An interesting conflict between national case law and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) was addressed by the Court of Justice of the European Union (CJEU) in relation to Germany.

The national court asked the CJEU if a limited partnership is obliged to provide its partners with information about other partners who hold their shares in the partnership indirectly through trust funds. Previous German case law had established that the right of a shareholder to know the name and address of the other shareholders is part of the “inalienable core of the rights of shareholders”. However, this principle predates the GDPR and the Munich District Court therefore decided to refer the case higher.

The CJEU stated that the exhaustive list of cases, in which the processing of personal data can be considered lawful, is exhaustively listed in Article 6(1) of the GDPR. In the present case, according to the CJEU, the disclosure of shareholders’ data is only relevant if one of the following three conditions is met. First, the disclosure is necessary for the performance of a contract, i.e. for the achievement of its main purpose; second, it is necessary for the purposes of the legitimate interests of a third party, where those interests outweigh those of the data subject; and third, it is necessary for the performance of a legal obligation, i.e. where required by national case law. Whether or not any of the grounds are met must be assessed individually in every case.

The CJEU also outlined other possibilities for achieving the same objective, for the purpose of contacting another shareholder in an emergency, according to the CJEU, it would be possible, for example, to ask the company to pass on a message to the shareholder, etc. The CJEU left it to the referring court to assess if the existing German case law does indeed consider contractual provisions between a company and its shareholders prohibiting the disclosure of their data to the public to be invalid.