The Court of Justice of the European Union (CJEU) this week ruled that the provision under EU legislation which requires that beneficial ownership information on EU companies and other legal entities is generally and publicly accessible violates privacy and data protection rights and is therefore invalid. This represents a significantly change to the transparency of company information and may have an immediate impact on the related registers across the EU.
Under the anti-money laundering Directive 2015/849 (MLD4) legal entities are required to collect information on their Ultimate Beneficial Owners (UBO) and submit that information to an external UBO register. Initially, public access to the UBO register (which is also available to competent authorities and obliged entities under MLD4) was limited to persons or organisations that could demonstrate a ‘legitimate interest.’
However, further to an amendment by Directive 2018/843 (MLD5) ‘any member of the general public’ could obtain access to certain material information (including the UBO’s surname, month and year of birth, country of residence and nationality) as well as financial information (concerning the nature and extent of the beneficial interest, for instance the percentages of shares or voting rights held by the UBO). This was further extended by some member states including Belgium where information on, among others, all intermediary entities with respect to ‘indirect UBOs’ is publicly accessible.
In 2020, two requests for a preliminary ruling were brought before the Court of Justice of the European Union (CJEU) to challenge public access to the Luxembourg UBO register.
In a well-considered ruling of 22 November 2022, the CJEU concluded that the broad access under MLD5 whereby UBO information of EU legal entities is accessible to any member of the general public, is invalid.
The CJEU first qualified such public access as a serious interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter (on private life and protection of personal data, respectively). The current framework not only enables a potentially unlimited number of persons to get insight on the material and financial situation of a UBO, but also leaves the UBO unprotected against possible abuse of its personal data which can be freely consulted, retained and disseminated.
The CJEU then considered that such interference is not limited to what is strictly necessary or proportionate to the objective pursued, and is therefore invalid because, among other things:
- the reported legislative difficulties in defining ‘legitimate interest’ under MLD4 (which restricted public access) do not justify installing general public access;
- the significant increase of the interference under MLD5 is not offset by any benefits in terms of combating money laundering and terrorist financing when compared against the less intrusive regime formerly in place under MLD4; and
- the optional measures to offer some protection for UBOs (such as online registration prior to consulting the UBO register) are not sufficient to solve the issues identified.
Note that the CJEU does not aim to affect the existing access to UBO information by authorities or obliged entities conducting costumer due diligence to prevent money laundering and terrorist financing.
Following this decision, member states are reflecting on measures to comply with the 22 November 2022 ruling (which can be invoked before member states’ courts and tribunals).
The Belgian UBO register announced that access by members of the general public has been temporarily suspended and that a solution to allow access will be communicated shortly. Similarly, in the Netherlands it is temporarily impossible to request UBO extracts. Comparable measures may be expected to follow in other EU member states.
The principle of transparency does not justify the interference with the rights of privacy and protection of personal data resulting from the general public's access to UBO information