Contents
Judgment of the Court (Fourth Chamber)12 September 2024note(Reference for a preliminary ruling — Protection of natural persons with regard to the processing of personal data — Regulation (EU) 2016/679 — Points (b), (c) and (f) of the first subparagraph of Article 6(1) — Lawfulness of processing — Necessity of processing for the purpose of performing a contract to which the data subject is party — Necessity of processing for the purpose of complying with a legal obligation incumbent on the controller — Necessity of processing for the purposes of the legitimate interests pursued by the controller or by a third party — Investment fund established in the form of a limited partnership offering shares for public subscription — Request of a partner seeking to obtain the contact details of other partners with indirect shareholdings in an investment fund through a trust company)In Joined Cases C‑17/22 and C‑18/22,REQUESTS for a preliminary ruling under Article 267 TFEU from the Amtsgericht München (Local Court, Munich, Germany), made by decisions of 21 December 2021, received at the Court on 7 January 2022, in the proceedingsHTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KGvMüller Rechtsanwaltsgesellschaft mbH (C‑17/22),Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KGvWealthCap Photovoltaik 1 GmbH Co. KG,WealthCap PEIA Komplementär GmbH,WealthCap Investorenbetreuung GmbH (C‑18/22),THE COURT (Fourth Chamber),composed of C. Lycourgos, President of the Chamber, O. Spineanu‑Matei, J.‑C. Bonichot, S. Rodin and L.S. Rossi (Rapporteur), Judges,Advocate General: J. Richard de la Tour,Registrar: I. Illéssy, Administrator,having regard to the written procedure and further to the hearing on 29 February 2024,after considering the observations submitted on behalf of:– HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG, by M. Handlos and R. Veil, Rechtsanwälte,– Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG, by U. Brinkmöller, Rechtsanwalt,– WealthCap Photovoltaik 1 GmbH Co. KG, WealthCap PEIA Komplementär GmbH and WealthCap Investorenbetreuung GmbH, by N. Bartmann, U. Baumgartner and A. Höder, Rechtsanwälte,– the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,gives the following
Judgment
1These requests for a preliminary ruling concern the interpretation of points (b) and (f) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
2The requests have been made in proceedings between (i) HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG (‘HTB’) and Müller Rechtsanwaltsgesellschaft mbH (Case C‑17/22); and (ii) Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG (‘Ökorenta’) and WealthCap Photovoltaik 1 GmbH Co. KG, WealthCap PEIA Komplementär GmbH and WealthCap Investorenbetreuung (Case C‑18/22).
Legal context
European Union law
3Recitals 1, 10, 39, 41, 47 and 48 of the GDPR are worded as follows:(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the “Charter”) and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.…(10) In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. Consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the [European] Union. ……(39) Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. ……(41) Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament, without prejudice to requirements pursuant to the constitutional order of the Member State concerned. However, such a legal basis or legislative measure should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice of the European Union … and the European Court of Human Rights.…(47) The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing. … The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.(48) Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients’ or [of] employees’ personal data. The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected.’
4Article 1 of that regulation, entitled ‘Subject matter and objectives’, provides, in paragraph 2 thereof:‘This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.’
5Article 4 of that regulation provides:‘For the purposes of this Regulation:(1) “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;(2) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;…(7) “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;…(11) “consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;…’
6Article 5 of that regulation, entitled ‘Principles relating to processing of personal data’, provides:1.Personal data shall be:(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; …(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);…2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’
7Article 6 of the GDPR, entitled ‘Lawfulness of processing’, is worded as follows:1.Processing shall be lawful only if and to the extent that at least one of the following applies:(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;(c) processing is necessary for compliance with a legal obligation to which the controller is subject;…(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.2. Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.3.The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:(a) Union law; or(b) Member State law to which the controller is subject.… The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.’
