This article explains the legitimate interest of the Registry and Storybook in the processing of personal data available from public sources on the websites Inforegister.ee and scorestorybook.ee (hereinafter "information portal") in accordance with Article 6 (1) (f) of the General Data Protection Regulation (EU 2016/679).

What data is processed?

We process personal data relating to natural persons related to legal entities (hereinafter “data subject” or “natural person”) that is available from public sources. The source of such personal data is, in particular, the business register. The composition of the personal data of natural persons related to legal persons from public sources that we process is as follows:

• first and last name
• personal identification code and date of birth
• the role in the legal person and its beginning and end (eg member of the management board, shareholder, member of the supervisory board, beneficial owner, procurator, liquidator, trustee in bankruptcy)
• business and business bans;
• contacts

We, in turn, combine the above personal data with data concerning legal entities related to the data subject, which are not personal data. This creates different links between the data subject and the companies. The information portal processes the personal data of valid and invalid representatives of legal entities and other related persons in accordance with the privacy policy. This means that valid and invalid links between data subjects and legal entities are published on the information portal.

We do not collect personal data in connection with the data subject's assets. In connection with companies, we collect court decisions from the Register of Judgments, Official Announcements, media articles from mainstream publications, various data from company-related websites (website, Facebook, etc.), procurement-related documents from the Public Procurement Register and job offers from the Unemployment Insurance Fund, but we do not make inquiries , not related to business. We cannot rule out that the data available from the sources cited contain personal data. However, these personal data are not linked to the data subject's non-business activities and the links are expressed primarily through the company related to the data subject.

We compile different scores (reputation and credit score) for companies, which are derived using different technologies when combining business data. We do not compile any scores for a data subject, only for companies related to the data subject. We may also publish the score with the data subject, but we will make sure that the score is marked accordingly and that the score refers to related companies. In this way, we ensure that the public does not attribute corporate scores to data subjects.

Users of the information portal have access to the personal data of data subjects collected from public sources. The composition of personal data disclosed to users depends on the level of access (unregistered user, registered user, registered contractual customer user), and the user can make personal data about himself / herself collected from public sources available to all users of the information portal.

Legitimate interest

According to Article 6(1)(f) of the GDPR, the processing of personal data is lawful where the processing of personal data is necessary in the legitimate interest of the controller or of a third party, unless such interest is overtweighed by the interests or fundamental rights of the data subject and the freedoms for which personal data must be protected. 

It follows from the foregoing that, on the basis of our legitimate interest, the processing of personal data is permitted if:

• we or the receiving third party or third parties have a legitimate interest in data processing
• the processing of personal data is necessary for the exercise of a legitimate interest
• our legitimate interests and/or those of a third party outweigh the interests, fundamental rights and freedoms of the data subject to be protected.

We explain below and based on the above assumptions our legitimate interest in processing personal data.

Our legitimate interest and those of third parties

Our legitimate interest lies in our business interests ,  i.e. the realisation of economic activities through the information portal. We provide the information portal user, inparticular  entrepreneurs (both legal and natural persons), with personal data (personal data available from public sources) in addition to the data of legal persons being published on the information portal. The data published on the information portal enables entrepreneurs to make informed business decisions,including verifying the background and reliability ofexisting or future business partners/entrepreneurs. 

Personal data related to legal persons also play an important role in the above activities, in so far as the economic activities of legal persons are directly carried out by natural persons (in particular members of the management board and other legal representatives), which is why personal data are also disclosed on the information portal for the provision of the service of using the information portal. The publication of personal data on the information portal is necessary in order to provide a comprehensive service that meets the needs of the client, since a natural person associated with a legal person, i.e. the background of companies related to a natural person, is inevitably of paramount importance in checking the background and reliability of the undertaking. For this purpose, the above personal data about a natural person are collected and combined with data related to companies related to a natural person and various insights and relationships are established on this basis.  In conclusion, such a service ensures a high level of interest from users in the information portal.

