":["para_215","para_216","para_217"]},{"title":"21","paragraphs":[]},{"title":"Under Article 6 of the GDPR, entitled ‘Lawfulness of processing’:","paragraphs":["para_220"]},{"title":"(a)","paragraphs":["para_222","para_223"]},{"title":"(c)","paragraphs":["para_225","para_226"]},{"title":"(e)","paragraphs":["para_228","para_229","para_230"]},{"title":"(a)","paragraphs":[]},{"title":"Union law; or","paragraphs":[]},{"title":"(b)","paragraphs":["para_234","para_235","para_236"]},{"title":"22","paragraphs":[]},{"title":"Article 17 of the GDPR, entitled ‘Right to erasure (“right to be forgotten”), provides:","paragraphs":["para_239"]},{"title":"(a)","paragraphs":["para_241"]},{"title":"(b)","paragraphs":["para_243"]},{"title":"(c)","paragraphs":["para_245"]},{"title":"(d)","paragraphs":["para_247","para_248"]},{"title":"3.   Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:","paragraphs":["para_250"]},{"title":"(b)","paragraphs":["para_252","para_253"]},{"title":"23","paragraphs":[]},{"title":"Article 21(1) of the GDPR is worded as follows:","paragraphs":["para_256"]},{"title":"24","paragraphs":[]},{"title":"Article 58 of the GDPR provides:","paragraphs":["para_259","para_260"]},{"title":"2.   Each supervisory authority shall have all of the following corrective powers:","paragraphs":["para_262","para_263","para_264"]},{"title":"(b)","paragraphs":["para_266","para_267","para_268","para_269","para_270"]},{"title":"25","paragraphs":[]},{"title":"Under Article 82 of the GDPR, entitled ‘Right to compensation and liability’:","paragraphs":["para_273","para_274","para_275","para_276"]},{"title":"26","paragraphs":[]},{"title":"Article 94 of the GDPR provides:","paragraphs":["para_279","para_280"]},{"title":"Bulgarian law","paragraphs":[]},{"title":"The Law on the registers","paragraphs":[]},{"title":"27","paragraphs":["para_284","para_285","para_286"]},{"title":"28","paragraphs":[]},{"title":"Article 3 of that law provides:","paragraphs":["para_289"]},{"title":"29","paragraphs":[]},{"title":"Article 6(1) of that law lays down:","paragraphs":["para_292"]},{"title":"30","paragraphs":[]},{"title":"Article 11 of that law is worded as follows:","paragraphs":["para_295","para_296"]},{"title":"31","paragraphs":[]},{"title":"Article 13(1), (2), (6) and (9) of the Law on the registers provides:","paragraphs":["para_299"]},{"title":"(2)   The application shall contain:","paragraphs":[]},{"title":"1. the contact details of the applicant;","paragraphs":["para_302","para_303","para_304","para_305","para_306","para_307","para_308"]},{"title":"The Commercial Code","paragraphs":[]},{"title":"32","paragraphs":["para_311"]},{"title":"33","paragraphs":[]},{"title":"As set out in Article 119 of the Commercial Code:","paragraphs":["para_314","para_315","para_316"]},{"title":"2.   The data referred to in point 1 … shall be entered in the register …","paragraphs":["para_318","para_319","para_320"]},{"title":"34","paragraphs":["para_322","para_323"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"35","paragraphs":["para_326"]},{"title":"36","paragraphs":["para_328"]},{"title":"37","paragraphs":["para_330"]},{"title":"38","paragraphs":["para_332"]},{"title":"39","paragraphs":["para_334"]},{"title":"40","paragraphs":["para_336"]},{"title":"41","paragraphs":["para_338"]},{"title":"42","paragraphs":["para_340"]},{"title":"43","paragraphs":["para_342"]},{"title":"44","paragraphs":["para_344"]},{"title":"45","paragraphs":["para_346"]},{"title":"46","paragraphs":["para_348","para_349","para_350"]},{"title":"(2)","paragraphs":["para_352"]},{"title":"(3)","paragraphs":["para_354"]},{"title":"(4)","paragraphs":["para_356"]},{"title":"(5)","paragraphs":["para_358"]},{"title":"(6)","paragraphs":["para_360"]},{"title":"(7)","paragraphs":["para_362"]},{"title":"(8)","paragraphs":["para_364"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"Preliminary observations","paragraphs":[]},{"title":"47","paragraphs":["para_368"]},{"title":"48","paragraphs":["para_370"]},{"title":"49","paragraphs":["para_372"]},{"title":"The first question","paragraphs":[]},{"title":"50","paragraphs":["para_375"]},{"title":"51","paragraphs":["para_377"]},{"title":"52","paragraphs":["para_379"]},{"title":"53","paragraphs":["para_381"]},{"title":"54","paragraphs":["para_383"]},{"title":"55","paragraphs":["para_385"]},{"title":"56","paragraphs":["para_387"]},{"title":"57","paragraphs":["para_389"]},{"title":"58","paragraphs":["para_391"]},{"title":"59","paragraphs":["para_393"]},{"title":"60","paragraphs":["para_395"]},{"title":"The second and third questions","paragraphs":[]},{"title":"61","paragraphs":["para_398"]},{"title":"The fifth question","paragraphs":[]},{"title":"62","paragraphs":["para_401"]},{"title":"63","paragraphs":["para_403"]},{"title":"64","paragraphs":["para_405"]},{"title":"65","paragraphs":["para_407"]},{"title":"66","paragraphs":["para_409"]},{"title":"67","paragraphs":["para_411"]},{"title":"68","paragraphs":["para_413"]},{"title":"69","paragraphs":["para_415"]},{"title":"70","paragraphs":["para_417"]},{"title":"71","paragraphs":["para_419"]},{"title":"72","paragraphs":["para_421"]},{"title":"73","paragraphs":["para_423"]},{"title":"74","paragraphs":["para_425"]},{"title":"75","paragraphs":["para_427"]},{"title":"76","paragraphs":["para_429"]},{"title":"77","paragraphs":["para_431"]},{"title":"78","paragraphs":["para_433"]},{"title":"79","paragraphs":["para_435"]},{"title":"80","paragraphs":["para_437"]},{"title":"81","paragraphs":["para_439"]},{"title":"82","paragraphs":["para_441"]},{"title":"83","paragraphs":["para_443"]},{"title":"The fourth question","paragraphs":[]},{"title":"Admissibility","paragraphs":[]},{"title":"84","paragraphs":["para_447"]},{"title":"85","paragraphs":["para_449"]},{"title":"86","paragraphs":["para_451"]},{"title":"87","paragraphs":["para_453"]},{"title":"88","paragraphs":["para_455"]},{"title":"Substance","paragraphs":[]},{"title":"89","paragraphs":["para_458"]},{"title":"90","paragraphs":["para_460"]},{"title":"91","paragraphs":["para_462"]},{"title":"92","paragraphs":["para_464"]},{"title":"93","paragraphs":["para_466"]},{"title":"94","paragraphs":["para_468"]},{"title":"95","paragraphs":["para_470"]},{"title":"96","paragraphs":["para_472"]},{"title":"97","paragraphs":["para_474"]},{"title":"98","paragraphs":["para_476"]},{"title":"99","paragraphs":["para_478"]},{"title":"100","paragraphs":["para_480"]},{"title":"101","paragraphs":["para_482"]},{"title":"102","paragraphs":["para_484"]},{"title":"103","paragraphs":["para_486"]},{"title":"104","paragraphs":["para_488"]},{"title":"105","paragraphs":["para_490"]},{"title":"106","paragraphs":["para_492"]},{"title":"107","paragraphs":["para_494"]},{"title":"108","paragraphs":["para_496"]},{"title":"109","paragraphs":["para_498"]},{"title":"110","paragraphs":["para_500"]},{"title":"111","paragraphs":["para_502"]},{"title":"112","paragraphs":["para_504"]},{"title":"113","paragraphs":["para_506"]},{"title":"114","paragraphs":["para_508"]},{"title":"115","paragraphs":["para_510"]},{"title":"116","paragraphs":["para_512"]},{"title":"117","paragraphs":["para_514"]},{"title":"118","paragraphs":["para_516"]},{"title":"119","paragraphs":["para_518"]},{"title":"120","paragraphs":["para_520"]},{"title":"121","paragraphs":["para_522"]},{"title":"122","paragraphs":["para_524"]},{"title":"123","paragraphs":["para_526"]},{"title":"124","paragraphs":["para_528"]},{"title":"125","paragraphs":["para_530"]},{"title":"126","paragraphs":["para_532"]},{"title":"127","paragraphs":["para_534"]},{"title":"The sixth question","paragraphs":[]},{"title":"128","paragraphs":["para_537"]},{"title":"129","paragraphs":["para_539"]},{"title":"130","paragraphs":["para_541"]},{"title":"131","paragraphs":["para_543"]},{"title":"132","paragraphs":["para_545"]},{"title":"133","paragraphs":["para_547"]},{"title":"134","paragraphs":["para_549"]},{"title":"135","paragraphs":["para_551"]},{"title":"136","paragraphs":["para_553"]},{"title":"The seventh question","paragraphs":[]},{"title":"137","paragraphs":["para_556"]},{"title":"138","paragraphs":["para_558"]},{"title":"139","paragraphs":["para_560"]},{"title":"140","paragraphs":["para_562"]},{"title":"141","paragraphs":["para_564"]},{"title":"142","paragraphs":["para_566"]},{"title":"143","paragraphs":["para_568"]},{"title":"144","paragraphs":["para_570"]},{"title":"145","paragraphs":["para_572"]},{"title":"146","paragraphs":["para_574"]},{"title":"147","paragraphs":["para_576"]},{"title":"148","paragraphs":["para_578"]},{"title":"149","paragraphs":["para_580"]},{"title":"150","paragraphs":["para_582"]},{"title":"151","paragraphs":["para_584"]},{"title":"152","paragraphs":["para_586"]},{"title":"153","paragraphs":["para_588"]},{"title":"154","paragraphs":["para_590"]},{"title":"155","paragraphs":["para_592"]},{"title":"156","paragraphs":["para_594"]},{"title":"The eighth question","paragraphs":[]},{"title":"157","paragraphs":["para_597"]},{"title":"158","paragraphs":["para_599"]},{"title":"159","paragraphs":["para_601"]},{"title":"160","paragraphs":["para_603"]},{"title":"161","paragraphs":["para_605"]},{"title":"162","paragraphs":["para_607"]},{"title":"163","paragraphs":["para_609"]},{"title":"164","paragraphs":["para_611"]},{"title":"165","paragraphs":["para_613"]},{"title":"166","paragraphs":["para_615"]},{"title":"167","paragraphs":["para_617"]},{"title":"168","paragraphs":["para_619"]},{"title":"169","paragraphs":["para_621"]},{"title":"170","paragraphs":["para_623"]},{"title":"171","paragraphs":["para_625"]},{"title":"172","paragraphs":["para_627"]},{"title":"173","paragraphs":["para_629"]},{"title":"174","paragraphs":["para_631"]},{"title":"175","paragraphs":["para_633"]},{"title":"176","paragraphs":["para_635"]},{"title":"Costs","paragraphs":[]},{"title":"177","paragraphs":["para_638"]},{"title":"On those grounds, the Court (First Chamber) hereby rules:","paragraphs":["para_640","para_641","para_642","para_643","para_644","para_645","para_646","para_647","para_648","para_649"]},{"title":"Article 4(1) of Regulation 2016/679","paragraphs":["para_651","para_652"]},{"title":"Article 82(1) of Regulation 2016/679","paragraphs":["para_654","para_655"]},{"title":"Article 82(3) of Regulation 2016/679","paragraphs":["para_657","para_658","para_659"]}],"paragraphs":[{"text":"62023CJ0200","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (First Chamber)","paragraph_id":"para_2"},{"text":"4 October 2024 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Publication in the commercial register of a company’s constitutive instrument containing personal data – Directive (EU) 2017/1132 – Non-compulsory personal data – Lack of consent of the data subject – Right to erasure – Non-material damage)","paragraph_id":"para_4"},{"text":"In Case C‑200/23,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Varhoven administrativen sad (Supreme Administrative Court, Bulgaria), made by decision of 21 March 2023, received at the Court on 28 March 2023, in the proceedings","paragraph_id":"para_6"},{"text":"Agentsia po vpisvaniyata","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"OL,","paragraph_id":"para_9"},{"text":"intervening party:","paragraph_id":"para_10"},{"text":"Varhovna administrativna prokuratura,","paragraph_id":"para_11"},{"text":"THE COURT (First Chamber),","paragraph_id":"para_12"},{"text":"composed of A. Arabadjiev, President of the Chamber, T. von Danwitz (Rapporteur), P.G. Xuereb, A. Kumin and I. Ziemele, Judges,","paragraph_id":"para_13"},{"text":"Advocate General: L. Medina,","paragraph_id":"para_14"},{"text":"Registrar: R. Stefanova-Kamisheva, Administrator,","paragraph_id":"para_15"},{"text":"having regard to the written procedure and further to the hearing on 7 March 2024,","paragraph_id":"para_16"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"Agentsia po vpisvaniyata, by I.D. Ivanov and D.S. Miteva, and by Z.N. Mandazhieva, advokat,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"OL, acting on her own behalf, and by I. Stoynev and T. Tsonev, advokati,","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the Bulgarian Government, by T. Mitova and R. Stoyanov, acting as Agents,","paragraph_id":"para_23"},{"text":"–","paragraph_id":"para_24"},{"text":"the German Government, by J. Möller and P.