8Article 13(1) of that regulation provides:‘Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:…(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;…’
German law
9Paragraph 161 of the Handelsgesetzbuch (Commercial Code), in the version applicable to the disputes in main proceedings, provides:(1) A partnership formed for the purpose of carrying on a commercial business under a joint business name is a partly limited partnership if the liability of one or more of the partners is limited vis-à-vis the partnership’s creditors to the amount of a specific contribution of assets (limited partners), while the other partners have unlimited liability (general partners).(2) Unless this Part provides otherwise, the provisions applicable to the general partnership shall apply to the partly limited partnership.’
10Paragraph 162(1) of that code is worded as follows:‘The application for registration of the partnership shall contain, in addition to the particulars specified in Paragraph 106(2) [(including each partner’s surname, forename, date of birth and place of residence)], the names of the limited partners and each limited partner’s respective amount of contribution for which the limited partner is liable towards third parties. …’
11Paragraph 127a(1) and (3) of the Aktiengesetz (Law on Public Limited Companies), in the version applicable to the disputes in the main proceedings, provides:(1) Shareholders or associations of shareholders may invite other shareholders in the shareholder forum of the Bundesanzeiger [(German Federal Gazette)] to act jointly or by proxy for the purpose of filing a motion or request in accordance with the present act or to exercise their voting rights at a general meeting.…(3) The invitation may contain information concerning the website of the person making the invitation and that person’s electronic address. …’
12The first sentence of Paragraph 33(1) of the Wertpapierhandelsgesetz (Law on Securities Trading), in the version applicable to the disputes in the main proceedings, provides:‘Any party (the party subject to the notification requirement) whose home country is the Federal Republic of Germany and whose shareholding in an issuer reaches, exceeds or falls below 3%, 5%, 10%, 15%, 20%, 25%, 30%, 50% or 75% of the voting rights attaching to shares belonging to that party by purchase, sale or other means, must notify this to the issuer and simultaneously to the Bundesanstalt (Federal Financial Supervisory Authority) without undue delay, and at the latest within four trading days, in compliance with Paragraph 34(1) and (2). …’
The disputes in the main proceedings and the questions referred for a preliminary ruling
13It is apparent from the orders for reference that HTB and Ökorenta are investment companies which each hold shares indirectly through a trust company in investment funds. Those investment funds are organised in the form of a limited partnership, that is to say, a partnership offering shares for public subscription. Shareholdings in those limited partnerships are devised as a financial investment. Where those shareholdings are indirect, partners exercise their right through trust companies.
14The applicants in the main proceedings request the defendants in the main proceedings, which are trust companies, to disclose the names and addresses of all their partners with indirect shareholdings in the investment funds concerned, through trust companies.
15The defendants in the main proceedings object to such a disclosure, taking the view that the data requested are intended to serve the economic interests of the applicants in the main proceedings, consisting in advertising their own investment products, causing concern among investors, or purchasing their shares at a price below their value and making a profit by reselling them. The investment and trust agreements under which the partners of the defendants in the main proceedings have acquired shareholdings held indirectly in the investment funds concerned contain clauses prohibiting disclosure of those data to other shareholders.
16The applicants in the main proceedings deny having such intentions and assert their right to contact the other limited partners with shareholdings in the investment funds concerned, inter alia, in order to enter into share purchase negotiations.
17The referring court notes, in essence, that, in accordance with the case-law of the Bundesgerichtshof (Federal Court of Justice, Germany) and the Oberlandesgericht München (Higher Regional Court, Munich, Germany), the disclosure of personal data requested by the applicants in the main proceedings could prove to be mandatory. However, it observes that since that case-law in part predates the entry into force of the GDPR, it might have to be assessed differently in the present case, having regard to points (b) and (f) of the first subparagraph of Article 6(1) of that regulation, the interpretation of which is decisive for the resolution of the disputes in the main proceedings.
