Page 1

Position
legal entities and natural persons - entrepreneurs
from the point of view of personal data protection
The regulation protects the fundamental rights and freedoms of natural persons , in particular their right
for the protection of personal data. According to recital 14 of the Regulation, this Regulation does not apply to
processing of personal data concerning legal persons , in particular established companies
as legal entities, including the name, form and contact details of the legal entity.
In this context, we draw attention to the conclusions of the judgment of the Court of Justice of the European Union
Union 1 , according to which legal persons may invoke protection only to the extent that the name
legal entity identifies one or more natural persons. It is also possible to mention also
Opinion of Working Group WP29 4/2007, according to which information on legal
persons may also be considered to be related to natural persons, for example if the name
of a legal person is derived from the name of the natural person.
The Office for Personal Data Protection of the Slovak Republic (hereinafter referred to as the “Office”)
at present, it interprets the question in question in such a way that it is clear from the relevant recital 14 of the Regulation that
that even in the processing of data on enterprises established as legal persons may occur
1
to the processing of personal data of natural persons. Regulation as well as Act no. 18/2018 Coll. in
however, it does not apply to the processing of such personal data.
Personal data of natural persons representing a legal entity shall act on its behalf,
are subject to full protection under Regulation and Act no. 18/2018 Coll., Therefore for example
also to the data on the statutory representatives of the legal entity, which are contained in the contractual
documentation 2 , or are listed on portals containing mainly economic information
on companies (publicly available sources 3 ), the legislation under the Regulation applies
and Act no. 18/2018 Coll. The above applies, of course, only in cases where processing
occurs within the scope of activities that do not fall within the scope of the Regulation (Articles 2 and 3) and Act no. 18/2018
Z. z. excluded.
Natural persons operating a trade in accordance with Act no. 455/1991 Coll.
on Trade Licensing (Trade Licensing Act) as amended and natural persons
carrying out business activities according to special legal regulations (so - called free

More specifically the judgment of the CJEU in Joined Cases C-92/09 and C-93/09, Volker und markus Schecke GbR and Hartmut
Eifert v Land Hessen, 9 November 2010, paragraphs 53, 54 and 87
1

legal basis for processing in this case may be, for example, a legitimate interest under Art. 6 par. 1
Regulations or the contract itself in accordance with Art. 6 par. 1 letter b) Regulations. Regarding contact details
employees of the Contracting Parties, such personal data shall be provided by contract to the other Contracting Party by the operator in
position of the employer, in accordance with § 78 par. 3 of Act no. 18/2018 Coll. Contact details of the legal entity that
can be assigned to a specific natural person (e.g. Anna.Nova@firma.sk) are therefore also protected under
Regulation / Act no. 18/2018 Coll.
3 Eg. Act no. 530/2003 Coll. on the Commercial Register as amended or Act no. 431/2002 Coll.
2 The

on accounting as amended.

Page 2

professions ) (hereinafter collectively referred to as the “natural person-entrepreneur”) are specific in this context
group.
Personal data is any information relating to an identified or identifiable physical
persons - "the person concerned". An identifiable natural person is a person who can be identified directly or
indirectly, in particular by reference to an identifier such as name, identification number, location data, online identifier,
or by reference to one or more elements which are specific to the physical, physiological, genetic, mental,
economic , cultural or social identity of that natural person.

The possibility of identifying the person concerned, whether directly or indirectly, is necessary
reasonably assume. It is therefore not just a hypothetical possibility of identifying the person concerned
a person who would require extraordinary effort 4 or costs that would ultimately
nor did they necessarily lead to successful identification. As stated in the case of Patrick Breyer
v Federal Republic of Germany 5 , in order to determine whether a person is identifiable, are to be
take into account any means that are reasonably likely to be used
the operator or any other person to identify the person concerned. Court of Justice
European Union stated that in order for a data to qualify as personal data,
it is not necessary to have all the information enabling the person concerned to be identified
they had to be in the hands of a single person. The key is the result, that is, the possibility
and the ability to uniquely identify and reliably distinguish a natural person from others
natural persons.