-L. Krüger, acting as Agents,","paragraph_id":"para_25"},{"text":"–","paragraph_id":"para_26"},{"text":"Ireland, by M. Browne, Chief State Solicitor, A. Joyce, M. Lane and M. Tierney, acting as Agents, and by I. Boyle Harper, Barrister-at-Law,","paragraph_id":"para_27"},{"text":"–","paragraph_id":"para_28"},{"text":"the Italian Government, by G. Palmieri, acting as Agent, and by G. Natale, avvocato dello Stato,","paragraph_id":"para_29"},{"text":"–","paragraph_id":"para_30"},{"text":"the Polish Government, by B. Majczyna, acting as Agent,","paragraph_id":"para_31"},{"text":"–","paragraph_id":"para_32"},{"text":"the Finnish Government, by A. Laine, acting as Agent,","paragraph_id":"para_33"},{"text":"–","paragraph_id":"para_34"},{"text":"the European Commission, by A. Bouchagiar, C. Georgieva, H. Kranenborg and L. Malferrari, acting as Agents,","paragraph_id":"para_35"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 30 May 2024,","paragraph_id":"para_36"},{"text":"gives the following","paragraph_id":"para_37"},{"text":"Judgment","paragraph_id":"para_38"},{"text":"1","paragraph_id":"para_39"},{"text":"This request for a preliminary ruling concerns the interpretation of Articles 3 and 4 of Directive 2009/101/EC of the European Parliament and of the Council of 16 September 2009 on coordination of safeguards which, for the protection of the interests of members and third parties, are required by Mem …","paragraph_id":"para_40"},{"text":"2","paragraph_id":"para_41"},{"text":"The request was made in proceedings between the Agentsia po vpisvaniyata (Registration Agency, Bulgaria) (‘the Agency’) and OL concerning the Agency’s refusal to erase certain personal data relating to OL contained in a company’s constitutive instrument published in the commercial register.","paragraph_id":"para_42"},{"text":"Legal context","paragraph_id":"para_43"},{"text":"European Union law","paragraph_id":"para_44"},{"text":"Directive (EU) 2017/1132","paragraph_id":"para_45"},{"text":"3","paragraph_id":"para_46"},{"text":"Directive (EU) 2017/1132 of the European Parliament and of the Council of 14 June 2017 relating to certain aspects of company law ( OJ 2017 L 169, p. 46 ) repealed and replaced Directive 2009/101 as from its entry into force, namely 20 July 2017.","paragraph_id":"para_47"},{"text":"4","paragraph_id":"para_48"},{"text":"Recitals 1, 7, 8 and 12 of Directive 2017/1132 state:","paragraph_id":"para_49"},{"text":"‘(1)","paragraph_id":"para_50"},{"text":"… [Directive 2009/101] … and [Directive] 2012/30/EU of the European Parliament and of the Council [of 25 October 2012 on coordination of safeguards which, for the protection of the interests of members and others, are required by Member States of companies within the meaning of the second paragraph …","paragraph_id":"para_51"},{"text":"…","paragraph_id":"para_52"},{"text":"(7)","paragraph_id":"para_53"},{"text":"The coordination of national provisions concerning disclosure, the validity of obligations entered into by, and the nullity of, companies limited by shares or otherwise having limited liability, is of special importance, particularly for the purpose of protecting the interests of third parties.","paragraph_id":"para_54"},{"text":"(8)","paragraph_id":"para_55"},{"text":"The basic documents of a company should be disclosed in order for third parties to be able to ascertain their contents and other information concerning the company, especially particulars of the persons who are authorised to bind the company.","paragraph_id":"para_56"},{"text":"…","paragraph_id":"para_57"},{"text":"(12)","paragraph_id":"para_58"},{"text":"Cross-border access to company information should be facilitated by allowing, in addition to the compulsory disclosure made in one of the languages permitted in the company’s Member State, the voluntary registration in additional languages of the required documents and particulars. Third parties acting in good faith should be able to rely on the translations thereof.’","paragraph_id":"para_59"},{"text":"5","paragraph_id":"para_60"},{"text":"In Section 1 of Chapter II of Title I of Directive 2017/1132, entitled ‘Incorporation of the public liability company’, Article 4 of that directive, entitled ‘Compulsory information to be provided in the statutes or instruments of incorporation or separate documents’, provides:","paragraph_id":"para_61"},{"text":"‘The following information at least shall appear in either the statutes or the instrument of incorporation or a separate document published in accordance with the procedure laid down in the laws of each Member State in accordance with Article 16:","paragraph_id":"para_62"},{"text":"…","paragraph_id":"para_63"},{"text":"(i)","paragraph_id":"para_64"},{"text":"the identity of the natural or legal persons or companies or firms by which or in whose name the statutes or the instrument of incorporation, or where the company was not formed at the same time, the drafts of those documents, have been signed;","paragraph_id":"para_65"},{"text":"…’","paragraph_id":"para_66"},{"text":"6","paragraph_id":"para_67"},{"text":"Section 1 of Chapter III of Title I of that directive, headed ‘General provisions’, comprises Articles 13 to 28 thereof.","paragraph_id":"para_68"},{"text":"7","paragraph_id":"para_69"},{"text":"Under Article 13 of that directive, entitled ‘Scope’:","paragraph_id":"para_70"},{"text":"‘The coordination measures prescribed by this Section shall apply to the laws, regulations and administrative provisions of the Member States relating to the types of company listed in Annex II.’","paragraph_id":"para_71"},{"text":"8","paragraph_id":"para_72"},{"text":"Article 14 of Directive 2017/1132, entitled ‘Documents and particulars to be disclosed by companies’, provides:","paragraph_id":"para_73"},{"text":"‘Member States shall take the measures required to ensure compulsory disclosure by companies of at least the following documents and particulars:","paragraph_id":"para_74"},{"text":"(a)","paragraph_id":"para_75"},{"text":"the instrument of constitution, and the statutes if they are contained in a separate instrument;","paragraph_id":"para_76"},{"text":"(b)","paragraph_id":"para_77"},{"text":"any amendments to the instruments referred to in point (a), including any extension of the duration of the company;","paragraph_id":"para_78"},{"text":"(c)","paragraph_id":"para_79"},{"text":"after every amendment of the instrument of constitution or of the statutes, the complete text of the instrument or statutes as amended to date;","paragraph_id":"para_80"},{"text":"(d)","paragraph_id":"para_81"},{"text":"the appointment, termination of office and particulars of the persons who either as a body constituted pursuant to law or as members of any such body:","paragraph_id":"para_82"},{"text":"(i)","paragraph_id":"para_83"},{"text":"are authorised to represent the company in dealings with third parties and in legal proceedings; it shall be apparent from the disclosure whether the persons authorised to represent the company may do so alone or are required to act jointly;","paragraph_id":"para_84"},{"text":"(ii)","paragraph_id":"para_85"},{"text":"take part in the administration, supervision or control of the company;","paragraph_id":"para_86"},{"text":"…’","paragraph_id":"para_87"},{"text":"9","paragraph_id":"para_88"},{"text":"Article 15 of that directive, entitled ‘Changes in documents and particulars’, provides, in paragraph 1:","paragraph_id":"para_89"},{"text":"‘Member States shall take the measures required to ensure that any changes in the documents and particulars referred to in Article 14 are entered in the competent register referred to in the first subparagraph of Article 16(1) and are disclosed, in accordance with Article 16(3) and (5), normally within 21 days of receipt of the complete documentation regarding those changes including, if applicable, the legality check as required under national law for entry in the file.’","paragraph_id":"para_90"},{"text":"10","paragraph_id":"para_91"},{"text":"Under Article 16 of that directive, entitled ‘Disclosure in the register’:","paragraph_id":"para_92"},{"text":"‘1.   In each Member State, a file shall be opened in a central, commercial or companies register (“the register”), for each of the companies registered therein.","paragraph_id":"para_93"},{"text":"…","paragraph_id":"para_94"},{"text":"3.   All documents and particulars which are required to be disclosed pursuant to Article 14 shall be kept in the file, or entered in the register; the subject matter of the entries in the register shall in every case appear in the file.","paragraph_id":"para_95"},{"text":"Member States shall ensure that the filing by companies, as well as by other persons and bodies required to make or assist in making notifications, of all documents and particulars which are required to be disclosed pursuant to Article 14 is possible by electronic means. In addition, Member States may require all, or certain categories of, companies to file all, or certain types of, such documents and particulars by electronic means.","paragraph_id":"para_96"},{"text":"All documents and particulars referred to in Article 14 which are filed, whether by paper means or by electronic means, shall be kept in the file, or entered in the register, in electronic form. To this end, Member States shall ensure that all such documents and particulars which are filed by paper means are converted by the register to electronic form.","paragraph_id":"para_97"},{"text":"…","paragraph_id":"para_98"},{"text":"4.   A copy of all or any part of the documents or particulars referred to in Article 14 shall be obtainable on application. Applications may be submitted to the register by paper means or by electronic means as the applicant chooses.","paragraph_id":"para_99"},{"text":"…","paragraph_id":"para_100"},{"text":"5.   Disclosure of the documents and particulars referred to in paragraph 3 shall be effected by publication in the national gazette designated for that purpose by the Member State, either of the full text or of a partial text, or by means of a reference to the document which has been deposited in the file or entered in the register. The national gazette designated for that purpose may be kept in electronic form.","paragraph_id":"para_101"},{"text":"Member States may decide to replace publication in the national gazette with equally effective means, which shall entail at least the use of a system whereby the information disclosed can be accessed in chronological order through a central electronic platform.","paragraph_id":"para_102"},{"text":"6.   The documents and particulars may be relied on by the company as against third parties only after they have been disclosed in accordance with paragraph 5, unless the company proves that the third parties had knowledge thereof.","paragraph_id":"para_103"},{"text":"…","paragraph_id":"para_104"},{"text":"7.   Member States shall take the necessary measures to avoid any discrepancy between what is disclosed in accordance with paragraph 5 and what appears in the register or file.","paragraph_id":"para_105"},{"text":"However, in cases of discrepancy, the text disclosed in accordance with paragraph 5 may not be relied on as against third parties; such third parties may nevertheless rely thereon, unless the company proves that they had knowledge of the texts deposited in the file or entered in the register.","paragraph_id":"para_106"},{"text":"…’","paragraph_id":"para_107"},{"text":"11","paragraph_id":"para_108"},{"text":"Article 21 of Directive 2017/1132, entitled ‘Language of disclosure and translation of documents and particulars to be disclosed’, provides:","paragraph_id":"para_109"},{"text":"‘1.   Documents and particulars to be disclosed pursuant to Article 14 shall be drawn up and filed in one of the languages permitted by the language rules applicable in the Member State in which the file referred to in Article 16(1) is opened.","paragraph_id":"para_110"},{"text":"2.   In addition to the compulsory disclosure referred to in Article 16, Member States shall allow translations of documents and particulars referred to in Article 14 to be disclosed voluntarily in accordance with Article 16 in any official language(s) of the [European] Union.","paragraph_id":"para_111"},{"text":"Member States may prescribe that the translation of such documents and particulars be certified.","paragraph_id":"para_112"},{"text":"Member States shall take the necessary measures to facilitate access by third parties to the translations voluntarily disclosed.","paragraph_id":"para_113"},{"text":"3.   In addition to the compulsory disclosure referred to in Article 16, and to the voluntary disclosure provided for under paragraph 2 of this Article, Member States may allow the documents and particulars concerned to be disclosed, in accordance with Article 16, in any other language(s).","paragraph_id":"para_114"},{"text":"…","paragraph_id":"para_115"},{"text":"4.   In cases of discrepancy between the documents and particulars disclosed in the official languages of the register and the translation voluntarily disclosed, the latter may not be relied upon as against third parties. …’","paragraph_id":"para_116"},{"text":"12","paragraph_id":"para_117"},{"text":"Under Article 161 of that directive, entitled ‘Data protection’:","paragraph_id":"para_118"},{"text":"‘The processing of personal data carried out in the context of this Directive shall be subject to Directive 95/46/EC [of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 281, p. 31 )].’","paragraph_id":"para_119"},{"text":"13","paragraph_id":"para_120"},{"text":"Article 166 of that directive, headed ‘Repeal’, provides:","paragraph_id":"para_121"},{"text":"‘Directives … [2009/101] … and [2012/30] … are repealed …","paragraph_id":"para_122"},{"text":"References to the repealed Directives shall be construed as references to this Directive and shall be read in accordance with the correlation table in Annex IV.’","paragraph_id":"para_123"},{"text":"14","paragraph_id":"para_124"},{"text":"Annex II to Directive 2017/1132 lists the types of companies referred to in Article 7(1), Article 13, Article 29(1), Article 36(1), Article 67(1) and point (a) of Article 119(1) of that directive, including, for Bulgaria, OODs.","paragraph_id":"para_125"},{"text":"15","paragraph_id":"para_126"},{"text":"In accordance with the correlation table in Annex IV to Directive 2017/1132, first, Articles 2, 2a, 3, 4 and 7a of Directive 2009/101 correspond to Articles 14, 15, 16, 21 and 161 of Directive 2017/1132, respectively. Second, Article 3 of Directive 2012/30 corresponds to Article 4 of Directive 2017/1132.","paragraph_id":"para_127"},{"text":"Directive (EU) 2019/1151","paragraph_id":"para_128"},{"text":"16","paragraph_id":"para_129"},{"text":"Directive 2017/1132 was amended, inter alia, by Directive (EU) 2019/1151 of the European Parliament and of the Council of 20 June 2019 amending Directive [2017/1132] as regards the use of digital tools and processes in company law ( OJ 2019 L 186, p. 80 ), which entered into force on 31 July 2019 and which provides, in Article 1 thereof, entitled ‘Amendments to Directive [2017/1132]’:","paragraph_id":"para_130"},{"text":"‘Directive [2017/1132] is amended as follows:","paragraph_id":"para_131"},{"text":"…","paragraph_id":"para_132"},{"text":"(6) Article 16 is replaced by the following:","paragraph_id":"para_133"},{"text":"“Article 16","paragraph_id":"para_134"},{"text":"Disclosure in the register","paragraph_id":"para_135"},{"text":"1.   