18In particular, the referring court states that it follows from the order of the Bundesgerichtshof (Federal Court of Justice) of 19 November 2019 (II ZR 263/18), that, in a partnership, such as a limited partnership, the right of a partner to know the name and address of other partners is part of the ‘essential core rights of partners’. That right also applies in relation to limited partnerships with only indirect shareholdings. The knowledge of all other partners, including those with indirect shareholdings, is necessary to make effective use of the rights held by each partner in a partnership offering shares for public subscription. Disclosure of those personal data to other partners is therefore in keeping with the obligations which are incumbent on the partnership pursuant to the contract under which it is established. The only exception to the right of obtaining such data under German law consists in the prohibition of an abuse of rights, which prohibits the right to information from being exercised unlawfully or with harmful intent.
19In accordance with the case-law of the Bundesgerichtshof (Federal Court of Justice), the abuse of rights is, in any event, ruled out where an investor seeks contact with other investors in order to discuss matters concerning the partnership with them and, where appropriate, to organise a commonality of interests between investors. Moreover, there is no reason to refuse to provide information on the ground that there is a purely abstract risk of misuse of those personal data. In addition, a partner must be able to access the data of the other partners of the partnership directly, without depending on that partnership’s managing bodies.
20It also follows from that case-law that such a right to information cannot be precluded by contractual provisions, otherwise an essential right of the partners, namely the right to convene an extraordinary meeting of partners would in fact be suppressed since the quorums necessary for that purpose can be obtained by a partner with a small shareholding only if that partner joins other partners, which necessarily presupposes that he or she knows their names and addresses (order of the Bundesgerichtshof (Federal Court of Justice) of 21 September 2009 – (II ZR 264/08)). According to that case-law, recital 48 of the GDPR would also justify that, within a group of undertakings, the personal data of all the partners may be transmitted to one of them for internal administrative purposes.
21In the view of the referring court, the case-law of the Bundesgerichtshof (Federal Court of Justice) thus affirms the existence, in essence, of a right to information of the partners which is limited only by an abuse of rights.
22The referring court also refers to the judgment of 16 January 2019 of the Oberlandesgericht München (Higher Regional Court, Munich) (7 U 342/18), according to which the main subject matter of the partnership agreement is the exercise of the partners’ rights, including that of strengthening their position within the partnership. The purchase of shares in a partnership thus constitutes a lawful exercise of those rights and the disclosure of information relating to other partners for that purpose equates to a reasonable interest. Such a disclosure should be refused only if it is not intended to satisfy any reasonable interest.
23The referring court is uncertain as to the compatibility of the case-law of the Bundesgerichtshof (Federal Court of Justice) and the Oberlandesgericht München (Higher Regional Court, Munich) with EU law, in so far as it allows extensive disclosure of the personal data of partners with indirect shareholdings in an investment fund on the basis of a purely formal claim of an interest on the part of the other partners to obtain such data, for example, for the purpose of acquiring shareholdings.
24It takes the view that, under EU law, protection of personal data is the rule, with the result that the exception to that principle, provided for inter alia in points (b) and (f) of the first subparagraph of Article 6(1) of the GDPR, which authorises disclosure of that data, must be based on ‘sufficient justification’. That court further states that there is no legal obligation under German law to publish the data concerning persons with shareholdings in a trust company. Thus, the referring court asks whether a right of access to partners’ data should not be subject, first, to a certain shareholding threshold, by analogy to what is provided for in German law in respect of listed public limited companies and, second, to a specific and precise reason, linked to the partnership, concerning the partners in respect of whom such information is requested.
25In those circumstances the Amtsgericht München (Local Court, Munich, Germany) decided to stay the proceedings in the two cases in the main proceedings and to refer the following identical questions to the Court of Justice for a preliminary ruling:(1)(a) Is [the first subparagraph of] Article 6(1)(b) and (f) of the [GDPR] to be interpreted as meaning that, in the case of a [partnership offering shares for public subscription], a limited partner with negligible liability has a “legitimate interest” in obtaining information relating to all partners with shares held indirectly through a trustee, together with their contact details and the number of their shares in such a partnership, and a contractual obligation to that effect must be inferred from the partnership agreement?(b) Or is a legitimate interest restricted under such circumstances to obtaining from the partnership information on limited partners with shares held indirectly and, rather than bearing negligible liability, hold shares above a minimum threshold that may, at least potentially, allow them to influence the future of the partnership?(2)(a) Does the intention to make contact for the purpose of becoming better acquainted, exchanging views or negotiating the purchase of shares in the partnership suffice in order not to exceed the limits to prevent abuse of rights inherent in such an unrestricted right [Question (1)(a)] or to make an exception to the restriction applicable to a restricted right to information [Question (1)(b)]?(b) Or is an interest in information potentially relevant only where its disclosure is requested with the express intention of contacting other partners in order to invite them to coordinate on specifically designated matters on which a consensus is needed for the purpose of partners’ resolutions?’