Personal data, which may be included in court decisions related to the company, the media, etc., are disclosed in connection with the company, and the above sources are extremely important for assessing the reliability of companies and thus meeting the needs of our customers. The inclusion of personal data in these sources is inevitable in so far as information portals cannot be expected to process information collected from sources in such a way that it does not contain personal data. In addition, the erasure of personal data also requires the processing of personal data and we are guided by the principle that we process personal data only to the extent necessary for the fulfilment of our purposes.

The legitimate interest of third parties lies in the legitimate interests of the public and users of our information portal.   Information portals play an important role in society to ensure overall civilian turnover and transparency and reliability of the business environment.

The information disclosed on the Information Portal ensures civil turnover and legal certainty, in so far as the legal representatives of the representatives of legal persons are published on the information portal and in this way the person entering into the transaction with the legal person can verify the existence of the right of representation, i.e. the trader has confidence in the validity of the transaction.

In addition, the information portal gives both entrepreneurs and other interested parties (e.g. employees looking for information about the background of a future employer) the opportunity to verify the reliability of enterprises by checking not only the background of companies, but also the background of natural persons involved. As explained above, although the participants in business transactions are mostly legal persons, decisions in business are made only by people, i.e. natural persons. Thus, at the will of the natural person, mh: new enterprises are created, although there are (manages) a large number of enterprises that do not generate turnover; failure to comply with the obligations of the report, even with a repetitive pattern; circular arrears are created; transfer of enterprises to shadow persons; join networks of shadow non-profit organisations; assets and values are transferred to a new business body, etc. Thus, the background of natural persons is also essential for checking the background and reliability of enterprises.

It is of the utmost importance that persons who enter into transactions with companies can mitigate potential financial losses and decide according to their moral and risk level: whether to enter into business relations with a company with which the related party has previously disposed of the last 3 companies to a shadow person; whether to enter into an employment relationship with a company the last 3 companies of which a member of the management board have been terminated with bankruptcy; whether to buy goods from the online store if the board member associated with the company has repeatedly left (e-commerce) companies to fade with debt and/or these companies are also blacklisted by the Technical Regulator, etc. The pattern of behavior of natural persons, including history and the relationship between events, plays a key role in entering into a business relationship with companies, since decisions are made on the part of the company by the same natural person in the future.

In the overall picture, the information portal promotes a transparent economic environment and prevents possible losses and costs that result from decisions made in relation to business partners due to incomplete information. In doing so, it is important to stress that damage to one undertaking may also be passed on to other undertakings (other business partners) as a domino effect. Among other things, the employees of the company may be affected as subjects of special protection, in case the damage caused to the company has a devastating effect on the company. Inevitably , the negative effects on workers will be passed on to society as a whole.

In court decisions related to the company, in the media, etc., important information (debts, offences, etc.) is published to assess the reliability of the company. Given that the Information Portal is not reasonably able to remove personal data from these sources (and the erasure of personal data also requires additional processing operations) and companies have a legitimate desire to consult court decisions and media articles related to the Company, it is also necessary to justify access to personal data contained by companies in these sources,all the more so since court decisions and media outlets are available to everyone without restriction.

In conclusion, we consider that the disclosure of personal data on the information portal promotes the freedom to conduct a business as a fundamental right of persons, which we consider consists, among other things, of the right of a person to use all legal and good manners for the purpose of doing business and developing a business (including making positive business decisions).

Necessity of processing personal data for the purpose of exercising a legitimate interest

The personal data processed in the Information Portal is necessary for the exercise of our legitimate interests and those of third parties.

As noted above, the processing of such personal data is necessary for the realization of our business interests, i.e. the provision of the service of using the information portal. Personal data stored on the information portal, such as the role, name and personal identification code of the representative of the legal person (which also indicates the date of birth of the person), are necessary in order to provide the users of the service with the most essential (to a minimum) information about the company and, if the corresponding personal data are not disclosed, persons would have no interest in using the information portal, since identifying representatives of legal persons is extremely important information for entrepreneurs. On the other hand, the disclosure of such personal data is necessary for the exercise of the legitimate interests of third parties. As explained above, when carrying out transactions, persons need to verify the right of representation of representatives of legal persons in order to verify the validity of the transactions. This means that the disclosure of such personal data is necessary for the public to ensure overall legal turnover and legal certainty.