In each Member State, a file shall be opened in a central, commercial or companies register (‘the register’), for each of the companies registered therein.","paragraph_id":"para_136"},{"text":"…","paragraph_id":"para_137"},{"text":"2.   All documents and information that are required to be disclosed pursuant to Article 14 shall be kept in the file referred to in paragraph 1 of this Article, or entered directly in the register, and the subject matter of the entries in the register shall be recorded in the file.","paragraph_id":"para_138"},{"text":"All documents and information referred to in Article 14, irrespective of the means by which they are filed, shall be kept in the file in the register or entered directly into it in electronic form. Member States shall ensure that all documents and information that are filed by paper means are converted by the register to electronic form as quickly as possible.","paragraph_id":"para_139"},{"text":"…","paragraph_id":"para_140"},{"text":"3.   Member States shall ensure that the disclosure of the documents and information referred to in Article 14 is effected by making them publicly available in the register. In addition, Member States may also require that some or all of those documents and information are published in a national gazette designated for that purpose, or by equally effective means. …","paragraph_id":"para_141"},{"text":"4.   Member States shall take the necessary measures to avoid any discrepancy between what is in the register and in the file.","paragraph_id":"para_142"},{"text":"Member States that require the publication of documents and information in a national gazette or on a central electronic platform shall take the necessary measures to avoid any discrepancy between what is disclosed in accordance with paragraph 3 and what is published in the gazette or on the platform.","paragraph_id":"para_143"},{"text":"In cases of any discrepancies under this Article, the documents and information made available in the register shall prevail.","paragraph_id":"para_144"},{"text":"5.   The documents and information referred to in Article 14 may be relied on by the company as against third parties only after they have been disclosed in accordance with paragraph 3 of this Article, unless the company proves that the third parties had knowledge thereof.","paragraph_id":"para_145"},{"text":"…","paragraph_id":"para_146"},{"text":"6.   Member States shall ensure that all documents and information submitted as part of the formation of a company, the registration of a branch, or a filing by a company or a branch, is stored [in] the registers in a machine-readable and searchable format or as structured data …”","paragraph_id":"para_147"},{"text":"(7) the following Article is inserted:","paragraph_id":"para_148"},{"text":"“Article 16a","paragraph_id":"para_149"},{"text":"Access to disclosed information","paragraph_id":"para_150"},{"text":"1.   Member States shall ensure that copies of all or any part of the documents and information, referred to in Article 14, may be obtained from the register on application …","paragraph_id":"para_151"},{"text":"…”","paragraph_id":"para_152"},{"text":"(19) Article 161 is replaced by the following:","paragraph_id":"para_153"},{"text":"“Article 161","paragraph_id":"para_154"},{"text":"Data protection","paragraph_id":"para_155"},{"text":"The processing of any personal data carried out in the context of this Directive shall be subject to [the GDPR].”’","paragraph_id":"para_156"},{"text":"17","paragraph_id":"para_157"},{"text":"Article 2 of Directive 2019/1151, entitled ‘Transposition’, provides:","paragraph_id":"para_158"},{"text":"‘1.   Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by 1 August 2021. …","paragraph_id":"para_159"},{"text":"2.   Notwithstanding paragraph 1 of this Article, Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with … point (6) of Article 1 of this Directive, as regards Article 16(6) of Directive [2017/1132], by 1 August 2023.","paragraph_id":"para_160"},{"text":"3.   By way of derogation from paragraph 1, Member States which encounter particular difficulties in transposing this Directive shall be entitled to benefit from an extension of the period provided for in paragraph 1 of up to one year. …","paragraph_id":"para_161"},{"text":"…’","paragraph_id":"para_162"},{"text":"The GDPR","paragraph_id":"para_163"},{"text":"18","paragraph_id":"para_164"},{"text":"Recitals 26, 32, 40, 42, 43, 50, 85, 143 and 146 of the GDPR state:","paragraph_id":"para_165"},{"text":"‘(26)","paragraph_id":"para_166"},{"text":"The principles of data protection should apply to any information concerning an identified or identifiable natural person. … To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. …","paragraph_id":"para_167"},{"text":"…","paragraph_id":"para_168"},{"text":"(32)","paragraph_id":"para_169"},{"text":"Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement …","paragraph_id":"para_170"},{"text":"…","paragraph_id":"para_171"},{"text":"(40)","paragraph_id":"para_172"},{"text":"In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis, laid down by law, either in this Regulation or in other Union or Member State law as referred to in this Regulation, including the necessi …","paragraph_id":"para_173"},{"text":"…","paragraph_id":"para_174"},{"text":"(42)","paragraph_id":"para_175"},{"text":"Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. … Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.","paragraph_id":"para_176"},{"text":"(43)","paragraph_id":"para_177"},{"text":"In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is the …","paragraph_id":"para_178"},{"text":"…","paragraph_id":"para_179"},{"text":"(50)","paragraph_id":"para_180"},{"text":"The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. In such a case, no legal basis separate from that which allowed the collection of the personal data is required. …","paragraph_id":"para_181"},{"text":"…","paragraph_id":"para_182"},{"text":"(85)","paragraph_id":"para_183"},{"text":"A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthoris …","paragraph_id":"para_184"},{"text":"…","paragraph_id":"para_185"},{"text":"(143)","paragraph_id":"para_186"},{"text":"… each natural or legal person should have an effective judicial remedy before the competent national court against a decision of a supervisory authority which produces legal effects concerning that person. Such a decision concerns in particular the exercise of investigative, corrective and authoris …","paragraph_id":"para_187"},{"text":"…","paragraph_id":"para_188"},{"text":"(146)","paragraph_id":"para_189"},{"text":"… The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage. The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation. … Data subjects should receive full and effective compensation for the damage they have suffered. …’","paragraph_id":"para_190"},{"text":"19","paragraph_id":"para_191"},{"text":"Article 4 of the GDPR, entitled ‘Definitions’, provides:","paragraph_id":"para_192"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_193"},{"text":"(1)","paragraph_id":"para_194"},{"text":"“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;","paragraph_id":"para_195"},{"text":"(2)","paragraph_id":"para_196"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_197"},{"text":"…","paragraph_id":"para_198"},{"text":"(7)","paragraph_id":"para_199"},{"text":"“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;","paragraph_id":"para_200"},{"text":"…","paragraph_id":"para_201"},{"text":"(9)","paragraph_id":"para_202"},{"text":"“recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State …","paragraph_id":"para_203"},{"text":"…","paragraph_id":"para_204"},{"text":"(11)","paragraph_id":"para_205"},{"text":"“consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;","paragraph_id":"para_206"},{"text":"…’","paragraph_id":"para_207"},{"text":"20","paragraph_id":"para_208"},{"text":"Article 5 of the GDPR, headed ‘Principles relating to processing of personal data’, states:","paragraph_id":"para_209"},{"text":"‘1.   Personal data shall be:","paragraph_id":"para_210"},{"text":"…","paragraph_id":"para_211"},{"text":"(b)","paragraph_id":"para_212"},{"text":"collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes … (“purpose limitation”);","paragraph_id":"para_213"},{"text":"(c)","paragraph_id":"para_214"},{"text":"adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);","paragraph_id":"para_215"},{"text":"…","paragraph_id":"para_216"},{"text":"2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’","paragraph_id":"para_217"},{"text":"21","paragraph_id":"para_218"},{"text":"Under Article 6 of the GDPR, entitled ‘Lawfulness of processing’:","paragraph_id":"para_219"},{"text":"‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:","paragraph_id":"para_220"},{"text":"(a)","paragraph_id":"para_221"},{"text":"the data subject has given consent to the processing of his or her personal data for one or more specific purposes;","paragraph_id":"para_222"},{"text":"…","paragraph_id":"para_223"},{"text":"(c)","paragraph_id":"para_224"},{"text":"processing is necessary for compliance with a legal obligation to which the controller is subject;","paragraph_id":"para_225"},{"text":"…","paragraph_id":"para_226"},{"text":"(e)","paragraph_id":"para_227"},{"text":"processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;","paragraph_id":"para_228"},{"text":"…","paragraph_id":"para_229"},{"text":"3.   The basis for the processing referred to in point[s] (c) and (e) of paragraph 1 shall be laid down by:","paragraph_id":"para_230"},{"text":"(a)","paragraph_id":"para_231"},{"text":"Union law; or","paragraph_id":"para_232"},{"text":"(b)","paragraph_id":"para_233"},{"text":"Member State law to which the controller is subject.","paragraph_id":"para_234"},{"text":"The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That leg …","paragraph_id":"para_235"},{"text":"…’","paragraph_id":"para_236"},{"text":"22","paragraph_id":"para_237"},{"text":"Article 17 of the GDPR, entitled ‘Right to erasure (“right to be forgotten”), provides:","paragraph_id":"para_238"},{"text":"‘1.   The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:","paragraph_id":"para_239"},{"text":"(a)","paragraph_id":"para_240"},{"text":"the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;","paragraph_id":"para_241"},{"text":"(b)","paragraph_id":"para_242"},{"text":"the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;","paragraph_id":"para_243"},{"text":"(c)","paragraph_id":"para_244"},{"text":"the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);","paragraph_id":"para_245"},{"text":"(d)","paragraph_id":"para_246"},{"text":"the personal data have been unlawfully processed;","paragraph_id":"para_247"},{"text":"…","paragraph_id":"para_248"},{"text":"3.   Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:","paragraph_id":"para_249"},{"text":"…","paragraph_id":"para_250"},{"text":"(b)","paragraph_id":"para_251"},{"text":"for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;","paragraph_id":"para_252"},{"text":"…’","paragraph_id":"para_253"},{"text":"23","paragraph_id":"para_254"},{"text":"Article 21(1) of the GDPR is worded as follows:","paragraph_id":"para_255"},{"text":"‘The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer …","paragraph_id":"para_256"},{"text":"24","paragraph_id":"para_257"},{"text":"Article 58 of the GDPR provides:","paragraph_id":"para_258"},{"text":"‘1.   Each supervisory authority shall have all of the following investigative powers:","paragraph_id":"para_259"},{"text":"…","paragraph_id":"para_260"},{"text":"2.   Each supervisory authority shall have all of the following corrective powers:","paragraph_id":"para_261"},{"text":"…","paragraph_id":"para_262"},{"text":"3.   Each supervisory authority shall have all of the following authorisation and advisory powers:","paragraph_id":"para_263"},{"text":"…","paragraph_id":"para_264"},{"text":"(b)","paragraph_id":"para_265"},{"text":"to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;","paragraph_id":"para_266"},{"text":"…","paragraph_id":"para_267"},{"text":"4.   The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the [Charter of Fundamental Rights of the European Union (“the Charter”)].","paragraph_id":"para_268"},{"text":"5.   Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.","paragraph_id":"para_269"},{"text":"6.   Each Member State may provide by law that its supervisory authority shall have additional powers to those referred to in paragraphs 1, 2 and 3. The exercise of those powers shall not impair the effective operation of Chapter VII.’","paragraph_id":"para_270"},{"text":"25","paragraph_id":"para_271"},{"text":"Under Article 82 of the GDPR, entitled ‘Right to compensation and liability’:","paragraph_id":"para_272"},{"text":"‘1.   Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.","paragraph_id":"para_273"},{"text":"2.   Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.","paragraph_id":"para_274"},{"text":"3.   A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.","paragraph_id":"para_275"},{"text":"…’","paragraph_id":"para_276"},{"text":"26","paragraph_id":"para_277"},{"text":"Article 94 of the GDPR provides:","paragraph_id":"para_278"},{"text":"‘1.   Directive [95/46] is repealed with effect from 25 May 2018.","paragraph_id":"para_279"},{"text":"2.   