Procedure before the Court
26By decision of 23 September 2022, the President of the Court stayed the present proceedings pending final judgment in Case C‑252/21.
27In accordance with the decision of the President of the Court of 7 July 2023, the Registry notified the referring court of the judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, requesting it to state whether, in the light of that judgment, it wished to maintain its requests for a preliminary ruling, in whole or in part.
28By letter of 4 August 2023, lodged at the Court Registry the same day, that court stated that it maintained its requests for a preliminary ruling.
Consideration of the questions referred
29By its questions referred for a preliminary ruling, which it is appropriate to consider together, the referring court asks, in essence, whether points (b) and (f) of the first subparagraph Article of 6(1) of the GDPR must be interpreted as meaning that the processing of personal data which consists in disclosing, at the request of a partner of an investment fund established in the form of a partnership offering shares for public subscription, information on all the partners with indirect shareholdings in that fund, through trust companies, irrespective of the size of their shareholding in the capital of those funds, for the purpose of contacting them and negotiating the purchase of their shares or to coordinate with them for the purpose of reaching a consensus in connection with partners’ resolutions, may be regarded as being necessary for the performance of a contract to which the data subjects are parties within the meaning of point (b), or for the purposes of legitimate interests pursued by the controller or by a third party within the meaning of point (f).
30Since it is apparent from the requests for a preliminary ruling that the referring court is uncertain as to the compatibility with the GDPR of the obligation to disclose such data arising, under German law, from the case-law of the national courts, it is necessary to reformulate the questions referred as extending to the interpretation of point (c) of the first subparagraph of Article 6(1) of that regulation and to take the view that, by its questions, the referring court is also uncertain as to whether such a disclosure may be regarded as being based on a legal obligation to which the controller is subject.
31In order to answer those questions, as a preliminary point, it should be borne in mind that the objective pursued by the GDPR, as is apparent from Article 1 thereof and recitals 1 and 10 thereof, consists, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal data, as enshrined in Article 8(1) of the Charter and Article 16(1) TFEU (judgment of 7 March 2024, IAB Europe, C‑604/22, EU:C:2024:214, paragraph 53 and the case-law cited).
32In accordance with that objective, any processing of personal data must, in particular, comply with the principles relating to the processing of such data set out in Article 5 of that regulation and satisfy the lawfulness conditions listed in Article 6 of that regulation (see, to that effect, judgments of 6 October 2020, La Quadrature du Net and Others, C‑511/18, C‑512/18 and C‑520/18, EU:C:2020:791, paragraph 208, and of 11 July 2024, Meta Platforms Ireland (Representative action), C‑757/22, EU:C:2024:598, paragraph 49).
33In that regard, it should be noted that, under Article 5(1)(a) of the GDPR, personal data are to be processed lawfully, fairly and in a transparent manner in relation to the data subject.
34In particular, as regards the conditions for lawful processing, as the Court has held previously, the first subparagraph of Article 6(1) of the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful. Thus, in order to be capable of being regarded as such, processing must fall within one of the cases provided for in that provision (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 90).
35In the light of the specific features of the disputes in the main proceedings, it must also be observed that the first subparagraph of Article 6(1) does not, in itself, set out an obligation, but merely expresses the possibility of processing personal data in the situations that it lists (see, by analogy, judgment of 4 May 2017, Rīgas satiksme, C‑13/16, EU:C:2017:336, paragraph 26).
