On 22 November 2022, the European Court of Justice (ECJ), sitting as the Grand Chamber, ruled in relation to the Directive 2018/843 that its provision whereby Member States must ensure that the information on the beneficial ownership of companies incorporated within their territory should be accessible in all cases to any member of the public is invalid. The decision of partial invalidation therefore relates to the provision of the Directive itself and not to the transposition of the Directive into Luxembourg law, as the Luxembourg legislation is in conformity with the Directive.[1]
On the same day, because of this ruling, public access to the UBO register was suspended in several Member States, including the Grand Duchy of Luxembourg and in the Netherlands.
UBO Register
At stake is the accessibility of personal data of "Ultimate Beneficial Owners" or "UBOs" of companies and other legal entities. Member States are required under EU anti-money laundering regulations to maintain such a register.
Modified accessibility
Originally, in accordance with the anti-money-laundering directive, the mandate to Member States was as follows[2]:
Article 30(5)
“Member States shall ensure that information on the beneficial ownership is accessible in all cases to:
- competent authorities and EU Financial Intelligence Units (FIUs), without restriction;
- obliged entities, within the framework of customer due diligence in accordance with Chapter II;
- any person or organisation that can demonstrate a legitimate interest.”
Subsection (c) of this article was changed to "Any member of the general public" in 2021[3]. Since that change, it is therefore no longer necessary to demonstrate a legitimate interest.
Judgment of the Court of Justice
The aforementioned judgment relates only to this specific change, which allows unconditional access to any member of the general public.
According to the ECJ, the general public’s access to information on beneficial ownership constitutes a serious interference with the fundamental rights to respect for private life and to the protection of personal data. Indeed, the accessible information makes it possible to create a profile with certain personal data, the financial situation of the person concerned and the economic sectors, countries, and specific companies in which the beneficial owner has invested.
The information disclosed enables a potentially unlimited number of persons to find out about the material and financial situation of a beneficial owner.
Furthermore, the potential consequences for the data subjects resulting from possible abuse of their personal data are exacerbated by the fact that, once those data have been made available to the general public, they cannot only be freely consulted, but also retained and disseminated.
This serious interference is not justified by its purpose i.e. countering money laundering and terrorist financing.
It was argued in the proceedings that the original provision making public access dependent on a legitimate interest was not properly workable due to the lack of a uniform definition of a legitimate interest. On that point, the ECJ ruled that the fact that it may be difficult to determine precisely in what cases and under what conditions public access to information about the beneficial owners is possible cannot justify the Union legislature stipulating that all members of the population have access to that information.[4] (See, by analogy, judgment of 5 April 2022, Commissioner of An Garda Síochána and Others, C 140/20, EU:C:2022:258, paragraph 84.)
Article 30(5a) and (9) of Directive 2015/849 as amended respectively allow Member States to make the availability of information on beneficial owners subject to online registration and, in exceptional circumstances, to provide for exceptions to members of the public having access to that information. In the ECJ's view, those restrictions as such do not demonstrate a balance between the public interest objective pursued and the fundamental rights enshrined in Articles 7 and 8 of the EU Charter of Fundamental Rights, nor do they demonstrate the existence of sufficient safeguards to enable data subjects to effectively protect their personal data against the risk of misuse.
For the sake of clarity, it is not disputed that financial institutions and entities subject to the reporting obligation must have access to the UBO register for customer due diligence purposes.
Ministry of Justice reaction
The judgment has prompted the Ministries of Justice of the Netherlands and of the Grand Duchy of Luxembourg to ask the Chamber of Commerce and the Luxembourg Business Registers, respectively, to temporarily stop providing information from the UBO register to the general public with immediate effect.
As the ECJ leaves no doubt that due diligences performed by financial institutions and obliged entities are justified,[5] it seems obvious that requests based on Art. 30(5) (a) and (b) the anti-money-laundering directive will continue to be honoured.
[1] Joined cases C-37/20 Luxembourg Business Registers and C-601/20 Sovim, see also CURIA - Documents (europa.eu)
[2] Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing amending Regulation (EU) No 648/2012 of the European Parliament and of the Council and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC
[3] By Article 15(c) of Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and amending Directives 2009/138/EC and 2013/36/EU (OJ 2018 L 156, p. 43)
[4] O. 72 in which the ECJ refers to: judgment of 5 April 2022, Commissioner of An Garda Síochána and Others, C 140/20, EU:C:2022:258, paragraph 84).
[5] O. 84.