References to the repealed Directive shall be construed as references to this Regulation. …’","paragraph_id":"para_280"},{"text":"Bulgarian law","paragraph_id":"para_281"},{"text":"The Law on the registers","paragraph_id":"para_282"},{"text":"27","paragraph_id":"para_283"},{"text":"Article 2 of the Zakon za targovskia registar i registara na yuridicheskite litsa s nestopanska tsel (Law on the commercial register and the register of not-for-profit legal persons) (DV No 34 of 25 April 2006), in the version applicable to the dispute in the main proceedings (‘the Law on the registers’), provides:","paragraph_id":"para_284"},{"text":"‘(1)   The commercial register and the register of not-for-profit legal persons are a common electronic database containing the particulars entered pursuant to a law, and the acts made available to the public pursuant to a law, which concern traders and the branches of foreign traders, not-for-profit legal persons and the branches of foreign not-for-profit legal persons.","paragraph_id":"para_285"},{"text":"(2)   The particulars and acts referred to in paragraph 1 shall be made available to the public without containing the information constituting personal data within the meaning of Article 4(1) of [the GDPR], with the exception of information that must be made available to the public by law.’","paragraph_id":"para_286"},{"text":"28","paragraph_id":"para_287"},{"text":"Article 3 of that law provides:","paragraph_id":"para_288"},{"text":"‘The commercial register and the register of not-for-profit legal persons shall be maintained by the [Agency], which is attached to the Ministar na pravosadieto [Minister for Justice, Bulgaria].’","paragraph_id":"para_289"},{"text":"29","paragraph_id":"para_290"},{"text":"Article 6(1) of that law lays down:","paragraph_id":"para_291"},{"text":"‘All traders and legal persons operating on a not-for-profit basis shall apply to be entered in the commercial register and the register of not-for-profit legal persons, respectively, stating the particulars entry of which is required and submitting the documents to be made available to the public.’","paragraph_id":"para_292"},{"text":"30","paragraph_id":"para_293"},{"text":"Article 11 of that law is worded as follows:","paragraph_id":"para_294"},{"text":"‘(1)   The commercial register and the register of not-for-profit legal persons are public registers. Everyone shall be entitled to access freely and free of charge the database constituting the registers.","paragraph_id":"para_295"},{"text":"(2)   The [Agency] shall ensure registered access to the file of the trader or not-for-profit legal person.’","paragraph_id":"para_296"},{"text":"31","paragraph_id":"para_297"},{"text":"Article 13(1), (2), (6) and (9) of the Law on the registers provides:","paragraph_id":"para_298"},{"text":"‘(1)   Entry, erasure and making available to the public shall be done by means of an application form.","paragraph_id":"para_299"},{"text":"(2)   The application shall contain:","paragraph_id":"para_300"},{"text":"1. the contact details of the applicant;","paragraph_id":"para_301"},{"text":"…","paragraph_id":"para_302"},{"text":"3. the particulars subject to entry, the entry erasure of which is requested, or the act to be made available to the public;","paragraph_id":"para_303"},{"text":"…","paragraph_id":"para_304"},{"text":"(6)   The application shall be accompanied by the documents or, as the case may be, the act to be made available to the public, in accordance with the requirements of the law. The documents shall be submitted in the form of an original, a copy authenticated by the applicant or a notarised copy. The …","paragraph_id":"para_305"},{"text":"…","paragraph_id":"para_306"},{"text":"(9)   Where the application or the attached documents refer to personal data which are not required by law, the persons who provided them are assumed to have consented to their processing by the [Agency] and to them being made available to the public.","paragraph_id":"para_307"},{"text":"…’","paragraph_id":"para_308"},{"text":"The Commercial Code","paragraph_id":"para_309"},{"text":"32","paragraph_id":"para_310"},{"text":"Point (3) of Article 101 of the Targovski zakon (Commercial Code) (DV No 48 of 18 June 1991), in the version applicable to the dispute in the main proceedings (‘the Commercial Code’), provides that a company’s constitutive instrument must contain ‘the name, business name and unique identification code of members’.","paragraph_id":"para_311"},{"text":"33","paragraph_id":"para_312"},{"text":"As set out in Article 119 of the Commercial Code:","paragraph_id":"para_313"},{"text":"‘(1)   Registration of the company in the commercial register shall require:","paragraph_id":"para_314"},{"text":"1. the submission of the company’s constitutive instrument which is [to be] made available to the public;","paragraph_id":"para_315"},{"text":"…","paragraph_id":"para_316"},{"text":"2.   The data referred to in point 1 … shall be entered in the register …","paragraph_id":"para_317"},{"text":"…","paragraph_id":"para_318"},{"text":"(4)   For the purposes of amending or supplementing the company’s constitutive instrument in the commercial register, a copy of that instrument containing all amendments and all addenda, authenticated by the body representing the company, shall be submitted for the purpose of being made available to the public.’","paragraph_id":"para_319"},{"text":"Decree No 1 on the maintenance, retention and access to the commercial register and the register of not-for-profit legal persons","paragraph_id":"para_320"},{"text":"34","paragraph_id":"para_321"},{"text":"Article 6 of the Naredba n 1 za vodene, sahranyavane i dostap do targovskia registar i do registara na yuridicheskite litsa s nestopanska tsel (Decree No 1 on the maintenance, retention and access to the commercial register and the register of not-for-profit legal persons) of 14 February 2007 (DV No 18 of 27 February 2007), adopted by the Ministar na pravosadieto (Minister for Justice), in the version applicable to the dispute in the main proceedings, provides:","paragraph_id":"para_322"},{"text":"‘Registration and removal from the commercial register and the register of not-for-profit legal persons shall be carried out on the basis of an application form in accordance with the annexes [ containing specific forms ]. Documents from the commercial register and the register of not-for-profit legal persons shall be made available to the public based on an application form in accordance with the annexes [ containing specific forms ].’","paragraph_id":"para_323"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_324"},{"text":"35","paragraph_id":"para_325"},{"text":"OL is a member of ‘Praven Shtit Konsulting’ OOD, a limited liability company governed by Bulgarian law, which was registered on 14 January 2021 in the commercial register following the submission of a company’s constitutive instrument dated 30 December 2020 and signed by the members of that company (‘the constitutive instrument concerned’).","paragraph_id":"para_326"},{"text":"36","paragraph_id":"para_327"},{"text":"That instrument, which includes the surname, first name, identification number, identity card number, date and place of issue of that card, as well as OL’s address and signature, was made available to the public by the Agency as submitted.","paragraph_id":"para_328"},{"text":"37","paragraph_id":"para_329"},{"text":"On 8 July 2021, OL requested the Agency to erase the personal data relating to her contained in that constitutive instrument, stating that, if the processing of those data was based on her consent, she was withdrawing that consent.","paragraph_id":"para_330"},{"text":"38","paragraph_id":"para_331"},{"text":"In the absence of a reply from the Agency, OL brought an action before the Administrativen sad Dobrich (Administrative Court, Dobrich, Bulgaria) which, by a judgment of 8 December 2021, annulled the implied refusal of the Agency to erase those data and referred the case back to the Agency for a new decision.","paragraph_id":"para_332"},{"text":"39","paragraph_id":"para_333"},{"text":"In order to comply with that judgment, and with a similar judgment concerning the other company member who had taken the same step, the Agency, by letter of 26 January 2022, stated that an authenticated copy of the constitutive instrument concerned in which the personal data of the company members, other than the personal data required by law, were redacted had to be sent to it in order for OL’s request for erasure of her personal data to be granted.","paragraph_id":"para_334"},{"text":"40","paragraph_id":"para_335"},{"text":"On 31 January 2022, OL again brought an action before the Administrativen sad Dobrich (Administrative Court, Dobrich) seeking annulment of that letter and an order that the Agency compensate her for the alleged non-material damage caused by that letter which infringed the rights conferred by the GDPR.","paragraph_id":"para_336"},{"text":"41","paragraph_id":"para_337"},{"text":"On 1 February 2022, before being notified of that action, the Agency erased of its own motion OL’s identification number, the data relating to her identity card and her address, but not her surname, first name and signature.","paragraph_id":"para_338"},{"text":"42","paragraph_id":"para_339"},{"text":"By judgment of 5 May 2022, the Administrativen sad Dobrich (Administrative Court, Dobrich) annulled the letter of 26 January 2022 and ordered the Agency to pay compensation to OL in the amount of 500 Bulgarian leva (BGN) (approximately EUR 255), together with statutory interest, in respect of non-ma …","paragraph_id":"para_340"},{"text":"43","paragraph_id":"para_341"},{"text":"The Agency brought an appeal on a point of law against that judgment before the referring court, the Varhoven administrativen sad (Supreme Administrative Court, Bulgaria).","paragraph_id":"para_342"},{"text":"44","paragraph_id":"para_343"},{"text":"According to that court, the Agency claims that it is not only a controller but also a recipient of the personal data transmitted in the registration procedure of ‘Praven Shtit Konsulting’. Furthermore, the Agency did not receive any copy of the constitutive instrument concerned in which OL’s person …","paragraph_id":"para_344"},{"text":"45","paragraph_id":"para_345"},{"text":"The referring court adds that, in the light of that main line of national case-law, a clarification of the requirements resulting from that regulation appears necessary. In particular, that court raises the question of the balancing exercise that must be carried out between, on the one hand, the rig …","paragraph_id":"para_346"},{"text":"46","paragraph_id":"para_347"},{"text":"In those circumstances, the Varhoven administrativen sad (Supreme Administrative Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_348"},{"text":"‘(1)","paragraph_id":"para_349"},{"text":"May Article 4(2) of [Directive 2009/101] be interpreted as meaning that it imposes an obligation on the Member State to permit the disclosure of [a company’s constitutive instrument], which is subject to registration under Article 119 of [the Commercial Code], in the case where that instrument conta …","paragraph_id":"para_350"},{"text":"(2)","paragraph_id":"para_351"},{"text":"If the first question is answered in the affirmative, may it be assumed that, in the circumstances which gave rise to the dispute in the main proceedings, the processing of personal [data] by the [Agency] is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, within the meaning of Article 6(1)(e) of [the GDPR]?","paragraph_id":"para_352"},{"text":"(3)","paragraph_id":"para_353"},{"text":"If the first two questions are answered in the affirmative, may a national provision such as that contained in Article 13(9) of [the Law on the registers], in accordance with which, in the event that personal data not required by law are contained in an application [for registration] or in the docum …","paragraph_id":"para_354"},{"text":"(4)","paragraph_id":"para_355"},{"text":"Is it permissible for provisions of national law intended to give effect to the obligation laid down in Article 3(7) of Directive [2009/101], whereby Member States are to take the necessary measures to avoid any discrepancy between what is disclosed in accordance with [Article 3(5) of that directive …","paragraph_id":"para_356"},{"text":"(5)","paragraph_id":"para_357"},{"text":"In the situation underlying the dispute in the main proceedings, does the [Agency] act only as controller in relation to the personal data or is it also the recipient thereof, in the case where the purposes of processing those data were determined by another controller as part of the documents that were submitted for disclosure?","paragraph_id":"para_358"},{"text":"(6)","paragraph_id":"para_359"},{"text":"Does the handwritten signature of a natural person constitute information relating to an identified natural person, in the sense that it is covered by the term “personal data” within the meaning of Article 4(1) of [the GDPR]?","paragraph_id":"para_360"},{"text":"(7)","paragraph_id":"para_361"},{"text":"Is the concept of “non-material damage” in Article 82(1) of [the GDPR] to be interpreted as meaning that the assumption of non-material damage requires a noticeable disadvantage and an objectively comprehensible impairment of personal interests, or is the mere short-term loss of the data subject’s u …","paragraph_id":"para_362"},{"text":"(8)","paragraph_id":"para_363"},{"text":"May opinion No 01-116(20)/01.02.2021, issued by the national supervisory authority, the [Commission for the Protection of Personal Data], in accordance with Article 58(3)(b) of [the GDPR], to the effect that the [Agency] does not have the option or power in law to restrict of its own motion or at th …","paragraph_id":"para_364"},{"text":"Consideration of the questions referred","paragraph_id":"para_365"},{"text":"Preliminary observations","paragraph_id":"para_366"},{"text":"47","paragraph_id":"para_367"},{"text":"As a preliminary point, it should be noted that the questions referred concern the interpretation of both the GDPR and Directive 2009/101, which was codified and replaced by Directive 2017/1132, applicable ratione temporis to the facts at issue in the main proceedings. Consequently, the request for a preliminary