36Under point (a) of the first subparagraph of Article 6(1) of the GDPR, the processing of personal data is lawful if and to the extent that the data subject has given consent to that processing for one or more specific purposes. In the absence of such consent, or where that consent has not been given in a free, specific, informed and unambiguous manner within the meaning of point 11 of the first paragraph of Article 4 of that regulation, such processing is nevertheless justified where it meets one of the requirements of necessity referred to in points (b) to (f) of the first subparagraph of Article 6(1) of that regulation.
37In that context, the justifications provided for in that latter provision, in so far as they allow the processing of personal data carried out in the absence of the data subject’s consent to be made lawful, must be interpreted restrictively (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 93 and the case-law cited).
38Furthermore, as the Court has held, where it can be found that the processing of personal data is necessary in respect of one of the justifications provided for in points (b) to (f) of the first subparagraph of Article 6(1) of the GDPR, it is not necessary to determine whether that processing also falls within the scope of another of those justifications (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 94 and the case-law cited).
39The Court has also held that, in accordance with Article 5 of the GDPR, the controller bears the burden of proving that those data are collected, inter alia, for specified, explicit and legitimate purposes and that they are processed lawfully, fairly and in a transparent manner in relation to the data subject. In addition, according to Article 13(1)(c) of that regulation, where personal data are collected from the data subject, the controller must inform the data subject of the purposes of the processing for which those data are intended as well as the legal basis for the processing (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 95).
40In the present case, it is apparent from the documents before the Court that partners with indirect shareholdings, through trust companies, in the investment funds concerned have not given their consent, within the meaning of point (a) of the first subparagraph of Article 6(1) of the GDPR, to the disclosure by the defendants in the main proceedings of their personal data to third parties, in particular, to HTB and Ökorenta.
41In those circumstances, in order to answer the questions raised, it must be ascertained whether the provisions of points (b) and (f) of the first subparagraph of Article 6(1) of that regulation, referred to specifically in the requests for a preliminary ruling, may be relied on to justify the possible disclosure of those data to those third parties.
42As regards, in the first place, point (b) of the first subparagraph of Article 6(1) of the GDPR, that provision provides that processing of personal data is lawful if it is ‘necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.
43In that regard, the Court has held previously that, in order for the processing of personal data to be regarded as necessary for the performance of a contract within the meaning of that provision, it must be objectively indispensable for a purpose that is integral to the contractual obligation intended for the data subject. The controller must therefore be able to demonstrate how the main subject matter of the contract cannot be achieved if the processing in question does not occur (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 98).
44As the Court has also held, the decisive factor for the purposes of applying the justification set out in point (b) of the first subparagraph of Article 6(1) of the GDPR is that the processing of personal data by the controller must be essential for the proper performance of the contract concluded between the controller and the data subject and, therefore, that there are no workable, less intrusive alternatives (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 99).
45In the present case, it is apparent from the orders for reference that the investment and trust agreements at issue in the main proceedings, under which the indirect shareholdings were acquired in the investment funds concerned, expressly prohibit the disclosure of data concerning indirect investors and other shareholders.
46In that respect, it should be noted that the essential feature of acquiring an indirect shareholding, through a trust company, in an investment fund offering shares for public subscription is precisely the anonymity of the partners, including in relations between the partners themselves. In other words, it is by taking account of the confidential processing of their data by the investment fund that persons choose a financial investment in such a fund in the form of a shareholding through a trust company.
47Accordingly, subject to verification by the referring court, the processing of confidential data, consisting in disclosing information concerning partners with indirect shareholdings through a trust company in an investment fund offering shares for public subscription, cannot be regarded as being ‘necessary for the performance of a contract’ within the meaning of point (b) of the first subparagraph of Article 6(1) of the GDPR, where the contract on which the acquisition of such a shareholding is based expressly prohibits the disclosure of those data to other shareholders.
48As regards, in the second place, point (f) of the first subparagraph of Article 6(1) of the GDPR, that provision provides that the processing of personal data is lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of those personal data.
