A blow to corporate transparency but a win for privacy: ECJ rules public access to beneficial ownership information unlawful

Extract

The Court of Justice of the European Union (“ECJ”) has ruled that the requirement on Member States to ensure public access to beneficial ownership information for companies incorporated within their territory is unlawful.

In doing so, the ECJ drew a balance between (1) the rights to a private life and protection of personal data, and (2) the extent to which transparency aids the EU’s fight against money laundering, coming down clearly on the side of the privacy rights. It will be interesting to see how the European Commission amends EU law following the ECJ’s decision, and the practical impact of this.

In this article, we set out the background to and reasoning for the decision, along with our thoughts on the wider impact.

Background and summary

Two Luxembourgish companies made applications to the Luxembourg District Court (“LBR”) requesting that the general public be restricted from accessing information on certain of their beneficial owners.

These applications were made on various grounds, including that Article 30(5)(c) of the 4th Money Laundering Directive (EU 2015/849 – “MLD 4”) (as amended by the 5th Money Laundering Directive – “MLD 5”) was invalid because it infringed the fundamental rights to respect for private life and protection of personal data under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (the “Charter”) – not to be confused with the European Convention on Human Rights (“ECHR”).

Article 30(5)(c) of MLD 4 (as amended) required Member States to ensure beneficial ownership information for companies incorporated within their territory was accessible to any member of the public.

The LBR referred a number of points to the ECJ for determination, and the ECJ ultimately invalidated Article 30(5)(c) of MLD 4 (as amended). This was on the basis that:

1. Providing beneficial ownership information to members of the public constituted a serious interference with the fundamental rights of respect for private life (Article 7, Charter) and protection of personal data (Article 8, Charter) of beneficial owners; and
2. The requirement to make such information available to the public was not limited to what was strictly necessary or proportionate to the objective pursued by the MLD 4 (as amended).

Decision

Serious interference

The starting point of the decision was that making available information on beneficial owners to the general public constituted a serious interference with the Article 7 and 8 Charter rights of beneficial owners. This was because:

1. The information required to be made public related to both the identity of the beneficial owner, and the nature and extent of their beneficial ownership; this allowed the public to paint a profile of the beneficial owner;
2. The information was made accessible to a potentially unlimited number of persons;
3. Such persons could acquire, retain, disseminate and use the data for purposes unrelated to the objective of MLD 4 (as amended); and
4. It is difficult for data subjects to defend themselves against abuse once the information has been obtained and used as such.

However, the Article 7 and 8 Charter rights are not absolute rights and must be considered in relation to their function in society. Legislative provisions can interfere with those rights and still be valid, provided that the measures:

1. Satisfy the principle of legality;
2. Do not undermine the essence of the rights; and
3. Are appropriate, necessary, and proportionate in relation to the objective pursued by them.

Legality and Essence

The ECJ considered that the Article 30(5)(c) satisfied the principle of legality and did not undermine the essence of the Article 7 and 8 rights. In particular, the measures were provided for in law and were defined in scope, including that data made accessible had to be adequate, accurate, and current.

Appropriate, necessary, and proportionate

The objective of MLD 4 (as amended) is to prevent the use of the EU’s financial system for the purposes of money laundering and terrorist financing. The recitals of MLD 4 noted that pursuit of that objective cannot be effective unless the environment is hostile to criminals, and enhancing transparency could be a powerful deterrent.

These objectives were stated to be capable of justifying even serious interferences with the Article 7 and 8 rights, and the ECJ considered that the Article 30(5)(c) measure was appropriate to pursue this aim.

However, the ECJ did not consider that the measure was strictly necessary or proportionate.

Firstly, the recitals to MLD 4 (as amended) noted that public access to beneficial ownership information would allow greater scrutiny by civil society (including the press or civil society organisations), and by parties to transactions with EU companies. However, beneficial ownership information could still be made available to those persons without it being accessible to the public in general.

