Court of Justice (First Chamber) 4 October 2024, C-200/23 (Agentsia po vpisvaniyata v OL.)

Also known as

The Court of Justice (First Chamber) held, on a reference from the Bulgarian Supreme Administrative Court, that Article 21(2) of Directive 2017/1132 does not oblige Member States to permit disclosure in the commercial register of personal data contained in a company's constitutive instrument beyond the minimum data required by that directive or national law, and that the authority responsible for maintaining the commercial register is both a 'recipient' and a 'controller' of personal data within the meaning of Article 4(7) and (9) GDPR even where such data were not required to be disclosed. The Court further ruled that Directive 2017/1132 and Article 17 GDPR preclude national legislation or practice whereby that authority refuses any erasure request solely because a redacted copy of the constitutive instrument has not been provided, and that a handwritten signature constitutes 'personal data' under Article 4(1) GDPR. Finally, the Court held that a temporary loss of control over personal data made publicly available online may constitute compensable 'non-material damage' under Article 82(1) GDPR provided actual damage is demonstrated, and that a non-binding supervisory authority opinion issued under Article 58(3)(b) GDPR is insufficient to exempt the controller from liability under Article 82(3) GDPR.AI