49As the Court has held previously, that provision lays down three cumulative conditions so that the processing of personal data covered by that provision is lawful, namely, first, the pursuit of a legitimate interest by the data controller or by a third party; second, the need to process personal data for the purposes of the legitimate interests pursued; and, third, that the interests or fundamental freedoms and rights of the person concerned by the data protection do not take precedence (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 106 and the case-law cited).
50As regards, first, the condition relating to the pursuit of a ‘legitimate interest’, it should be emphasised that, in the absence of a definition of that concept in the GDPR, as the Court has held previously, a wide range of interests is, in principle, capable of being regarded as legitimate (judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C‑26/22 and C‑64/22, EU:C:2023:958, paragraph 76).
51Second, with regard to the condition that the processing of personal data be necessary for the purposes of the legitimate interests pursued, that condition requires the referring court to ascertain that the legitimate data processing interests pursued cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights and freedoms of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter (judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C‑26/22 and C‑64/22, EU:C:2023:958, paragraph 77 and the case-law cited).
52In that context, it should also be recalled that the condition relating to the need for processing must be examined in conjunction with the ‘data minimisation’ principle enshrined in Article 5(1)(c) of the GDPR, in accordance with which personal data must be ‘adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed’ (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 109 and the case-law cited).
53Lastly, as regards, third, the condition that the interests or fundamental rights and freedoms of the person concerned by the data protection do not take precedence over the legitimate interests of the controller or of a third party, the Court has held previously that that condition entails a balancing of the opposing rights and interests at issue which depends in principle on the specific circumstances of the particular case and that, consequently, it is for the referring court to carry out that balancing exercise, taking account of those specific circumstances (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 110 and the case-law cited).
54Furthermore, recital 47 of the GDPR states that the interests and fundamental rights of the data subject may in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect such processing (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 112).
55While it is ultimately for the national court to assess whether, in relation to the processing of personal data at issue in the main proceedings, the three conditions referred to in paragraph 49 of this judgment are satisfied, it is open to the Court, when giving a preliminary ruling on a reference, to give clarifications to guide the national court in that determination (judgments of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 96, and of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C‑26/22 and C‑64/22, EU:C:2023:958, paragraph 81 and the case-law cited).
56In the present case, as regards, first, the condition relating to the pursuit of a legitimate interest by the controller or by a third party within the meaning of point (f) of the first subparagraph of Article 6(1) of the GDPR, the referring court refers to the interest of a third party, namely the interest of a partner with an indirect shareholding in an investment fund established in the form of a limited partnership offering shares for public subscription, to obtain personal data relating to the other indirect partners of that partnership with a view to entering into contract with them or negotiating with them the purchase of shares, or coordinating with them for the purpose of reaching a consensus in connection with resolutions of all the partners.
57It must be held that such an interest is, in principle, likely to constitute, for the purpose of disclosing personal data, a legitimate interest within the meaning of point (f) of the first subparagraph of Article 6(1) of the GDPR, having regard, in particular, to the status of such a partnership, as it results from the national law of the Member State concerned, irrespective of the size of the shareholding and the powers held in that partnership by the partner which requested disclosure. It is however for the referring court to assess, on a case-by-case basis, the existence of such an interest, taking into account the legal framework applicable and all the circumstances of the case.
58Where such a legitimate interest is established, it is also necessary, in order for the pursuit of that interest to allow the processing of personal data, under point (f) of the first subparagraph of Article 6(1) of the GDPR, that the controller comply with all its other obligations under that regulation.
59Second, as regards the condition relating to the necessity of such processing to achieve that interest and, in particular, the existence of means less restrictive of the fundamental rights and freedoms of data subjects and equally appropriate, it must be stated that it is, in particular, possible for the partner of an investment fund wishing to obtain information concerning another partner with an indirect shareholding in that fund through a trust company to ask that fund or that company directly to transfer its request to the partner concerned, for the purpose of becoming acquainted or exchanging views with that partner. That partner could then freely decide whether it wishes to make contact with the requesting partner or whether it prefers not to allow such a request and to remain anonymous. Such a solution could also be applied in the case where the requesting partner wishes to enter into negotiations with another partner with the aim of purchasing shares from that partner or to coordinate with that partner for the purpose of reaching a consensus in connection with resolutions of all the partners.