In particular, prior to being amended by MLD 5, Article 30(5)(c) of MLD 4 provided access for persons with a “legitimate interest” in the relevant beneficial ownership information. The Commission did not define “legitimate interest”, but the ECJ stated that the press, civil society organisations, and parties to transactions with EU companies would clearly fall within the category.

Secondly, whilst the Commission noted that “legitimate interests” did not lend itself to an easy legal definition, and that any legal definition would be difficult to apply and could result in inconsistent application, this was not sufficient to justify making beneficial ownership information available to the public generally.

Thirdly, the set of data that could be made available by a Member State was not limited and exhaustively defined by MLD 4 (as amended); Article 30(5) set out the minimum information that should be made public, but not the maximum.

Fourthly, combating money laundering and terrorist financing is generally a matter for public authorities and entities such as financial institutions, and Article 30(5)(a) and (b) requires Member States to provide access to beneficial ownership information to those bodies in any event.

In light of the above, the fact that Member States could make beneficial ownership information available only on condition of online registration, and the availability of an exemption from publication in “exceptional circumstances”, did not constitute safeguards capable of drawing a proper balance between the objective of MLD 4 and the rights in Articles 7 and 8 of the Charter.

Accordingly, the ECJ invalidated Article 30(5)(c) of MLD 4 (as amended).

UK Impact

Whilst the Charter is not incorporated into English law, the ECHR is. English Courts are required to consider rights under the ECHR – which includes the right to respect for private and family life (but not a right to protection of personal data) – and the European Court of Human Rights has ultimate jurisdiction over such matters.

Accordingly, whilst the ECJ did not ascribe specific weight between the Article 7 and 8 rights in its decision, the English Courts could take the decision into account if a similar challenge is made on grounds that the relevant provision (as incorporated into English law) is incompatible with the right to respect for private and family life under the ECHR.

In the UK, information on beneficial owners (persons with significant control) of companies is available on Companies House (with certain exceptions). If beneficial ownership information remains public in the UK, it could make the EU a more attractive place to set up a company from a privacy standpoint, and perhaps also from a money laundering standpoint.

Importantly, however, the decision does not invalidate the requirements for companies to identify their beneficial owners and keep a register, nor for a Member State to keep a central register.

Beneficial ownership information will still be available to relevant law enforcement authorities and financial institutions, and it remains to be seen how the EU will amend MLD 4 to make the information accessible to persons who might have a legitimate interest in acquiring it.

It may be some time before we can assess the practical effect of this decision, including its impact on the fight against money laundering in the EU.

Relevant legislative provisions

Article 30(5)(c), MLD 4 (as amended by MLD 5)

5. Member States shall ensure that the information on the beneficial ownership is accessible in all cases to:

(a) competent authorities and FIUs, without any restriction;

(b) obliged entities, within the framework of customer due diligence in accordance with Chapter II;

(c) any member of the general public.

The persons referred to in point (c) shall be permitted to access at least the name, the month and year of birth and the country of residence and nationality of the beneficial owner as well as the nature and extent of the beneficial interest held.

Member States may, under conditions to be determined in national law, provide for access to additional information enabling the identification of the beneficial owner. That additional information shall include at least the date of birth or contact details in accordance with data protection rules.

5a. Member States may choose to make the information held in their national registers referred to in paragraph 3 available on the condition of online registration and the payment of a fee, which shall not exceed the administrative costs of making the information available, including costs of maintenance and developments of the register.

Prior to being amended by MLD 5, (c) stated:

(c) any person or organisation that can demonstrate a legitimate interest.

The persons or organisations referred to in point (c) shall be permitted to access at least the name, the month and year of birth and the country of residence and nationality of the beneficial owner as well as the nature and extent of the beneficial interest held.

Article 7, Charter – Respect for private and family life

Everyone has the right to respect for his or her private and family life, home and communications.

Article 8, Charter – Protection of personal data

1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.