The disclosure of other personal data (including business and business bans, (invalid) relationships between persons, contact details)is necessary so that we can provide our clients with a competitive service with as many functions as possible, including various overviews and summaries of the current and past activities and events of the natural person in business. Onthe otherhand, thedisclosure of such personal data isnecessary for the exercise of the interests of third parties. We have explained in detail above the reasons why persons (in particular, the companies used by the information portal,  but also other persons, e.g. employees) need to get acquainted with the background of future transaction partners. Given the tendencies and risks in the business environment (including tankers, front persons, persons who repeatedly leave insolvent associations, etc.), persons have an important interest in verifying the background of natural persons associated with a legal person  inorder to establish the reliability of the enterprise.  In order to establish the reliability of an undertaking, it is not enough to disclose the name and personal identification code of the representative  alone, since other information provides an overview of the reliability of the company. Such information is not only the company's own information, but also the background information of the natural person associated with the company, i.e. its links with various other companies and the performance and eventsof these companies. In so doing, invalid links also play a role, sincethe existing link between a natural person and a legal persondoes not nullify the commercial activities prior to it. Merely disclosing existing links would not serve the purpose of verifying the reliability of an enterprise, which is to obtain an overview of all relevant information relating to the enterprise, including the business activities related to the natural person associated with the enterprise.

We have also explained above that since companies have a legitimate desire to consult court decisions and media articles related to the company, etc. (in which personaldata cannot reasonably be removed), access to personal data contained by companies in these sources must also be considered justified, all the more sosince court decisions and media outlets are available to everyone without restriction.

Consideration of our interests and those of third parties and of the data subject

We understand that the disclosure of personal data of data subjects on the information portal may violate the fundamental right to privacy of data subjects under § 26 of the PS, just as any processing of personal data. At the same time, we have carried out an analysis and we consider that our interests and those of third parties outweigh the interests of the data subject in privacy.

Firstly, we assume that the amount of personal data processed is not large and that the personal data relate to activities within the public sphere, i.e. business activities. The data disclosed in this information portal with the data subject concern, inparticular, the companies related to him or her and not the data subject himself or herself. We also make requests to different public registers and other sources  on a company-by-company basis, and only then will such data establish a link with the data subject.

Secondly, we assume that the data subject is not children or other vulnerable members of society, but natural persons with legal capacity.

Thirdly, we assume that the data subject can reasonably expect that personal data relating to him or her will be processed when he or she takes up business. For example, each data subject must take into account that when joining the management board of a company, his or her name and personal identification code become public through the commercial register. The data subject may also take into account(a) that    persons (in particular business partners and other persons entering into a transaction with him or her) have a heightened interest in his or her background.

Fourthly, we proceed from the fact that the personuandmed has been made public in the past. Thus, for example, the name and personal identification code and business prohibition of the data subject are available to the public through the commercial register. In doing so, both in the Commercial Register and on the information portals, the purpose of publishing this data is, among other things, to ensure legal certainty and civil turnover. Likewise, business-related datasubjects can nowadays assume that their  personaldata, which arepublicly available,  will be processed due to a heightened interest in the background of entrepreneurs (including because entrepreneurs have become wary of various reprehensible business schemes) for purposes other than, for example, merely determining the right of representation of a member of the management board.  

Fifthly, we assume that the disclosure of data on the information portal for many data subjects has a positive impact, for example if the information portal shows that companies related to the data subject have an impeccable background. This, in turn, allows the data subject to facilitate the business activities of enterprises related to him or her, since other persons see these enterprises as reliable.

