Public Registers on the Internet and Data Protection – How the Federal Court of Justice Pulls Out All the Stops in Three Decisions
Commercial registers, association registers, environmental registers – to name just a few examples of public registers. The landscape of these data sources is thematically diverse. Much of the registry data is available online, in some cases freely accessible. But how does this practice relate to data protection law? The Federal Court of Justice (BGH) addressed this issue in three decisions in 2024. The focus: the right of data subjects to have their data erased (see BGH, Jan. 23, 2024 – II ZB 7/23; BGH, Jan. 23, 2024 – II ZB 8/23; BGH, June 4, 2024 – II ZB 10/23).
On the one hand, the Federal Court of Justice (BGH) affirms the public interest in the processing of personal data in the registers, the fact that this data can be accessed online is considered a legal obligation of great general importance. On the other hand, it provides guidance on how this can be reconciled with the rights of the data subjects. Article 17 of the General Data Protection Regulation (GDPR) serves as the basis for this in particular.
The BGH draws one conclusion that applies across all registers: It clarifies that online access and physical access must be assessed differently in terms of the degree of interference with the rights and freedoms of data subjects.
A greater degree of intrusion requires organizational measures to mitigate it. A systematic means of having one’s own data deleted or access to it restricted is necessary.
The right to be forgotten must also be weighed against the accessibility of data via registry portals. The right to be forgotten also stems from Article 17 of the GDPR and governs the erasure or restriction of access to personal data available on the Internet including, for example, entries that can be found through search engines. Certain conditions must be met for the right to erasure or restriction of access to apply.
However, it remains unclear to what extent the Federal Court of Justice (BGH) would extend its findings regarding the register of associations to the commercial register. Legal scholars are also calling for a limitation on the period during which entries can be accessed. In this regard in particular, specific clarifications by the legislature in register law would now be warranted.
What significance do these decisions have for the development of an open web index?
The decisions make the following clear: The right to erasure and the right to be forgotten are enshrined in the General Data Protection Regulation (GDPR). They are rooted in fundamental rights. In practice, the pitfalls lie in the details. This must also be taken into account when collecting data through an open web index.
Certainly, the indexing of the Internet is in the public interest. On the other hand, the protection of individuals’ fundamental rights requires that certain data be exempted from unrestricted dissemination.
Paul Christopher Johannes, a PriDI team member and legal scholar at the University of Kassel, authored a detailed review article on the topic “Public Registers on the Internet and Data Protection.” The article appeared in the journal “DER BETRIEB” on November 25, 2024, Issue 48, page 2947.
