European Court of Justice strikes down public registers of beneficial ownership

In a seminal judgment, the Court of Justice of the European Union (CJEU) has held that registers containing the personal details of ‘beneficial owners‘ of companies and accessible to the public at large infringe fundamental rights. 

The judgment follows a small number of appeals in Luxembourg, including from Mishcon de Reya.

Read the CJEU press release on the judgment here.

Filippo Noseda, the Mishcon de Reya Partner who led the firm‘s appeals commented: “Today’s judgment represents a victory for data protection and the Rule of Law in an extremely politicised context.”
“Our research shows that the European Commission believed that providing indiscriminate access to sensitive personal information on the ownership of companies to the public at large in the age of the GDPR was disproportionate and unacceptable. However, the Commission went along with proponents of public registers to assuage the demands of NGOs following the publication of the Paradise Papers at the end of 2017.”
“Nobody should engage in money laundering or terrorism financing. However, the fight against crime must be conducted respecting the fundamental rights of compliant citizens. Nobody would condone search and entry powers without judicial scrutiny. In this country and abroad, there is a healthy debate in relation to the data protection implications of privacy-invading technologies deployed by e-commerce platforms, employers, the police or the intelligence community. However, when it comes to beneficial ownership of companies and bank accounts, high-profile public campaigns run by highly organised and single-minded transparency campaigners has succeeded in stymying the debate about ends and means, and the principle of proportionality, which is at the core of the Rule of Law. Today’s judgment confirms that transparency campaigners were wrong in pursuing a single-minded approach and that public society needs a balanced debate over issues that raise data protection implications.”

Today’s judgment is likely to have practical implications beyond the EU, including the UK. The UK was the first country to introduce public registers of beneficial ownership of UK companies and partnerships (known as 'PSC registers') in 2016, which was followed by public registers of overseas entities holding UK land ('ROE register') in March 2022. By the same token, the UK continues to adhere to the GDPR principles and therefore the EU judgment will be watched closely in the UK.

Mishcon de Reya has been at the forefront of addressing the data protection implications of public registers of beneficial ownership as well as automatic exchange of information under the US Foreign Accounts Tax Compliance Act (FATCA) and the OECD’s Common Reporting Standard (CRS). In 2018, Mishcon Academy, the firm’s think-tank, published a report entitled ‘The Great Debate: Privacy vs Transparency’. The firm has also published its research into internal EU documents and its correspondence with the EU, the OECD, as well as the UK Information Commissioner’s Office to ensure accountability of the work carried out by public authorities and raise awareness over the underlying data protection issues. 

The firm's work in this area has been widely reported in the media (including The Financial Times, The Economist, TIME Magazine, Forbes and Bloomberg) and specialised press (including Tax Analyst in the US and Trusts & Trustees in Europe).

Technical note

Central registers of beneficial ownership were first mentioned at a G8 meeting hosted by then UK Prime Minister David Cameron in Northern Ireland in June 2013.

In May 2015, the EU adopted a new version of the block’s anti-money laundering directive (the 4th in order of time) whose Article 30 created a requirement for EU Member States to introduce central registers of beneficial ownership of companies. 

Art 30 4AMLD provided for access to public authorities as well any person who could demonstrate a 'legitimate interest' in the fight against money laundering and terrorist financing, with the European Parliament singling out investigative journalists as people having a 'legitimate interest'. 
4AMLD required Member States to introduce central registers by 26 June 2017. However, David Cameron's government went one step ahead and on 25 June 2014 it announced plans to make the UK's public registers wholly public. The UK Registers of Persona with Significant Control became effective in April 2016. 

Following a string of terrorist attacks at the end of 2015 and 2016, the European Commission published plans to tighten 4AMLD to better combat terrorism. The first draft did not make any changes to the requirement of a 'legitimate interest'. 

However, following the publication of the 'Panama Papers' in April 2016 the European Parliament soon tabled an amendment to Article 30 requiring the removal of the requirement to demonstrate a 'legitimate interest' and introducing the idea of wholly public registers of beneficial ownership. 

Our research into internal EU documents show that the European Commission and the European Council (which represents the governments of EU Member States) were firmly against the removal of safeguards due to data protection concerns. The European Data Protection Supervisor, too, issued a critical opinion on 2 February 2017, stating that the amendments lacked proportionality, 'significant and unnecessary risks for the individual rights to privacy and data protection'. 

These concerns were raised against the backdrop of the GDPR (the General Data Protection Regulation) that was adopted a year earlier (on 27 April 2016) following Edward Snowden's revelations.

As the institutional impasse could not be resolved, on 20 December 2017 EU Ambassadors reached a political agreement backing the European Parliament's position, paving the way for the adoption of the 5th EU Anti-Money Laundering Directive on 30 May 2018. 

Luxembourg was one of the first EU Member States to implement a public register of beneficial ownership on 13 January 2019, with information freely searchable online. 

In October 2020, Mishcon de Reya lodged five appeals before the Luxembourg District Court with the assistance of Luther, a local firm. Other appeals were lodged by NautaDutilh and Elvinger Hoss and on 13 November 2020 the District Court referred the question of the compatibility of the

Luxembourg register with the fundamental rights to privacy and data protection to the European Court of Justice. Separately, the firm lodged a GDPR complaint with the Luxembourg data protection authorities.

Following the publication of the EU's Advocate General's opinion on 20 January 2022, Mishcon de Reya published a series of articles and 'amicus briefs' discussing the internal EU documents showing widespread opposition to the new rules.

Looking ahead

Mishcon de Reya's research has also shown that the European Commission was opposed to the introduction of FATCA in the EU. As for public registers, concerns were brought to an end by action taken by the UK Government who concluded a FATCA agreement with the United States only a few weeks after a data protection report issued by the EU Data Protection Working Party on behalf of the European Commission concluded that 'a bulk transfer and the screening of all these data is not the best way to achieve [FATCA's] goal' and that 'alternative, more selective, less broad measures should be considered in order to respect the privacy of law-abiding citizens'.

On 28 October 2021, Mishcon de Reya filed a claim before the High Court in London on behalf of a US-born British citizen known as 'Jenny' alleging that the automatic processing and exchange of personal data under FATCA without any indicia of tax evasion breaches Jenny's fundamental right to privacy and exposes her data to disproportionate and unnecessary risks of hacking and data loss. The background to Jenny's case is outlined on her crowdfunding page.