ruling must be interpreted as seeking an interpretation of Directive 2017/1132.","paragraph_id":"para_368"},{"text":"48","paragraph_id":"para_369"},{"text":"Furthermore, as the Advocate General observed in point 15 of her Opinion, since some of those facts are subsequent to 1 August 2021, the date on which the transposition period of Directive 2019/1151 – set out in Article 2(1) of that directive – expired, it is for the referring court to ascertain whether those facts fall within the scope ratione temporis of Directive 2017/1132 or of Directive 2017/1132, as amended by Directive 2019/1151.","paragraph_id":"para_370"},{"text":"49","paragraph_id":"para_371"},{"text":"That being so, it should be noted that the amendments to the wording of Articles 16 and 161 of Directive 2017/1132 and the addition of Article 16a to that directive introduced by Directive 2019/1151 have no bearing on the analysis which the Court is called upon to carry out in the present case, with the result that the answers to be given in the present judgment will, in any event, be relevant.","paragraph_id":"para_372"},{"text":"The first question","paragraph_id":"para_373"},{"text":"50","paragraph_id":"para_374"},{"text":"By its first question, the referring court asks, in essence, whether Article 21(2) of Directive 2017/1132 must be interpreted as imposing on a Member State an obligation to permit the disclosure, in the commercial register, of a company’s constitutive instrument subject to compulsory disclosure under that directive and containing personal data other than the minimum personal data required, disclosure of which is not required by the law of that Member State.","paragraph_id":"para_375"},{"text":"51","paragraph_id":"para_376"},{"text":"In particular, that court is uncertain as to the scope of the voluntary disclosure referred to in that provision and seeks to determine whether that provision requires Member States to permit the disclosure of information contained in the constitutive instruments of companies, such as personal data, which they have not required for the purposes of compulsory disclosure under that directive.","paragraph_id":"para_377"},{"text":"52","paragraph_id":"para_378"},{"text":"Under the first subparagraph of Article 21(2) of Directive 2017/1132, ‘in addition to the compulsory disclosure referred to in Article 16 [of that directive], Member States shall allow translations of documents and particulars referred to in Article 14 [of that directive] to be disclosed voluntarily …","paragraph_id":"para_379"},{"text":"53","paragraph_id":"para_380"},{"text":"Article 14 of Directive 2017/1132 for its part lists the documents and particulars which the companies concerned must, as a minimum, disclose. Those documents and particulars must, in accordance with Article 16(3) to (5) of that directive, be kept in the file or entered in the register, be accessibl …","paragraph_id":"para_381"},{"text":"54","paragraph_id":"para_382"},{"text":"In that regard, having regard in particular to the repeated use of the term ‘translations’ in Article 21(2) of Directive 2017/1132, it is apparent from the wording of that provision that it concerns the voluntary disclosure of translations of the documents and particulars referred to in Article 14 o …","paragraph_id":"para_383"},{"text":"55","paragraph_id":"para_384"},{"text":"Therefore, that wording tends to indicate that Article 21(2) cannot be interpreted as imposing on Member States any obligation relating to the disclosure of personal data which are not required to be disclosed either by other provisions of EU law or by the law of the Member State concerned, but which appear in a document subject to compulsory disclosure under that directive.","paragraph_id":"para_385"},{"text":"56","paragraph_id":"para_386"},{"text":"Where the meaning of a provision of EU law is absolutely plain from its very wording, the Court cannot depart from that interpretation (judgment of 25 January 2022, VYSOČINA WIND, C‑181/20 , EU:C:2022:51 , paragraph  39 ).","paragraph_id":"para_387"},{"text":"57","paragraph_id":"para_388"},{"text":"In any event, as regards the context of Article 21(2) of Directive 2017/1132, the title of that article, which refers to the ‘Language of disclosure and translation of documents and particulars to be disclosed’, as well as the other paragraphs of that article, support the interpretation referred to in paragraph 55 of this judgment.","paragraph_id":"para_389"},{"text":"58","paragraph_id":"para_390"},{"text":"Article 21(1) of Directive 2017/1132 provides that ‘documents and particulars to be disclosed pursuant to Article 14 [of that directive] shall be drawn up and filed in one of the languages permitted’ by the applicable national rules. Article 21(3) of that directive provides that, in addition to the …","paragraph_id":"para_391"},{"text":"59","paragraph_id":"para_392"},{"text":"Last, the interpretation referred to in paragraph 55 of this judgment is confirmed by recital 12 thereof, according to which cross-border access to company information should be facilitated by allowing, in addition to compulsory disclosure made in one of the languages permitted in the company’s Member State, the voluntary registration in additional languages of the required documents and particulars.","paragraph_id":"para_393"},{"text":"60","paragraph_id":"para_394"},{"text":"In the light of the foregoing, the answer to the first question is that Article 21(2) of Directive 2017/1132 must be interpreted as not imposing on a Member State an obligation to permit the disclosure, in the commercial register, of a company’s constitutive instrument subject to compulsory disclosure under that directive and containing personal data, other than the minimum personal data required, disclosure of which is not required by the law of that Member State.","paragraph_id":"para_395"},{"text":"The second and third questions","paragraph_id":"para_396"},{"text":"61","paragraph_id":"para_397"},{"text":"In the light of the answer given to the first question, there is no need to answer the second and third questions, which are asked only in the event that the first question is answered in the affirmative.","paragraph_id":"para_398"},{"text":"The fifth question","paragraph_id":"para_399"},{"text":"62","paragraph_id":"para_400"},{"text":"By its fifth question, which it is appropriate to examine before the fourth question, the referring court asks, in essence, whether the GDPR, in particular Article 4(7) and (9) thereof, must be interpreted as meaning that the authority responsible for maintaining the commercial register of a Member …","paragraph_id":"para_401"},{"text":"63","paragraph_id":"para_402"},{"text":"At the outset, it should be recalled that, in accordance with Article 161 of Directive 2017/1132, the processing of personal data carried out in the context of that directive is subject to Directive 95/46 and, therefore, to the GDPR, Article 94(2) of which states that references to the latter directive are to be construed as references to that regulation.","paragraph_id":"para_403"},{"text":"64","paragraph_id":"para_404"},{"text":"In that regard, it must first be pointed out that, under Article 14(1)(a), (b) and (d) of Directive 2017/1132, Member States must take the measures necessary to ensure the compulsory disclosure by companies of at least the instrument of constitution of the company concerned, the amendments thereto, …","paragraph_id":"para_405"},{"text":"65","paragraph_id":"para_406"},{"text":"Pursuant to Article 16(3) to (5) of that directive, as stated in paragraph 53 of this judgment, those documents and particulars must be kept in the file or entered in the register, be accessible by obtaining a full or partial copy on request, and be disclosed by publication either of the full text or of a partial text, or by means of a reference, in the national gazette, or by an equally effective means.","paragraph_id":"para_407"},{"text":"66","paragraph_id":"para_408"},{"text":"As the Advocate General observed in point 26 of her Opinion, it is therefore for the Member States to determine, inter alia, which categories of information concerning the identity of the persons referred to in Article 4(i) and Article 14(d) of that directive, in particular, which kind of personal data, are to be subject to compulsory disclosure, in accordance with EU law.","paragraph_id":"para_409"},{"text":"67","paragraph_id":"para_410"},{"text":"The information relating to the identity of those persons constitutes, as information relating to identified or identifiable natural persons, ‘personal data’ within the meaning of Article 4(1) of the GDPR (see, to that effect, judgment of 9 March 2017, Manni, C‑398/15 , EU:C:2017:197 , paragraph  34 ).","paragraph_id":"para_411"},{"text":"68","paragraph_id":"para_412"},{"text":"The same is true of the additional information relating to the identity of those persons or of other categories of persons which the Member States decide to subject to compulsory disclosure, or which, as in the present case, are included in the documents subject to such disclosure, without those data being required to be made available by Directive 2017/1132 or by the national law implementing that directive.","paragraph_id":"para_413"},{"text":"69","paragraph_id":"para_414"},{"text":"Next, as regards the concept of ‘recipient’ within the meaning of Article 4(9) of the GDPR, it refers to ‘a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not’, that provision specifying that public authorities which may receive personal data in the framework of a particular inquiry in accordance with EU law or the law of a Member State are not covered by that definition.","paragraph_id":"para_415"},{"text":"70","paragraph_id":"para_416"},{"text":"By receiving, in the context of an application for registration of a company in the commercial register of a Member State, the documents subject to compulsory disclosure referred to in Article 14 of Directive 2017/1132 containing personal data, whether or not they are required by that directive or by national law, the authority responsible for maintaining that register has the status of ‘recipient’ of those data within the meaning of Article 4(9) of the GDPR.","paragraph_id":"para_417"},{"text":"71","paragraph_id":"para_418"},{"text":"Last, under Article 4(7) of the GDPR, the concept of ‘controller’ covers natural or legal persons, public authorities, agencies or other bodies which, alone or jointly with others, determine the purposes and means of the processing of personal data. That provision also states that, where the purpose …","paragraph_id":"para_419"},{"text":"72","paragraph_id":"para_420"},{"text":"In that regard, it should be borne in mind that, according to the case-law of the Court, that provision is intended to ensure, through a broad definition of the concept of ‘controller’, effective and complete protection of data subjects (judgment of 11 January 2024, État belge (Data processed by an official journal), C‑231/22 , EU:C:2024:7 , paragraph  28 and the case-law cited).","paragraph_id":"para_421"},{"text":"73","paragraph_id":"para_422"},{"text":"Having regard to the wording of Article 4(7) of the GDPR, read in the light of that objective, it appears that, in order to establish whether a person or entity is to be classified as a ‘controller’ within the meaning of that provision, it must be examined whether that person or entity determines, a …","paragraph_id":"para_423"},{"text":"74","paragraph_id":"para_424"},{"text":"It must also be stated that, having regard to the broad definition of the concept of ‘controller’ within the meaning of Article 4(7) of the GDPR, the determination of the purposes and means of the processing and, where appropriate, the nomination of that controller by national law may not only be ex …","paragraph_id":"para_425"},{"text":"75","paragraph_id":"para_426"},{"text":"In addition, by transcribing and storing personal data received in connection with an application for registration of a company in the commercial register of a Member State, by disclosing those data, where appropriate, on request to third parties and publishing them in the national gazette, or by an …","paragraph_id":"para_427"},{"text":"76","paragraph_id":"para_428"},{"text":"Those kinds of processing of personal data are distinct from and subsequent to the disclosure of personal data carried out by the applicant for that registration and received by that authority. In addition, that authority carries out those kinds of processing alone, in accordance with the purposes and procedures laid down by Directive 2017/1132 and by the legislation of the Member State concerned implementing that directive.","paragraph_id":"para_429"},{"text":"77","paragraph_id":"para_430"},{"text":"In that regard, it is apparent from recitals 7 and 8 of that directive that the purpose of the disclosure provided for by that directive is to protect in particular the interests of third parties in relation to joint stock companies and limited liability companies, since the only safeguards they off …","paragraph_id":"para_431"},{"text":"78","paragraph_id":"para_432"},{"text":"Furthermore, the purpose of that directive is to guarantee legal certainty in relation to dealings between companies and third parties in view of the intensification of trade between Member States following the creation of the internal market. With that in mind, it is important that any person wishi …","paragraph_id":"para_433"},{"text":"79","paragraph_id":"para_434"},{"text":"As the Advocate General observed in point 39 of her Opinion, by transmitting to the authority responsible for maintaining the commercial register of a Member State the documents and particulars which are subject to compulsory disclosure under Directive 2017/1132, and by thus processing the personal …","paragraph_id":"para_435"},{"text":"80","paragraph_id":"para_436"},{"text":"In