2

In Amann v Switzerland 6, the ECtHR pointed out that the term private life must not be allowed
interpreted restrictively. In this case, the public authorities intercepted the business telephone call
of the complainant. Although the interception concerned a business telephone call, the ECtHR did
considered that the retention of data on this call was linked to private life
complainant and stated that respect for private life included the right to follow up
and building relationships with other human beings. Moreover, there was no principle
a reason which would justify the exclusion of an activity of an occupational or commercial nature from the concept
private life.
The ECtHR stated in Niemietz v. Germany that it could be too restrictive
to limit the notion of private life to a "sovereign circle". Respect for private life
it must also include, to some extent, the right to establish and develop relationships with other people.
Furthermore, there is no reason why the concept of private life should be regarded as exclusive
activities of a professional or commercial nature, because he has during his working life
Most people have a significant, if not the greatest opportunity to develop relationships with the outside world. This
this view is supported by the fact, as the Commission has rightly pointed out, that it is not always possible to be precise
recognize which activities of an individual form part of his or her professional or business life; and
which do not. Therefore, especially if an individual pursues a liberal profession, his work can
The Supreme Court of the Slovak Republic in decision no. zn. 6 Sžo 250/2008 defined that by a disproportionately high effort
means obtaining data from a hard-to-reach source, obtaining data by long-term search,
by multiple verification, comparison and sorting, or by obtaining data by means of a survey, the results of which are
can be assigned to more than one natural person, which needs to be further analyzed, specified and selected.
5 Judgment of the ECJ C-213/15, of 19 October 2016 Patrick Breyer v Federal Republic of Germany
6 ECtHR, Amann v. Switzerland, no. 27798/95, 16 February 2000, bod 65
4

Page 3

form part of his life to such an extent that it becomes impossible to determine in which area he acts in
at a given point in time. Refusal of protection under Article 8 of the European Convention on Human Rights
rights, on the grounds that the contested measure only covered professional activities
as proposed by the government in this case) could, moreover, lead to unequal
treatment, as this protection would not remain accessible to a person whose profession
and non-professional activities are linked in such a way that no distinction can be made between them. 7
In the case of Volker und Markus Schecke GbR SD of the EU stated that for assessment
the fact that the data published relate to professional activities is irrelevant. 8
It is also possible to refer to the judgment of the Supreme Administrative Court of the Czech Republic file no. zn. 1
Afs 60/2009, which states that the area of ​work activities of natural persons entrepreneurs
it is strongly connected with their private life. It is therefore not possible to approach across the board
to an analogous assessment as in the case of legal entities to which the Protection Act applies
personal data does not apply. “It is also necessary to take into account that the taxi driver in his vehicle
spends most of his working day. Taxi driver during his ride with the customer
establishes and develops contacts with the outside world. If otherwise, it would be a problem
unambiguously identify and distinguish what personal manifestations of the taxi driver during the interaction with the customer
can be characterized as a work activity and what already constitutes his private life. Especially
3
in such a case, where the individual pursues a liberal profession, the work is part of his
private life and it is not possible to determine the extent to which he is working or realizing at a given moment
your private life. ” 9
The Office respects the case law of the European Court of Human Rights in this matter
law and the Court of Justice of the European Union, which favor a broad interpretation of the term
the right to privacy, under which the protection of personal data may also be subsumed
relating to a trade or profession. There is no doubt that the information
on natural persons - entrepreneurs can be responsible in terms of their material content
definition of personal data. The affected person can also be a natural person - entrepreneur,
as it is not excluded that his privacy and personal protection may be violated
data. In connection with the above, the Office is of the opinion that even in the exercise of the profession, everyone has
the right to adequate protection of privacy, which also includes the protection of personal data. Aj
having regard to the close link between the private and professional lives of natural persons,
entrepreneurs, when processing data about them, the natural person who will be identified may be identified
identified on the basis of features forming the performance of the activity of a natural person - entrepreneur.
Possible separation of some data outside the scope of Regulation / Act no. 18/2018 Coll.
it can only be done on an ad hoc basis, taking into account the individual circumstances of the case, as
determining whether it is personal data always depends on a comprehensive assessment of the available data
in their interrelationship and at the same time the situation as a whole.

ECtHR, Niemietz v. Germany, no. 13710/88, 16 December 1992, paragraph 29
8 For more details, see Joined Cases C-92/09 and C-93/09 Volker und markus Schecke GbR, paragraph 59
9 Available on the website:
7

http://www.nssoud.cz/files/SOUDNI_VYKON/2009/0060_1Afs_0900119A_prevedeno.pdf

Page 4

In conclusion, the Authority adds that the European Commission also emphasizes that the Regulation applies
for natural persons only. If, in a Member State, a natural person carries out economic activities, but
under the national law of a Member State is not considered to be a legal person, then
this person should have been granted protection under the Regulation. 10

4

Abbreviations used:
Regulation - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals
in the processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC
(General Data Protection Regulation)
Act no. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts

10

http://ec.europa.eu/transparency/regexpert/index.cfm?do=groupDetail.groupDetailDoc&id=31371&no=2

