Does the Companies Act 2006 trump an individual's right to be forgotten?

Question

I once was a contractor and ran a limited company. At the time all my details and my secretary's were published on the Companies House website.

edit: This information includes full names and addresses.

This limited company was wound up in 2008. Since then CH have removed all information about my company from public view, including director and secretary details.

I occasionally still find other websites cribbed my company's details from Companies House back when and are to this day advertising these details if you look for them.

They claim they can hold on to this information citing the Companies Act 2006. They may be "nice enough" to hide your details from search bots if you ask them.

But does this Companies Act 2006 not fly in the face of article 17 of the GDPR ("right to be forgotten")? Especially after such a long time?

Do I have a stronger legal foothold by citing article 17 of the GDPR if I contacted these websites requesting actual removal (not hiding) of all personal data held on me and my previous secretary?

Answer 1

Companies House itself is exempt from certain GDPR provisions, including Article 17, by virtue of the Data Protection Act 2018, Schedule 2, Part 1, paragraph 5. (That's the Act which implements the GDPR in UK law.)

The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation.

The list is in paragraph 1 of that Part, and has effect under section 15 of the Act. Because the registrar is obliged by an enactment, the Companies Act 2006, to make information available to the public, it's exempt from being asked not to.

When Companies House data is processed by somebody else, they do not have this exemption. They are the "data controller" with respect to what they've retrieved (from the API or by scraping) and have freestanding obligations under the GDPR. They may still have other reasons why they are able to retain and process your data, such as a vital interest or a legitimate interest in protecting themselves or others from fraud, and therefore wanting to maintain a list of people associated with insolvent companies. For Article 17 specifically, there are exceptions relating to the public interest, statistics and research which might be invoked. But random websites cannot claim exemption from Article 17 just because the data comes from Companies House. There is nothing in the Companies Act which says that third parties are obliged to mirror Companies House data.

This is explained in greater detail in the Companies House Personal Information Charter, which is where I found the citation above. They go on to say:

If you have any concerns about company data on third party products and websites, please contact the organisation directly. We’re not able to advise other organisations on UK GDPR compliance, and we cannot advise you on whether other organisations are complying with the law.

Answer 2

There may be no Right of Erasure in this Case

It depends who holds the data, and whether they are Personal Data (PI) under the UK-GDPR.

The GDPR

According to GDPR Article 17 (right to erasure) paragraph 3:

Paragraphs 1 and 2 shall not apply to the extent that processing is necessary ...

(B) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

I gather that this has been taken to mean that the right of erasure (also known as the "right to be forgotten" does not in general apply to government records.

Also, note that the GDPR only protects information about "natural persons" not about companies or associations.

The Companies Act 2006

Sections 9 thru 16 of the Companies Act require various information about a company to be submitted to the Registrar of Companies, and retained in a register. These include:

• The memorandum of association;
• The Company's name;
• The type and structure of the company;
• a statement of capital and initial shareholdings;
• the company's proposed officers;
• a statement of initial significant control;
• the intended address of the company's registered office;and
• various other information about the company.

In addition , many sections of the act provide that dpecific information is to be sent to the registrar and retained on the register.

Part 31, Chapter 1 of the act permit the registrar to "strike off" the name of the company from the register when it appears that the company is not functioning. This can be done at the instance of the registrar, or on request of the company. When the name is struck off, the company is dissolved. But I find nothing in these sections requiring, or indeed authorizing, the registrar to erase the information.

Since there is provision for a company that has been struck off to be re-established, it seems that the intent is that information about defunct companies is to be maintained by the registrar, although I find no explicit statement to this effect.

The originals of documents delivered to the registrar in hard copy form must be kept for three years after they are received by the registrar, after which they may be destroyed provided the information contained in them has been [F1recorded].

Section 1083 of the act provides in relevant part that:

(1) The originals of documents delivered to the registrar in hard copy form must be kept for three years after they are received by the registrar, after which they may be destroyed provided the information contained in them has been recorded.

This is subject to section 1087(3) (extent of obligation to retain material not available for public inspection).

(2) The registrar is under no obligation to keep the originals of documents delivered in electronic form, provided the information contained in them has been recorded. This is subject to section 1087(3) (extent of obligation to retain material not available for public inspection).

Subsections (2)-(5) of Section 1084 of the act provides that once two years have passed sicne a company was dissolved:

... the registrar may direct that records relating to the company or institution may be removed to the Public Record Office or, as the case may be, the Public Record Office of Northern Ireland.

(3) Records in respect of which such a direction is given shall be disposed of under the enactments relating to that Office and the rules made under them.

...

(4A) This section has effect subject to section 1087ZA (required particulars available for public inspection for limited period).

(5) This section does not extend to Scotland.

Section 1085 (1) provides that:

(1) Any person may inspect the register.

There is a time limitation on the preservation of original hard-copy documents, but not on the information registered.

Under Section 1086 (1):

(1) Any person may require a copy of any material on the register.

Section 1087 (Material not available for public inspection) lists various categories of information that is not made available to the public.

Section 1087ZA(Required particulars available for public inspection for limited period) provides that:

(1) This section applies where—

(1) (a) a notice is given to the registrar by a company under section 790VA (notification of changes to the registrar), or

(1) (b) a document is delivered to the registrar by a company under section 790ZA (duty to notify registrar of changes).

(2) The notice or document, and any record of the information contained in the notice or document, must not be made available by the registrar for public inspection after the expiration of ten years beginning with the date on which the company is dissolved.

(3) The power in section 1084(2) (power of registrar to direct that records of a company that has been dissolved may be removed to the Public Record Office etc) may not be exercised in relation to the notice or document, or any record of the information contained in the notice or document, before the expiration of ten years beginning with the date on which the company is dissolved.

(4) Subsection (2) does not affect the availability for public inspection of the same information contained in material derived from another description of document in relation to which no such restriction applies.

But this section does not seem to require or permit erasure of any information, It does restrict the public availability of the information starting 10 years after the company is dissolved.

Conclusion

The GDPR right of erasure from article 17 (aka "the right to be forgotten") does not apply to data held because of a legal requirement. Nor does it ever apply to data that is not about a natural person rather than a company.

The Companies Act 2006 requires that quite a lot of information about a company be submitted to the Registrar, and made available for public inspection during the period of operation of the company, and for 10 years after the company is dissolved.

After that the Registrar is not supposed to make the information available for public inspection, but if others have copied and published the information before the end of the inspection period, nothing in the Companies Act, requires it to be erased on request.

But nothing in the Companies Act authorizes a third party who obtained information from the Registrar while it was available there to violate the UK-GDPR by refusing an otherwise proper erasure request. Such of the information formerly available from the register, but no longer listed there, as is PI, and particularly PII, would be subject to a GDPR article 17 erasure request addressed to a non-governmental Data Controller (DC) unless dome other exception applied. Should such a DC not comply, the Data Subject (DS) could make a complaint to the ICO, and follow it with legal action if that is needed.