60That solution would also make it possible for the partner concerned by the request for information, in accordance with the data minimisation principle referred to in paragraph 52 of this judgment, to retain control over the processing of its personal data and to thus limit their disclosure to another partner to what is in fact necessary and relevant in the light of the purposes in respect of which those data are requested and processed.
61It cannot, therefore, be ruled out that a procedure such as that described in the preceding paragraph of this judgment may be regarded as a measure involving the least intrusion in the right to protection of the confidentiality of the data subject’s personal data, whilst allowing the controller to pursue, in an equally efficient manner, the legitimate interest of the third party concerned, which it is however for the referring court to ascertain.
62Third, as regards the balancing of interests which it is for the referring court to carry out in the light of the specific circumstances of the present case, that court must take account, in particular, of the reasonable expectations of the data subject as well as the scale of the processing at issue and its impact on that person (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 116).
63It follows that, in such a balancing exercise, first, in cannot, in principle, be ruled out that the disclosure of partners’ personal data, even indirect partners, of a partnership, to other partners may serve, as the case may be, the economic interests of each of them and, therefore, also the interests of the indirect partners whose personal data those other partners wish to access.
64Second, nor can it be ruled out that the interest of the partners with indirect shareholdings in an investment fund in their personal data remaining confidential may override the interest of the other partners seeking to obtain their contact details. In that light, it is necessary to attach particular significance to the fact that it is likely, with regard, in particular, to the contractual provisions referred to in paragraph 45 of this judgment, that the indirect partners of such an investment fund could not reasonably expect, at the time when their personal data are collected, that those personal data are disclosed to third parties, in the present case, to other indirect partners of that investment fund.
65It follows from all the foregoing considerations, and subject to the final assessment of the referring court, that it appears doubtful that the processing of personal data, such as the disclosure of the information requested by the applicants in the main proceedings, may be justified in respect of a legitimate interest within the meaning of point (f) of the first subparagraph of Article 6(1) of the GDPR.
66As regards, in the third place, point (c) of the first subparagraph of Article 6(1) of the GDPR, that provision provides that the processing of personal data is lawful if processing is necessary for compliance with a legal obligation to which the controller is subject.
67Article 6(3) of the GDPR specifies, inter alia, in that respect, that the processing must be based on EU law or on Member State law to which the controller is subject, and that that legal basis must meet an objective of public interest and be proportionate to the legitimate aim pursued (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 128).
68Moreover, as recital 41 of that regulation states, where it refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament, without prejudice to obligations provided for under the constitutional order of the Member State concerned. However, such a legal basis or legislative measure should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of the Court and the European Court of Human Rights.
69In the present case, first, EU law does not lay down any obligation for investment funds or trust companies, such as those in the cases in the main proceedings, to disclose personal data of partners with indirect shareholdings in those funds.
70Second, it follows from the requests for a preliminary ruling that such an obligation could nevertheless be inferred, subject to the verifications to be carried out by the referring court in that regard, from the case-law of the Bundesgerichtshof (Federal Court of Justice) and the Oberlandesgericht München (Higher Regional Court, Munich), under which the contractual clauses which ensure confidentiality of contact details of the indirect partners of a partnership offering shares for public subscription, such as those at issue in the main proceedings, should be regarded as invalid, with the result that it would be necessary to disclose the personal data of partners with indirect shareholdings in an investment fund established in the form of a limited partnership offering shares for public subscription.
71In that regard, it should be noted that, consistently with what is stated in paragraph 68 of this judgment, it cannot be ruled out that ‘Member State law to which the controller is subject’ within the meaning of point (b) of Article 6(3) of the GDPR also covers national case-law.
72However, as is apparent from recital 41 of that regulation, such case-law must be clear and precise and its application must be foreseeable by those persons subject to it, in accordance with the case-law of the Court.
