On 22 November 2022, the Court of Justice of the European Union (the "CJEU") struck down the provision of the 5th AML Directive 2018/843 ("AML V") which provided that EU Member States must ensure that information on the beneficial ownership of companies within their territories is accessible in all cases to any member of the general public.
In the three Benelux countries, the invalidated provision served as a legal basis to allow the public at large to access personal data of ultimate beneficial owners ("UBOs") contained in the UBO register. Such general accessibility (i.e. in all cases to any member of the general public) has been considered by the CJEU to constitute a serious interference with the fundamental rights to privacy and the protection of personal data.
Topic of controversy
While under the 4th AML Directive 2015/849 ("AML IV"), the UBO register was accessible to any person who could demonstrate a “legitimate interest”, such a legitimate interest requirement had disappeared in the AML V.
Parties including the CNPD, the Luxembourg data protection authority, as well as privacy advocates (such as the Dutch NGO Privacy First) had previously raised questions about the accessibility by the general public without the need for a legitimate interest of the person accessing the data. Indeed, since the effective implementation of the AML V in the Benelux countries, any member of the general public had free access to certain personal information of UBOs of entities registered with the local UBO register.
Beneficial owners saw several of their personal data disclosed to the public at large as from the availability of the UBO register, including their name, nationality, month and year of birth, country of residence, as well as the nature and extent of the beneficial interest held.
Invalidation by the CJEU
Upon the Luxembourg District Court's request for a preliminary ruling, the CJEU ruled now that access by the general public to information on beneficial ownership as provided in Article 1(15)(c) of AML V, and thus by a potentially unlimited number of persons, constitutes a serious interference with the fundamental rights to privacy and the protection of personal data enshrined in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.
It held that the potential consequences for data subjects resulting from a possible abuse of their personal data are exacerbated by the fact that the data cannot only be freely consulted, but also retained and disseminated so that it becomes increasingly difficult, if not illusory, for them to defend themselves effectively against abuse.
The EU Council's and Commission's argument that the previous condition requiring a “legitimate interest” of the person accessing the data resulted in practical difficulties, as a uniform definition of such legitimate interest was lacking, was countered by the CJEU. The latter ruled that the difficulty to provide a detailed definition of the circumstances and conditions under which the public may have access to information on beneficial ownership cannot justify providing access to that information for the general public.
Therefore, the CJEU declared Article 1(15)(c) of AML V invalid in so far as it amended Article 30(5)(1)(c) of AML IV in such a way that it provides that EU Member States must ensure that information on the beneficial ownership of companies and other legal entities incorporated within their territory is accessible in all cases to any member of the general public.
Comparing such disclosure with the mandatory disclosure of the legal representatives of companies, such as foreseen in Directive (EU) 2017/1132 as amended (see CJEU case C-398/15 Manni), the CJEU held that those mandatory disclosures differ both in purpose and scope in terms of personal data covered.
The CJEU's judgment is not open to appeal. Both cases in which preliminary rulings were requested on this topic have been referred back to the Luxembourg District Court to continue the domestic proceedings.
Consequences
Since the publication of the CJEU's judgment on 22 November 2022, the Dutch, Belgian and Luxembourg UBO registers have blocked public access to UBO data.
The invalidation of Article 1(15)(c) of the AML V results in the revival of the initial text of Article 30(5)(c) of AML IV and must thus be read as it existed before the amendment by the AML V: "to any person or organisation able to demonstrate a legitimate interest".
It is now up to the national legislators in the Benelux countries to amend their local laws in order to bring them in line with EU law once more. For now at least, that means these national laws will have to be aligned with the initial text of Article 30(5)(c) AML IV and to reintroduce the requirement of “legitimate interest” again. As long as these national provisions have not been updated, we take the view that national courts and authorities will have to leave the national provisions implementing the public access to the local UBO registers with a legitimate interest test non-applied in all pending and possible future cases.
Another important question remains: is the collection and the further processing of the UBO data by the public at large and, for example, by data brokers illegal per se? For the future collection of UBO data in any event yes, but for UBO data that have been collected before the CJEU’s judgment, the same probably applies too.
Nicolas de Crombrugghe
Partner
Lentle Nijs
Associate