the present case, as the Advocate General noted in points 31 and 32 of that Opinion, it is apparent from the request for a preliminary ruling that the making available to the public of OL’s personal data occurred in the exercise of the powers vested in the Agency as the authority responsible for …","paragraph_id":"para_437"},{"text":"81","paragraph_id":"para_438"},{"text":"That classification is also not called into question by the fact that the Agency does not review, under that legislation, before they are made available online, the personal data contained in the electronic images or originals of documents which are transmitted to it for the purposes of the registra …","paragraph_id":"para_439"},{"text":"82","paragraph_id":"para_440"},{"text":"In those circumstances, it appears that, in a situation such as that at issue in the main proceedings, the Agency is the controller of OL’s personal data, the processing of which consists of making those data available, online, to the public, even if a copy of the constitutive instrument concerned, …","paragraph_id":"para_441"},{"text":"83","paragraph_id":"para_442"},{"text":"In the light of the foregoing, the answer to the fifth question is that the GDPR, in particular Article 4(7) and (9) thereof, must be interpreted as meaning that the authority responsible for maintaining the commercial register of a Member State which publishes, in that register, the personal data c …","paragraph_id":"para_443"},{"text":"The fourth question","paragraph_id":"para_444"},{"text":"Admissibility","paragraph_id":"para_445"},{"text":"84","paragraph_id":"para_446"},{"text":"The Bulgarian Government submits that the fourth question is inadmissible since it raises a hypothetical problem. According to that government, that question concerns the compatibility with Article 16 of Directive 2017/1132 of national legislation – which has not yet been adopted – laying down detailed procedural rules for the exercise of the right referred to in Article 17 of the GDPR.","paragraph_id":"para_447"},{"text":"85","paragraph_id":"para_448"},{"text":"In accordance with settled case-law, the procedure for referring questions for a preliminary ruling under Article 267 TFEU establishes a relationship of close cooperation between the national courts and the Court of Justice based on the assignment to each of different functions and constitutes an in …","paragraph_id":"para_449"},{"text":"86","paragraph_id":"para_450"},{"text":"It follows that questions relating to EU law enjoy a presumption of relevance. The Court may refuse to rule on a question referred by a national court for a preliminary ruling only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the …","paragraph_id":"para_451"},{"text":"87","paragraph_id":"para_452"},{"text":"In the present case, it is apparent from the request for a preliminary ruling that the referring court is called upon to adjudicate, at last instance, on the lawfulness of the Agency’s refusal to grant the request for erasure of personal data at issue in the main proceedings, on the ground that a co …","paragraph_id":"para_453"},{"text":"88","paragraph_id":"para_454"},{"text":"It follows that, contrary to what the Bulgarian Government maintains, the fourth question is admissible.","paragraph_id":"para_455"},{"text":"Substance","paragraph_id":"para_456"},{"text":"89","paragraph_id":"para_457"},{"text":"In the light of the information set out in the request for a preliminary ruling, as set out in paragraph 87 of the present judgment, it must be held that, by its fourth question, the referring court asks, in essence, whether Directive 2017/1132, in particular Article 16 thereof, and Article 17 of th …","paragraph_id":"para_458"},{"text":"90","paragraph_id":"para_459"},{"text":"In accordance with Article 17(1) of the GDPR, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase those personal data without undue delay where one of the grounds set out in that provision applies.","paragraph_id":"para_460"},{"text":"91","paragraph_id":"para_461"},{"text":"That is the case, according to Article 17(1)(c), where the data subject objects to processing pursuant to Article 21(1) of that regulation and there are no ‘overriding legitimate grounds for the processing’ or, in accordance with Article 17(1)(d), where the data in question have been ‘unlawfully processed’.","paragraph_id":"para_462"},{"text":"92","paragraph_id":"para_463"},{"text":"It also follows from Article 17(3)(b) of the GDPR that Article 17(1) thereof does not apply where the processing is necessary for compliance with a legal obligation which requires processing by EU law or the law of a Member State to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.","paragraph_id":"para_464"},{"text":"93","paragraph_id":"para_465"},{"text":"Therefore, in order to determine whether, in a situation such as that at issue in the main proceedings, the data subject has a right to erasure under Article 17 of the GDPR, it is necessary, in the first instance, to examine the ground or grounds for lawfulness under which the processing of his or her personal data may fall.","paragraph_id":"para_466"},{"text":"94","paragraph_id":"para_467"},{"text":"In that regard, it should be recalled that the first subparagraph of Article 6(1) of the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as being lawful. Thus, in order that it may be regarded as lawful, processing must fall within o …","paragraph_id":"para_468"},{"text":"95","paragraph_id":"para_469"},{"text":"In the absence of the data subject’s consent to the processing of his or her personal data pursuant to point (a) of the first subparagraph of Article 6(1), or where that consent is not freely given, specific, informed and unambiguous, within the meaning of Article 4(11) of the GDPR, such processing …","paragraph_id":"para_470"},{"text":"96","paragraph_id":"para_471"},{"text":"In that context, the justifications provided for in that latter provision, in so far as they allow the processing of personal data carried out in the absence of the data subject’s consent to be made lawful, must be interpreted restrictively (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21 , EU:C:2023:537 , paragraph  93 and the case-law cited).","paragraph_id":"para_472"},{"text":"97","paragraph_id":"para_473"},{"text":"It should also be noted that, in accordance with Article 5 of the GDPR, the controller bears the burden of proving that those data are collected, inter alia, for specified, explicit and legitimate purposes, that they are adequate, relevant and limited to what is necessary in relation to the purposes …","paragraph_id":"para_474"},{"text":"98","paragraph_id":"para_475"},{"text":"Although it is for the referring court to determine whether the various elements of the processing such as that at issue in the main proceedings are justified by one or other of the necessity requirements referred to in points (a) to (f) of the first subparagraph of Article 6(1) of the GDPR, the Cou …","paragraph_id":"para_476"},{"text":"99","paragraph_id":"para_477"},{"text":"In the present case, first of all, as noted by the Advocate General in point 43 of her Opinion, the presumption of consent established in Article 13(9) of the Law on the registers does not appear to satisfy the conditions required by point (a) of the first subparagraph of Article 6(1) of the GDPR, read in conjunction with Article 4(11) of that regulation.","paragraph_id":"para_478"},{"text":"100","paragraph_id":"para_479"},{"text":"As is apparent from recitals 32, 42 and 43 of that regulation, consent should be given by a clear affirmative act, for example by a written statement or an oral statement, without being regarded as having been freely given if the data subject has no genuine or free choice or is unable to refuse or w …","paragraph_id":"para_480"},{"text":"101","paragraph_id":"para_481"},{"text":"Therefore, a presumption such as that laid down in Article 13(9) of the Law on the registers cannot be regarded as establishing freely given, specific, informed and unambiguous consent to the processing of personal data by a public authority such as the Agency.","paragraph_id":"para_482"},{"text":"102","paragraph_id":"para_483"},{"text":"Next, the grounds for lawfulness laid down in points (b) and (d) of the first subparagraph of Article 6(1), relating to the processing of personal data necessary for the performance of a contract and the protection of the vital interests of a natural person, respectively, do not appear to be relevan …","paragraph_id":"para_484"},{"text":"103","paragraph_id":"para_485"},{"text":"Last, as regards the grounds for lawfulness set out in points (c) and (e) of the first subparagraph of Article 6(1) of the GDPR, it must be recalled that, under point (c) of the first subparagraph of Article 6(1), processing of personal data is lawful if it is necessary for compliance with a legal o …","paragraph_id":"para_486"},{"text":"104","paragraph_id":"para_487"},{"text":"Article 6(3) of the GDPR specifies, inter alia, in respect of those two situations in which processing is lawful, that the processing must be based on EU law or Member State law to which the controller is subject, and that that legal basis must meet an objective of public interest and be proportionate to the legitimate aim pursued.","paragraph_id":"para_488"},{"text":"105","paragraph_id":"para_489"},{"text":"Concerning, in the first place, the question whether the processing at issue in the main proceedings is necessary for compliance with a legal obligation arising from EU law or Member State law to which the controller is subject, for the purposes of point (c) of the first subparagraph of Article 6(1) …","paragraph_id":"para_490"},{"text":"106","paragraph_id":"para_491"},{"text":"It is thus for the Member States, in the context of the implementation of the obligations imposed by that directive, to ensure that the objectives of legal certainty and protection of the interests of third parties pursued by that directive and recalled in paragraph 77 of the present judgment, are r …","paragraph_id":"para_492"},{"text":"107","paragraph_id":"para_493"},{"text":"Therefore, it cannot be held that the making available to the public, online, in the commercial register, of personal data not required by Directive 2017/1132 or by the national legislation at issue in the main proceedings contained in a company’s constitutive instrument subject to compulsory disclo …","paragraph_id":"para_494"},{"text":"108","paragraph_id":"para_495"},{"text":"Nor does the lawfulness of the processing at issue in the main proceedings appear – subject to verification by the referring court – to be based on a legal obligation laid down by Member State law to which the controller is subject within the meaning of point (c) of the first subparagraph of Article …","paragraph_id":"para_496"},{"text":"109","paragraph_id":"para_497"},{"text":"As regards, in the second place, the question whether the processing at issue in the main proceedings is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, within the meaning of point (e) of the first subparag …","paragraph_id":"para_498"},{"text":"110","paragraph_id":"para_499"},{"text":"It follows that the processing at issue in the main proceedings appears, admittedly, to be carried out in connection with a task carried out in the public interest within the meaning of that provision. However, in order to satisfy the conditions imposed by that provision, it is necessary that that p …","paragraph_id":"para_500"},{"text":"111","paragraph_id":"para_501"},{"text":"That requirement of necessity is not met where the objective of general interest pursued can reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal d …","paragraph_id":"para_502"},{"text":"112","paragraph_id":"para_503"},{"text":"As the Advocate General observed in point 51 of her Opinion, the making available to the public, online, of personal data which are not required either by Directive 2017/1132 or by national law cannot be regarded in itself as being necessary in order to achieve the objectives pursued by that directive.","paragraph_id":"para_504"},{"text":"113","paragraph_id":"para_505"},{"text":"In particular, as regards the existence of means which are less detrimental to the fundamental rights of the data subjects, it should be noted that the national legislation at issue in the main proceedings provides that an applicant for registration of a company in the commercial register is require …","paragraph_id":"para_506"},{"text":"114","paragraph_id":"para_507"},{"text":"It should also be noted, as the Advocate General observed in point 56 of her Opinion, that, contrary to what has been argued by several Member States in their observations before the Court, the requirement to preserve the integrity and reliability of company documents – subject to compulsory disclos …","paragraph_id":"para_508"},{"text":"115","paragraph_id":"para_509"},{"text":"In particular, that requirement cannot impose that personal data not required by Directive 2017/1132 or by national law remain available to the public, online, in that register when, as is apparent from paragraph 113 of the present judgment, the Agency could itself draw up the copy of the instrument of the company concerned, provided for by that law, with a view to making it available.","paragraph_id":"para_510"},{"text":"116","paragraph_id":"para_511"},{"text":"It follows that the processing of personal data at issue in the main proceedings appears, in any event, to go beyond what is necessary for the performance of the task carried out in the public interest conferred on the Agency under that national legislation.","paragraph_id":"para_512"},{"text":"117","paragraph_id":"para_513"},{"text":"Consequently, as the Advocate General observed in point 59 of her Opinion, subject to