73Furthermore, in accordance with the case-law referred to in paragraph 67 of this judgment, that case-law must constitute a legal basis, meeting an objective of public interest, it must be proportionate to that objective and the processing concerned must be carried out only in so far as is strictly necessary, which it is for the referring court to ascertain (see, to that effect, judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraphs 134 and 138).
74It will thus be for that court to determine, in particular, whether there are no measures which, whilst making it possible to ensure transparency between the partners of partnerships, as it appears to result from German law, and as has been set out in paragraphs 18 to 22 of this judgment, are less restrictive of the protection of confidential personal data of indirect partners of limited partnerships offering shares for public subscription than the obligation to disclose those data to any other partner which requests them.
75In the light of all the foregoing, the answer to the questions raised is that point (b) of the first subparagraph of Article of 6(1) of the GDPR must be interpreted as meaning that the processing of personal data which consists in disclosing, at the request of a partner of an investment fund established in the form of a partnership offering shares for public subscription, information on all the partners with indirect shareholdings in that fund, through trust companies, irrespective of the size of their shareholding in the capital of those funds, for the purpose of contacting them and negotiating the purchase of their shares or to coordinate with them for the purpose of reaching a consensus in connection with partners’ resolutions, may be regarded as being necessary, within the meaning of that provision, for the performance of the contract pursuant to which those partners have purchased such shareholdings, only on condition that that processing is objectively indispensable for a purpose that is integral to the contractual obligation intended for those same partners, with the result that the main subject matter of the contract could not be achieved if that processing were not to occur. That is not the case if that contract expressly prohibits the disclosure of those personal data to other shareholders.
76Point (f) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that such processing may be regarded as being necessary for the purposes of legitimate interests pursued by a third party, within the meaning of that provision, only on condition that that processing is strictly necessary to achieve such a legitimate interest and that, in the light of all the relevant circumstances, the interests or fundamental rights and freedoms of those partners do not override that legitimate interest.
77Point (c) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that that processing of personal data is justified, under that provision, where it is necessary for compliance with a legal obligation to which the controller is subject, under the law of the Member State concerned, as stated by the case-law of that Member State, on condition that that case-law is clear and precise, that its application is foreseeable for those persons subject to it and that it meets an objective of public interest and is proportionate to it.
Costs
78Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
Operative part
On those grounds, the Court (Fourth Chamber) hereby rules:
1.Point (b) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),must be interpreted as meaning that the processing of personal data which consists in disclosing, at the request of a partner of an investment fund established in the form of a partnership offering shares for public subscription, information on all the partners with indirect shareholdings in that fund, through trust companies, irrespective of the size of their shareholding in the capital of those funds, for the purpose of contacting them and negotiating the purchase of their shares or to coordinate with them for the purpose of reaching a consensus in connection with partners’ resolutions, may be regarded as being necessary, within the meaning of that provision, for the performance of the contract pursuant to which those partners have purchased such shareholdings, only on condition that that processing is objectively indispensable for a purpose that is integral to the contractual obligation intended for those same partners, with the result that the main subject matter of the contract could not be achieved if that processing were not to occur. That is not the case if that contract expressly prohibits the disclosure of those personal data to other shareholders.
2.Point (f) of the first subparagraph of Article 6(1) of Regulation 2016/679must be interpreted as meaning that such processing may be regarded as being necessary for the purposes of legitimate interests pursued by a third party, within the meaning of that provision, only on condition that that processing is strictly necessary to achieve such a legitimate interest and that, in the light of all the relevant circumstances, the interests or fundamental rights and freedoms of those partners do not override that legitimate interest.
3.Point (c) of the first subparagraph of Article 6(1) of Regulation 2016/679must be interpreted as meaning that that processing of personal data is justified, under that provision, where it is necessary for compliance with a legal obligation to which the controller is subject, under the law of the Member State concerned, as stated by the case-law of that Member State, on condition that that case-law is clear and precise, that its application is foreseeable for those persons subject to it and that it meets an objective of public interest and is proportionate to it.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.