In a ground-breaking decision released on 22 November 2022, the Court of Justice of the European Union (CJEU) invalidated open public access to ultimate beneficial owner (UBO) registers. The court held that the provision in the EU Anti-Money Laundering Directive, which requires beneficial ownership information on EU companies and other legal entities to be accessible to the public, violates fundamental EU privacy and personal data protection rights as set out in the Charter of Fundamental Rights. Interference with these rights is not limited to what is strictly necessary nor is it proportionate to the purpose of the UBO register and, therefore, is invalid.
The UBO register is a public register that contains certain personal data of the UBOs of domestic companies, other legal entities and partnerships. The Anti-Money Laundering Directive requires EU member states to set up a register for the centralised registration of up-to-date information on UBOs with a view to countering money laundering and terrorist financing. A 2018 amendment to the directive allowed “any member of the general public” to obtain access to certain personal information on a UBO (e.g., surname, date of birth, nationality, residence, etc.) and financial information (e.g., nature and extent of the beneficial interest in the entity). Before the amendment, member states had to ensure that the information on the beneficial ownership was, in all cases, accessible to any person or organisation that could demonstrate a “legitimate interest.”
The cases (two joined cases) involved a 2019 Luxembourg law that transposed the directive into domestic law and introduced both the UBO register concept and requirements for specific information on UBOs of registered entities to be included in the register. Some of the information was available to the general public. The Luxembourg law allows a UBO to request that access to the information be restricted in certain cases. A Luxembourg company and its UBO tried unsuccessfully to ask that the Luxembourg authorities limit public access to the register and brought the case before the courts when their request was denied. The Luxembourg district court took the position that disclosure of the information could give rise to a disproportionate risk of interference with the fundamental rights of the UBO concerned, so it referred the case to the CJEU requesting a ruling on whether the relevant provision in the Anti-Money Laundering Directive was compatible with the EU Charter of Fundamental Rights and whether public disclosure of the UBO’s information creates such a disproportionate risk as to harm the UBO’s fundamental rights.
The CJEU concluded that the general public’s access to information on UBOs via a UBO register constitutes a serious interference with the fundamental rights relating to privacy and the protection of personal data as enshrined in the charter. The ability of the general public to access such information enables a potentially unlimited number of persons to ascertain material and financial information relating to a UBO. Once such data is made available, it can then be retained and/or further disseminated.
The CJEU concluded that the interference with the personal privacy and financial data is not limited to what is strictly necessary nor is it proportionate to the objective pursued by the directive. To meet the proportionality requirement, the relevant legislation must set out “clear and precise rules” on the scope and application of the measures and impose minimum safeguards to shield the personal data from a potential risk of abuse. For example, the legislation must indicate the circumstances and conditions under which a measure providing for the processing of such data may be adopted to ensure that “interference” does not go beyond what is strictly necessary. The fact that it may be difficult to provide a detailed definition of the circumstances and conditions under which such a legitimate interest exists is not a justifiable reason to allow the general public to access the information in question.
The CJEU also noted that the Anti-Money Laundering Directive contains optional provisions that allow member states to make information on beneficial ownership available by using an online registration system for persons who wish to view the data and to provide exceptions for the general public in specific cases. However, according to the court, those restrictions do not demonstrate a balance between the public interest objective pursued and the fundamental rights in the Charter of Fundamental Rights, nor do they demonstrate the existence of sufficient safeguards to enable data subjects to effectively protect their personal information against the risk of misuse.
The CJEU stated that although the general public’s access to information on beneficial ownership “can contribute” to combating the misuse of legal entities and that such access “would also help” criminal investigations, these factors are insufficient to demonstrate that the measure is strictly necessary to prevent money laundering and terrorist financing.
The CJEU ruling suspends public access to information in the UBO register with immediate effect (and, in the Netherlands, it is no longer possible to request an “extract” of the information).
The CJEU’s decision will undoubtedly have an impact on UBO registers throughout the EU; in fact, certain member states have already suspended access to its register. Member states will need to ensure that they have adequate safeguards in place to protect the personal privacy and financial data of UBOs.
It should be noted that the court’s decision only affects access to the UBO register—it does not change the requirement to register in the UBO register in the first place.
Jiri Verschure
jiri.verschure@bdo.nl