CJEU ruling prohibits unrestricted access to beneficial owners’ personal data

On 22 November 2022, the EU Court of Justice invalidated provisions of the EU’s Fifth Anti-Money Laundering Directive, which guarantees public access to information about the beneficial owners of companies.

Ruling

The CJEU ruled that Article 30(5), first subparagraph, point (c) of the Directive is invalid in so far as it provides that Member States must ensure that information on the beneficial owners of companies and other legal persons established in their territory is in all cases accessible to any member of the general public.

In its judgment, the CJEU noted that unrestricted access to any member of the public without regard to whether they have a legitimate interest does not comply with the purpose of the Directive, does not comply with the necessity and proportionality criteria in relation to the Articles 7 and 8 of the Charter of Fundamental Rights of the European Union („Charter“).

Significance of the ruling

According to the CJEU, the objective of preventing money laundering and terrorist financing is an objective of general interest that can justify such restrictions under Articles 7 and 8 of the Charter. Moreover, this objective is primarily a matter for the public authorities and for entities such as credit or financial institutions which, by reason of their activities, are subject to specific obligations in that regard. Access by the general public to information on beneficial owners is also allowed to civil society, including the media and civil society organisations combating money laundering and terrorist financing. The obligations of these entities in ensuring the prevention of money laundering and terrorist financing are therefore not affected by the CJEU’s decision.

The CJEU’s ruling means that the legal framework under which any person has the right to access the personal data of the beneficial owners without any restrictions or additional conditions will no longer be applicable. On that basis, the responsible authorities in the Member States will have to take additional steps to restrict such access and the legislators will have to initiate the relevant changes to the legislation.

From now on, access to the personal data of beneficial owners will be possible to:

• competent authorities and Financial Intelligence Units, without any restriction;
• obliged entities, within the framework of customer due diligence in accordance with Chapter II of the Directive;
• any member of the general public, which can prove a legitimate interest.

Ecovis ProventusLaw law experts remind organisations that will seek to process the personal data of beneficial owners on the basis of legitimate interests to bear in mind the requirements of the General Data Protection Regulation (“GDPR”). Before processing data on the basis of legitimate interests, it is necessary to carry out balancing tests to determine whether your interests as an organisation override the interests of data subjects.

The issue mentioned above arose when the Luxembourg court referred the case to the European Court of Justice after the Luxembourg Register of Companies challenged the compatibility of the Fifth Anti-Money Laundering Directive and its obligation to grant access to the public about the ultimate owners of companies

Prepared by Gabija Bacevičiūtė, ECOVIS ProventusLaw Junior Lawyer and Loreta Andziulytė, Partner of ECOVIS ProventusLaw