On 22 November 2022, the European Court of Justice (ECJ), sitting as the Grand Chamber, ruled in relation to the Directive 2018/843 that its provision whereby Member States must ensure that the information on the beneficial ownership of companies incorporated within their territory should be accessible in all cases to any member of the public is invalid. The decision of partial invalidation therefore relates to the provision of the Directive itself and not to the transposition of the Directive into Luxembourg law, as the Luxembourg legislation is in conformity with the Directive.[1]
On the same day, because of this ruling, public access to the UBO register was suspended in several Member States, including the Grand Duchy of Luxembourg and in the Netherlands.
UBO Register
At stake is the accessibility of personal data of "Ultimate Beneficial Owners" or "UBOs" of companies and other legal entities. Member States are required under EU anti-money laundering regulations to maintain such a register.
Modified accessibility
Originally, in accordance with the anti-money-laundering directive, the mandate to Member States was as follows[2]:
Article 30(5)
“Member States shall ensure that information on the beneficial ownership is accessible in all cases to:
- competent authorities and EU Financial Intelligence Units (FIUs), without restriction;
- obliged entities, within the framework of customer due diligence in accordance with Chapter II;
- any person or organisation that can demonstrate a legitimate interest.”
Subsection (c) of this article was changed to "Any member of the general public" in 2021[3]. Since that change, it is therefore no longer necessary to demonstrate a legitimate interest.
Judgment of the Court of Justice
The aforementioned judgment relates only to this specific change, which allows unconditional access to any member of the general public.
According to the ECJ, the general public’s access to information on beneficial ownership constitutes a serious interference with the fundamental rights to respect for private life and to the protection of personal data. Indeed, the accessible information makes it possible to create a profile with certain personal data, the financial situation of the person concerned and the economic sectors, countries, and specific companies in which the beneficial owner has invested.
The information disclosed enables a potentially unlimited number of persons to find out about the material and financial situation of a beneficial owner.
Furthermore, the potential consequences for the data subjects resulting from possible abuse of their personal data are exacerbated by the fact that, once those data have been made available to the general public, they cannot only be freely consulted, but also retained and disseminated.
This serious interference is not justified by its purpose i.e. countering money laundering and terrorist financing.
It was argued in the proceedings that the original provision making public access dependent on a legitimate interest was not properly workable due to the lack of a uniform definition of a legitimate interest. On that point, the ECJ ruled that the fact that it may be difficult to determine precisely in what cases and under what conditions public access to information about the beneficial owners is possible cannot justify the Union legislature stipulating that all members of the population have access to that information.[4] (See, by analogy, judgment of 5 April 2022, Commissioner of An Garda Síochána and Others, C 140/20, EU:C:2022:258, paragraph 84.)
Article 30(5a) and (9) of Directive 2015/849 as amended respectively allow Member States to make the availability of information on beneficial owners subject to online registration and, in exceptional circumstances, to provide for exceptions to members of the public having access to that information. In the ECJ's view, those restrictions as such do not demonstrate a balance between the public interest objective pursued and the fundamental rights enshrined in Articles 7 and 8 of the EU Charter of Fundamental Rights, nor do they demonstrate the existence of sufficient safeguards to enable data subjects to effectively protect their personal data against the risk of misuse.
For the sake of clarity, it is not disputed that financial institutions and entities subject to the reporting obligation must have access to the UBO register for customer due diligence purposes.
Ministry of Justice reaction
The judgment has prompted the Ministries of Justice of the Netherlands and of the Grand Duchy of Luxembourg to ask the Chamber of Commerce and the Luxembourg Business Registers, respectively, to temporarily stop providing information from the UBO register to the general public with immediate effect.
As the ECJ leaves no doubt that due diligences performed by financial institutions and obliged entities are justified,[5] it seems obvious that requests based on Art. 30(5) (a) and (b) the anti-money-laundering directive will continue to be honoured.
[1] Joined cases C-37/20 Luxembourg Business Registers and C-601/20 Sovim, see also CURIA - Documents (europa.eu)
[2] Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing amending Regulation (EU) No 648/2012 of the European Parliament and of the Council and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC
[3] By Article 15(c) of Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and amending Directives 2009/138/EC and 2013/36/EU (OJ 2018 L 156, p. 43)
[4] O. 72 in which the ECJ refers to: judgment of 5 April 2022, Commissioner of An Garda Síochána and Others, C 140/20, EU:C:2022:258, paragraph 84).
[5] O. 84.