03/02/2020 CURIA - Documents In that regard, it must first be pointed out that, under Article 2(1)(d) of Directive 68/151, Member States must take the measures necessary to ensure compulsory disclosure by companies of at least the appointment, termination of office and particulars of the persons who either as a body constituted pursuant to law, or as members of any such body, are authorised to represent the company in dealings with third parties and in legal proceedings, or take part in the administration, supervision or control of that company. Moreover, according to Article 2(1)(j), the appointment of liquidators, particulars concerning them and, in principle, their respective powers must also be disclosed. Pursuant to Article 3(1) to (3) of Directive 68/151, those particulars must be transcribed in each Member State either in a central register, commercial register or companies register (together, ‘the register’), and a copy of the whole or any part of those particulars must be obtainable by application. It must be held that the particulars concerning the identity of the persons referred to in Article 2(1)(d) and (j) of Directive 68/151 constitute, as information relating to identified or identifiable natural persons, ‘personal data’ within the meaning of Article 2(a) of Directive 95/46. It is apparent from the Court’s case-law that the fact that that information was provided as part of a professional activity does not mean that it cannot be characterised as personal data (see judgment of 16 July 2015, ClientEarth and PAN Europe v EFSA, C‑615/13 P, EU:C:2015:489, paragraph 30 and the case-law cited). Furthermore, by transcribing and keeping that information in the register and communicating it, where appropriate, on request to third parties, the authority responsible for maintaining that register carries out ‘processing of personal data’ for which it is the ‘controller’, within the meaning of the definitions set out Article 2(b) and (d) of Directive 95/46. The processing of personal data which is thus carried out in the implementation of Article 2(1)(d) and (j) and Article 3 of Directive 68/151 is subject to Directive 95/46, under Articles 1 and 3 thereof. This is now expressly provided for in Article 7a of Directive 2009/101, as amended by Directive 2012/17, which, however, is only declaratory in that regard. As the European Commission stated at the hearing, the EU legislature considered it useful to recall that fact in the context of the legislative changes introduced by Directive 2012/17 and aimed at ensuring interoperability of registers of the Member States, since those changes suggested an increase in the intensity of the processing of personal data. With regard to Directive 95/46, it should be remembered that, as is apparent from Article 1 and recital 10, that directive seeks to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data (see judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 66 and the case-law cited). According to recital 25 of Directive 95/46, the principles of protection laid down by the directive are reflected, on the one hand, in the obligations imposed on persons responsible for processing data, in particular regarding data quality, technical security, notification to the supervisory authority and the circumstances under which processing can be carried out, and, on the other hand, in the rights conferred on individuals whose data are the subject of processing to be informed that such processing is taking place, to consult the data, to request corrections and even to object to processing in certain circumstances. The Court has already held that the provisions of Directive 95/46, in so far as they govern the processing of personal data liable to infringe fundamental freedoms and, in particular, the right to respect for private life, must necessarily be interpreted in the light of the fundamental rights guaranteed by the Charter of Fundamental Rights of the European Union (‘the Charter’) (see judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 38 and the case-law cited). Article 7 of the Charter therefore guarantees the right to respect for private life, whilst Article 8 of the Charter expressly proclaims the right to the protection of personal data. Article 8(2) and (3) states that such data must be processed fairly, for specific purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law, that everyone has the right of access to data which has been collected concerning him or her and the right to have it rectified, and that compliance with those rules is to be subject to control by an independent authority. Those requirements are implemented inter alia in Articles 6, 7, 12, 14 and 28 of Directive 95/46. With regard, in particular, to the general conditions of lawfulness imposed by Directive 95/46, it should be noted that, subject to the exceptions permitted under Article 13 of that directive, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the directive and, secondly, with one of the criteria for making data processing legitimate listed in Article 7 of the directive (see, inter alia, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 71 and the case-law cited). In that regard, as the Advocate General pointed out in point 52 of his Opinion, it should be noted that the processing of personal data by the authority responsible for keeping the register pursuant to Article 2(1)(d) and (j) and Article 3 of Directive 68/151 satisfies several grounds for legitimation provided for in Article 7 of Directive 95/46, namely those set out in subparagraph (c) thereof, relating to compliance with a legal obligation, subparagraph (e), relating to the exercise of official authority or the performance of a task carried out in the public interest, and subparagraph (f) relating to the realisation of a legitimate interest pursued by the controller or by the third parties to whom the data are disclosed. With regard, inter alia, to the ground for legitimation provided for in Article 7(e) of Directive 95/46, it should be noted that the Court of Justice has already held that the activity of a public authority consisting in the storing, in a database, of data which undertakings are obliged to report on the basis of statutory obligations, permitting interested persons to search for that data and providing them with print-outs thereof, falls within the exercise of public powers (see judgment of 12 July 2012, Compass-Datenbank, C‑138/11, EU:C:2012:449, paragraphs 40 and 41). Moreover, such an activity also constitutes a task carried out in the public interest within the meaning of that provision. curia.europa.eu/juris/document/document.jsf?text=&docid=188750&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1151671 5/8