the verifications which it is for the referring court to carry out, such processing also does not appear to satisfy the conditions of lawfulness laid down in points (c) and (e) of the first subparagraph of Article 6(1), read in conjunction with Article 6(3) of the GDPR.","paragraph_id":"para_514"},{"text":"118","paragraph_id":"para_515"},{"text":"In the second instance, as regards the request for erasure under Article 17 of the GDPR at issue in the main proceedings, it should be noted that, if the referring court were to conclude, following its assessment of the lawfulness of that processing, that that processing is not lawful, according to …","paragraph_id":"para_516"},{"text":"119","paragraph_id":"para_517"},{"text":"If, on the other hand, that court were to conclude that that processing does satisfy the ground for lawfulness laid down in point (e) of the first subparagraph of Article 6(1) of the GDPR, in particular in so far as the making available to the public, online, in the commercial register of data not r …","paragraph_id":"para_518"},{"text":"120","paragraph_id":"para_519"},{"text":"It follows from that latter provision, read in conjunction with Article 21(1) of the GDPR, that the data subject enjoys a right to object to processing and a right to erasure, unless there are overriding legitimate grounds which take precedence over the interests and rights and freedoms of that pers …","paragraph_id":"para_520"},{"text":"121","paragraph_id":"para_521"},{"text":"In a situation such as that at issue in the main proceedings, there does not appear to be any overriding legitimate ground, within the meaning of that provision, capable of precluding such a request for erasure.","paragraph_id":"para_522"},{"text":"122","paragraph_id":"para_523"},{"text":"First, it is apparent from the order for reference that the company of which OL is a member is already registered in the commercial register.","paragraph_id":"para_524"},{"text":"123","paragraph_id":"para_525"},{"text":"Second, as has been noted in paragraph 115 of the present judgment, the requirement to preserve the integrity and reliability of company documents subject to compulsory disclosure under Directive 2017/1132 cannot impose that personal data not required by Directive 2017/1132 or by national law be kept available to the public, online, in that register.","paragraph_id":"para_526"},{"text":"124","paragraph_id":"para_527"},{"text":"Last, assuming that the referring court comes to the conclusion that the processing of the personal data at issue in the main proceedings does satisfies the ground for lawfulness laid down in point (c) of the first subparagraph of Article 6(1) of the GDPR, it should be noted that the GDPR, and in pa …","paragraph_id":"para_528"},{"text":"125","paragraph_id":"para_529"},{"text":"As the Court has already held, limiting access to personal data which is made subject to mandatory disclosure by EU law only to third parties who demonstrate a specific interest may, on a case-by-case basis, be justified on compelling legitimate grounds relating to the particular situation of the data subjects (see, to that effect, judgment of 9 March 2017, Manni, C‑398/15 , EU:C:2017:197 , paragraph  60 ).","paragraph_id":"para_530"},{"text":"126","paragraph_id":"para_531"},{"text":"As the Advocate General observed in point 67 of her Opinion, the same must apply, a fortiori, where, as in the present case, the personal data concerned are not required either by Directive 2017/1132 or by national law.","paragraph_id":"para_532"},{"text":"127","paragraph_id":"para_533"},{"text":"In the light of those factors, the answer to the fourth question is that Directive 2017/1132, in particular Article 16 thereof, and Article 17 of the GDPR must be interpreted as precluding a Member State’s legislation or practice which leads the authority responsible for maintaining the commercial r …","paragraph_id":"para_534"},{"text":"The sixth question","paragraph_id":"para_535"},{"text":"128","paragraph_id":"para_536"},{"text":"By its sixth question, the referring court asks, in essence, whether Article 4(1) of the GDPR must be interpreted as meaning that the handwritten signature of a natural person is covered by the concept of ‘personal data’ within the meaning of that provision.","paragraph_id":"para_537"},{"text":"129","paragraph_id":"para_538"},{"text":"That provision lays down that personal data means ‘any information relating to an identified or identifiable natural person’ and specifies that ‘an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identif …","paragraph_id":"para_539"},{"text":"130","paragraph_id":"para_540"},{"text":"In that connection, the Court has already held that the use of the expression ‘any information’ in the definition of the concept of ‘personal data’ in that provision reflects the aim of the EU legislature to assign a wide scope to that concept, which potentially encompasses all kinds of information, …","paragraph_id":"para_541"},{"text":"131","paragraph_id":"para_542"},{"text":"Information relates to an identified or identifiable natural person where, by reason of its content, purpose or effect, it is linked to an identifiable person (judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C‑487/21 , EU:C:2023:369 , paragraph  24 ).","paragraph_id":"para_543"},{"text":"132","paragraph_id":"para_544"},{"text":"As regards the ‘identifiable’ nature of a natural person, recital 26 of the GDPR states that account should be taken of ‘all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly’.","paragraph_id":"para_545"},{"text":"133","paragraph_id":"para_546"},{"text":"It follows that the broad definition of the concept of ‘personal data’ covers not only data collected and stored by the controller, but also includes all information resulting from the processing of personal data relating to an identified or identifiable person (see, to that effect, judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C‑487/21 , EU:C:2023:369 , paragraph  26 ).","paragraph_id":"para_547"},{"text":"134","paragraph_id":"para_548"},{"text":"It also follows from the case-law of the Court that the handwriting of a natural person provides information relating to that person (see, to that effect, judgment of 20 December 2017, Nowak, C‑434/16 , EU:C:2017:994 , paragraph  37 ).","paragraph_id":"para_549"},{"text":"135","paragraph_id":"para_550"},{"text":"Last, it should be noted that the handwritten signature of a natural person is, in general, used to identify that person, in order to confer evidential value, concerning their accuracy and sincerity, on the documents to which it is affixed or to take responsibility for them. Furthermore, it appears that, in the constitutive instrument concerned, the members’ signature accompanies their names.","paragraph_id":"para_551"},{"text":"136","paragraph_id":"para_552"},{"text":"In the light of the foregoing, the answer to the sixth question is that Article 4(1) of the GDPR must be interpreted as meaning that the handwritten signature of a natural person is covered by the concept of ‘personal data’ within the meaning of that provision.","paragraph_id":"para_553"},{"text":"The seventh question","paragraph_id":"para_554"},{"text":"137","paragraph_id":"para_555"},{"text":"By its seventh question, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as meaning that a loss of control, for a limited period, by the data subject over his or her personal data, on account of those data being made available online to the public, in the …","paragraph_id":"para_556"},{"text":"138","paragraph_id":"para_557"},{"text":"As a preliminary point, it should be recalled that that provision states that ‘any person who has suffered material or non-material damage as a result of an infringement of [the GDPR] shall have the right to receive compensation from the controller or processor for the damage suffered’.","paragraph_id":"para_558"},{"text":"139","paragraph_id":"para_559"},{"text":"In that regard, since the GDPR makes no reference to the law of the Member States so far as concerns the meaning and scope of the terms in that provision, in particular as regards the concepts of ‘material or non-material damage’ and of ‘compensation for the damage suffered’, those terms must be reg …","paragraph_id":"para_560"},{"text":"140","paragraph_id":"para_561"},{"text":"For that purpose, Article 82(1) of the GDPR must be interpreted as meaning that the mere infringement of that regulation is not sufficient to confer a right to compensation, since the existence of ‘damage’, material or non-material, or of ‘damage’ which has been ‘suffered’ constitutes one of the con …","paragraph_id":"para_562"},{"text":"141","paragraph_id":"para_563"},{"text":"Thus, a person seeking compensation for non-material damage on the basis of that provision is required to establish not only the infringement of provisions of that regulation, but also that that infringement caused him or her such damage. Such damage cannot therefore be presumed merely on the basis …","paragraph_id":"para_564"},{"text":"142","paragraph_id":"para_565"},{"text":"In particular, a person concerned by an infringement of the GDPR which has had negative consequences for him or her is required to demonstrate that those consequences constitute non-material damage, within the meaning of Article 82 of that regulation, since the mere infringement of the provisions thereof is not sufficient to confer a right to compensation (judgment of 25 January 2024, MediaMarktSaturn, C‑687/21 , EU:C:2024:72 , paragraph  60 and the case-law cited).","paragraph_id":"para_566"},{"text":"143","paragraph_id":"para_567"},{"text":"Therefore, where a person claiming compensation on the basis of Article 82(1) of the GDPR relies on the fear that his or her personal data will be misused in the future owing to the existence of such an infringement, the national court seised must verify that that fear can be regarded as well founde …","paragraph_id":"para_568"},{"text":"144","paragraph_id":"para_569"},{"text":"That being said, the Court has already held that it is apparent not only from the wording of Article 82(1) of the GDPR, read in the light of recitals 85 and 146 thereof – which encourage the acceptance of a broad interpretation of the concept of ‘non-material damage’, within the meaning of that firs …","paragraph_id":"para_570"},{"text":"145","paragraph_id":"para_571"},{"text":"In particular, it is apparent from the illustrative list of types of ‘damage’ that may be suffered by data subjects, set out in the first sentence of recital 85 of the GDPR, that the EU legislature intended to include in the concept of ‘damage’ that may be suffered by data subjects, inter alia, the …","paragraph_id":"para_572"},{"text":"146","paragraph_id":"para_573"},{"text":"Furthermore, an interpretation of Article 82(1) of the GDPR to the effect that the concept of ‘non-material damage’, within the meaning of that provision, does not include situations in which a data subject relies solely on the fear that his or her personal data will be misused by third parties, in …","paragraph_id":"para_574"},{"text":"147","paragraph_id":"para_575"},{"text":"Similarly, that concept cannot be limited solely to damage of a certain degree of seriousness, in particular as regards the duration of the period during which the negative consequences of the infringement of that regulation were suffered by the data subjects (see, to that effect, judgment of 14 December 2023, Gemeinde Ummendorf, C‑456/22 , EU:C:2023:988 , paragraphs  16 and  19 and the case-law cited).","paragraph_id":"para_576"},{"text":"148","paragraph_id":"para_577"},{"text":"Accordingly, it cannot be considered that, in addition to the three conditions set out in paragraph 140 of the present judgment, other conditions for establishing liability laid down in Article 82(1) of the GDPR, such as the tangible nature of the damage or the objective nature of the infringement, may be added (judgment of 14 December 2023, Gemeinde Ummendorf, C‑456/22 , EU:C:2023:988 , paragraph  17 ).","paragraph_id":"para_578"},{"text":"149","paragraph_id":"para_579"},{"text":"Nor does that provision require that, following a proven infringement of provisions of that regulation, the ‘non-material damage’ alleged by the data subject must reach a ‘ de minimis threshold’ in order that such damage may be redressed (judgment of 14 December 2023, Gemeinde Ummendorf, C‑456/22 , EU:C:2023:988 , paragraph  18 ).","paragraph_id":"para_580"},{"text":"150","paragraph_id":"para_581"},{"text":"Consequently, although there is nothing to preclude the publication on the internet of personal data and the consequent loss of control over those data for a short period of time from causing the data subjects ‘non-material damage’, within the meaning of Article 82(1) of the GDPR, giving rise to a r …","paragraph_id":"para_582"},{"text":"151","paragraph_id":"para_583"},{"text":"Last, it must be stated that, when determining the amount of damages due in respect of the right to compensation for non-material damage, non-material damage caused by a personal data breach is not, by its nature, less significant than physical injury (judgment of 20 June 2024, Scalable Capital, C‑182/22 and C‑189/22 , EU:C:2024:531 , paragraph  39 ).","paragraph_id":"para_584"},{"text":"152","paragraph_id":"para_585"},{"text":"Moreover, where a person succeeds in demonstrating that the infringement of the GDPR has caused him or her damage within the meaning of Article 82 of that regulation, the criteria for assessing the compensation due in the context of actions intended to safeguard the rights which individuals derive f …","paragraph_id":"para_586"},{"text":"153","paragraph_id":"para_587"},{"text":"In that regard, the right to compensation laid down in Article 82(1), in particular in the case of non-material damage, fulfils an exclusively