Sixthly, personal data that may be included in court decisions, media, etc. related tothe company are disclosed in relation to the company. If a natural person binds himself or herself to a legal person, he or she can reasonably expect the above data to also reflect his or her personal data and may be disclosed elsewhere for the purpose of assessing the company (without assessing the natural person). In addition, at the request of the data subject, we are ready to erase his or her personal data to the extent that business is not concerned.

Protective measures

We have put in place safeguards to protect the interests of the data subject and to balance them. We have provided the data subject with the possibility to supplement, modify and delete data on the Information Portal, as well as to object to the processing of personal data, in which case we consider that we will remove personal datathat are excessively damaging to the data subject or are not related to business. Inparticular , we respond to each objection on a personal basis. We have also restricted the availability of personal data on the information portal in such a way that in order to disclose certain personal data, the user must create an account and pay a fee. Such a solution ensures that the personal data of the data subject are not merely accessed out of curiosity. The above principle is based, inter alia, on the business register.

Retention of personal data

We consider it specifically necessary to consider for what reason we will erase personal data collected from public sources after 5 years from the end of the data subject's last valid relationship with a legal person.

Firstly, we are guided by our legitimate interest in providing an attractive and competitive service to our users. If we deleted the personal data of the data subject immediately after the relationship had expired or if we deleted the invalid relationships on an ongoing basis (5 years after the expiry of the relationship), the service provided to users would not be comprehensive and comprehensive, as users may mistakenly have the impression that the future transaction partner is trustworthy, although in reality the natural person associated with the transaction partner (in particular a member of the management board) has previously been involved in a number of unreliable companies (but the roles of a member of the management board ended in these companies e.g. more than 5 years ago). In this way, the usefulness of the information portal is reduced to the client and also the number of users and our revenue.

Secondly, we are guided by the legitimate interest of our users in obtaining an informative and useful service. It is in the legitimate interest of undertakings to make sure that they do not take excessive risks when entering into a transaction. Each company wishes to take as much information as possible into account when considering risks, while the case-law also obliges the member of the company's management board to carry out informed transactions with reasonable risk. Inevitably, the corporate risk assessment scope also includes the background of other companies related to the transaction partner, regardless of whether the relationship is direct (group) or whether the relationship is expressed through a natural person. Likewise, an enterprise cannot limit the risk analysis to a certain period of time, in so far as such an approach would be naïve in view of the schemes common in the business environment and, as mentioned above, decision-making on the basis of limited information may also give rise to the liability of a member of thecompany'smanagement board. We therefore consider that users also have a legitimate interest in getting acquainted with the invalid relationships of a natural person and with the respective companies, as long as the natural person is unlikely to be active in business in the near future.  

Thirdly, we assume that personal data will also be stored in sources of information, at least during this period. In particular, there is no restriction on the retention of data published in the Commercial Register, i.e. the data are stored forever. Thus, the retention period of personal data of data subjects on information portals is less infringing on the interests of data subjects than the retention period of data published in the commercial register. We have also taken into account that there is also no restriction on retention in court decisions and media articles (which may contain personal data in certain cases but do not collect personal data based on the data subject).

Fourthly, when drawing up the retention policy, we have taken into account that the time limit for making claims against a member of the management body is at least 5 years, but in certain cases (in case of intentional violation) 10 years. Thus, the 5-year erasure period balances the maximum limitation period (10 years) and the interests of the data subject arising from law and case law.

In conclusion, we consider that, in order to ensure the transparency and reliability of the business environment, it is of the utmost importance that entrepreneurs be able to rely on broad and far-reaching information when selecting business partners and mitigating risks.

Summary

Having established (a) our legitimate interests and those of third parties in the processing of personal data; (b) that the processing of personal data is necessary for the exercise of our legitimate interests and those of third parties; (c) that our legitimate interests and those of third parties outweigh the interests, fundamental rights and freedoms of data subjects,and also given that we have put in place safeguards to protect the interests of the data subject,  we have the right to process personal data published on the information portal.