compensatory function, in that financial compensation based on that provision must allow the damage actually suffered as a result of the infringement of that …","paragraph_id":"para_588"},{"text":"154","paragraph_id":"para_589"},{"text":"Furthermore, first, establishing the liability of the controller under Article 82 of the GDPR is subject to fault on the part of the controller, which is presupposed unless the controller proves that it is not in any way responsible for the event giving rise to the damage and, second, Article 82 doe …","paragraph_id":"para_590"},{"text":"155","paragraph_id":"para_591"},{"text":"In the present case, as noted in paragraph 42 of the present judgment, the referring court stated that the Administrativen sad Dobrich (Administrative Court, Dobrich) had found the existence of non-material damage consisting in psychological and emotional suffering by OL, namely fear of, and concern …","paragraph_id":"para_592"},{"text":"156","paragraph_id":"para_593"},{"text":"In the light of the foregoing considerations, the answer to the seventh question is that Article 82(1) of the GDPR must be interpreted as meaning that a loss of control, for a limited period, by the data subject over his or her personal data, on account of those data being made available online to t …","paragraph_id":"para_594"},{"text":"The eighth question","paragraph_id":"para_595"},{"text":"157","paragraph_id":"para_596"},{"text":"By its eighth question, the referring court asks, in essence, whether Article 82(3) of the GDPR must be interpreted as meaning that an opinion of the supervisory authority of a Member State, issued on the basis of Article 58(3)(b) of that regulation, is sufficient to exempt from liability, under Art …","paragraph_id":"para_597"},{"text":"158","paragraph_id":"para_598"},{"text":"In the first place, as regards the rules on liability provided for in Article 82 of the GDPR, it should be recalled that that article provides, in paragraph 1 thereof, that any person who has suffered material or non-material damage as a result of an infringement of that regulation is to have the ri …","paragraph_id":"para_599"},{"text":"159","paragraph_id":"para_600"},{"text":"In accordance with the first sentence of Article 82(2) of that regulation, any controller involved in processing is to be liable for the damage caused by processing which infringes that regulation. That provision, which specifies the rules on liability – the principle of which is established in para …","paragraph_id":"para_601"},{"text":"160","paragraph_id":"para_602"},{"text":"Article 82(3) of the GDPR, for its part, states that a controller is to be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.","paragraph_id":"para_603"},{"text":"161","paragraph_id":"para_604"},{"text":"As the Court has already held, it follows from a combined analysis of Article 82(1) to (3) of the GDPR, the context of that article and the objectives pursued by the EU legislature by means of that regulation that that article provides for fault-based liability in which the burden of proof rests not …","paragraph_id":"para_605"},{"text":"162","paragraph_id":"para_606"},{"text":"In particular, it would not be consistent with the objective of ensuring such a high level of protection of natural persons with regard to the processing of their personal data to opt for an interpretation according to which data subjects who have suffered damage as a result of an infringement of th …","paragraph_id":"para_607"},{"text":"163","paragraph_id":"para_608"},{"text":"In accordance with the case-law cited in paragraph 154 of the present judgment, the controller’s liability under Article 82 of the GDPR is thus subject to fault on the part of the controller, which is presupposed unless it proves that it is not in any way responsible for the event giving rise to the damage.","paragraph_id":"para_609"},{"text":"164","paragraph_id":"para_610"},{"text":"In that regard, as is apparent from the express addition of the words ‘in any way’ during the legislative process, the circumstances in which the controller may claim to be exempt from civil liability under Article 82 of the GDPR must be strictly limited to those in which the controller is able to demonstrate that the damage is not attributable to it (judgment of 14 December 2023, Natsionalna agentsia za prihodite, C‑340/21 , EU:C:2023:986 , paragraph  70 ).","paragraph_id":"para_611"},{"text":"165","paragraph_id":"para_612"},{"text":"The Court also held that, in the event of a personal data breach committed by a third party, such as a cyber criminal, or by a person acting under the authority of the controller, that controller may be exempted from liability, on the basis of Article 82(3) of the GDPR, only if it proves that there …","paragraph_id":"para_613"},{"text":"166","paragraph_id":"para_614"},{"text":"Therefore, in order for the controller to be exempted from liability under Article 82(3) of the GDPR, it cannot be sufficient for it to demonstrate that it had given instructions to persons acting under its authority, within the meaning of that regulation, and that one of those persons failed in his …","paragraph_id":"para_615"},{"text":"167","paragraph_id":"para_616"},{"text":"In the second place, as regards the rules on evidence, it should be recalled that the GDPR does not lay down rules relating to the admission and probative value of evidence which must be applied by the national courts hearing an action for damages based on Article 82 of that regulation. Therefore, i …","paragraph_id":"para_617"},{"text":"168","paragraph_id":"para_618"},{"text":"In the third place, as regards an opinion issued under Article 58(3)(b) of the GDPR, it should be recalled that that article lays down the powers of the supervisory authorities.","paragraph_id":"para_619"},{"text":"169","paragraph_id":"para_620"},{"text":"Thus, Article 58 of the GDPR confers on those authorities, in paragraph 1 thereof, investigative powers, in paragraph 2 thereof, the power to adopt corrective measures, in paragraph 3 thereof, the authorisation powers and the advisory powers listed therein and, in paragraph 5 thereof, the power to b …","paragraph_id":"para_621"},{"text":"170","paragraph_id":"para_622"},{"text":"Among the powers listed in Article 58(3) of the GDPR is included, in point (b) of that provision, the power ‘to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data’.","paragraph_id":"para_623"},{"text":"171","paragraph_id":"para_624"},{"text":"It is clear from the wording of that latter provision, in particular from the term ‘opinions’, that the issuing of such an opinion falls within the scope of the advisory powers of the supervisory authority, and not within that of its authorisation powers.","paragraph_id":"para_625"},{"text":"172","paragraph_id":"para_626"},{"text":"The use of the terms ‘opinions’ and ‘advisory powers’ also indicates that an opinion issued on the basis of Article 58(3)(b) of the GDPR is not, under EU law, legally binding.","paragraph_id":"para_627"},{"text":"173","paragraph_id":"para_628"},{"text":"Recital 143 of the GDPR confirms that interpretation. Indeed, that recital states that ‘each natural or legal person should have an effective judicial remedy before the competent national court against a decision of a supervisory authority which produces legal effects concerning that person. Such a …","paragraph_id":"para_629"},{"text":"174","paragraph_id":"para_630"},{"text":"Since an opinion issued to the controller is not legally binding, it cannot in itself demonstrate that that the damage is not attributable to that controller, within the meaning of the case-law cited in paragraph 164 of the present judgment, nor, therefore, that it is sufficient to exempt that controller from liability under Article 82(3) of the GDPR.","paragraph_id":"para_631"},{"text":"175","paragraph_id":"para_632"},{"text":"Such an interpretation of Article 82(3) is also consistent with the objectives pursued by the GDPR of ensuring a high level of protection of natural persons with regard to the processing of their personal data and of ensuring effective compensation for the damage that they may suffer as a result of …","paragraph_id":"para_633"},{"text":"176","paragraph_id":"para_634"},{"text":"In the light of the foregoing, the answer to the eighth question is that Article 82(3) of the GDPR must be interpreted as meaning that an opinion of the supervisory authority of a Member State, issued on the basis of Article 58(3)(b) of that regulation, is not sufficient to exempt from liability, un …","paragraph_id":"para_635"},{"text":"Costs","paragraph_id":"para_636"},{"text":"177","paragraph_id":"para_637"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_638"},{"text":"On those grounds, the Court (First Chamber) hereby rules:","paragraph_id":"para_639"},{"text":"1.","paragraph_id":"para_640"},{"text":"Article 21(2) of Directive (EU) 2017/1132 of the European Parliament and of the Council of 14 June 2017 relating to certain aspects of company law","paragraph_id":"para_641"},{"text":"must be interpreted as not imposing on a Member State an obligation to permit the disclosure, in the commercial register, of a company’s constitutive instrument subject to compulsory disclosure under that directive and containing personal data, other than the minimum personal data required, disclosure of which is not required by the law of that Member State.","paragraph_id":"para_642"},{"text":"2.","paragraph_id":"para_643"},{"text":"Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), in particular Article 4(7) and (9) thereof","paragraph_id":"para_644"},{"text":"must be interpreted as meaning that the authority responsible for maintaining the commercial register of a Member State which publishes, in that register, the personal data contained in a company’s constitutive instrument, which is subject to compulsory disclosure under Directive 2017/1132 and was t …","paragraph_id":"para_645"},{"text":"3.","paragraph_id":"para_646"},{"text":"Directive 2017/1132, in particular Article 16 thereof, and Article 17 of Regulation 2016/679","paragraph_id":"para_647"},{"text":"must be interpreted as precluding a Member State’s legislation or practice which leads the authority responsible for maintaining the commercial register of that Member State to refuse any request for erasure of personal data not required by that directive or by the law of that Member State, containe …","paragraph_id":"para_648"},{"text":"4.","paragraph_id":"para_649"},{"text":"Article 4(1) of Regulation 2016/679","paragraph_id":"para_650"},{"text":"must be interpreted as meaning that the handwritten signature of a natural person is covered by the concept of ‘personal data’ within the meaning of that provision.","paragraph_id":"para_651"},{"text":"5.","paragraph_id":"para_652"},{"text":"Article 82(1) of Regulation 2016/679","paragraph_id":"para_653"},{"text":"must be interpreted as meaning that a loss of control, for a limited period, by the data subject over his or her personal data, on account of those data being made available online to the public, in the commercial register of a Member State, may suffice to cause ‘non-material damage’, provided that …","paragraph_id":"para_654"},{"text":"6.","paragraph_id":"para_655"},{"text":"Article 82(3) of Regulation 2016/679","paragraph_id":"para_656"},{"text":"must be interpreted as meaning that an opinion of the supervisory authority of a Member State, issued on the basis of Article 58(3)(b) of that regulation, is not sufficient to exempt from liability, under Article 82(2) of that regulation, the authority responsible for maintaining the commercial register of that Member State which has the status of ‘controller’, within the meaning of Article 4(7) of that regulation.","paragraph_id":"para_657"},{"text":"[Signatures]","paragraph_id":"para_658"},{"text":"(\n *1\n ) Language of the case: Bulgarian.","paragraph_id":"para_659"}],"word_count":19451,"cites":["C-398/15","C-181/20","C-231/22","C-564/19","C-510/19","C-439/19","C-252/21","C-180/21","C-184/20","C-26/22","C-64/22","C-460/20","C-487/21","C-434/16","C-300/21","C-741/21","C-687/21","C-340/21","C-590/22","C-456/22","C-182/22","C-189/22","C-667/21"],"sha256":"783700e406f7c7c599a04403315d35655ecf78672978f76e0ec9e48463c9fa6b","source_url":"https://publications.europa.eu/resource/celex/62023CJ0200.ENG.xhtml.ECR_62023CJ0200_EN_01.html","fetched_at":"2026-09-30T05:23:56.183+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-200-23-62023cj0200","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-200-23-62023cj0200","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-200-23-62023cj0200","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-200-23-62023cj0200","verification":{"stored_sha256":"783700e406f7c7c599a04403315d35655ecf78672978f76e0ec9e48463c9fa6b","recomputed_sha256":"783700e406f7c7c599a04403315d35655ecf78672978f76e0ec9e48463c9fa6b","intact":true,"checked_at":"2026-10-15T07:27:52.515Z"}},"hash":"sha256:bddeb1f675e37382872615c96ec9c5fac137a1337258824ed9fbe796a44c0b80","version":"legal-2026-10-15","expires":"2026-10-16T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-15+legal-2026-10-15+2026-10-15T07:24:49","content_hash":"sha256:bddeb1f675e37382872615c96ec9c5fac137a1337258824ed9fbe796a44c0b80","revalidate_after":"2026-10-15T08:27:53.150Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-200-23-62023cj0200","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-200-23-62023cj0200"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-200-23-62023cj0200"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-200-23-62023cj0200"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":3},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-02T09:09:43.064Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-200-23-62023cj0200&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":41747}}