The European Court of Justice (ECJ) has declared parts of the 4th EU Anti-Money Laundering Directive invalid, most notably the requirement that information about ultimate beneficial owners (UBOs) of companies in the EU must be publicly accessible. The ECJ sees this as a serious, unnecessary and disproportionate infringement of the EU Charter of Fundamental Rights.
Background
In the proceedings that gave rise to the decision (ECJ, judgment of 22 November 2022 – C-37/20), two companies subject to registration sued the Luxembourg Business Registers. Under Luxembourg law, which is based on the 4th EU Anti-Money Laundering Directive (Directive (EU) 2018/843), various kinds of personal information about the UBOs of companies can be accessed at the Luxembourg Business Registers, which is freely accessible on the internet.
The plaintiffs requested – initially without success – that public access to information concerning their UBOs should be restricted. One of their arguments was that public access to the UBO’s personal information infringes the rights to protection of private and family life and of personal data embedded in Articles 7 and 8, respectively, of the Charter of Fundamental Rights of the European Union (EU Charter of Fundamental Rights). They also argued that the information entering the public domain would put the UBOs at significant risk of being kidnapped, abducted, subjected to violence or even killed.
Luxembourg District Court (tribunal d’arrondissement de Luxembourg), the court handling the two cases, referred a number of questions to the ECJ, in particular on the compatibility of the relevant provision of the Anti-Money Laundering Directive with the EU Charter of Fundamental Rights.
ECJ decision
The European Court of Justice ruled that the new version of Article 1(15)(c) of Directive 2018/843, according to which beneficial ownership information is to be accessible to any member of the general public, was invalid, arguing that this provision infringed Articles 7 and 8 of the EU Charter of Fundamental Rights. The interference with fundamental rights was, it said, neither limited to what was strictly necessary, nor was it proportionate to the purpose of the Directive.
The availability of the information to the general public constituted a serious interference with the fundamental rights to respect for private life and protection of personal data. Furthermore, it went on, unrestricted access to information about the UBOs was neither limited to what was necessary nor was the severity of the interference in proportion to the aim, being to combat money laundering and terrorism.
An earlier version of the Directive had made it a requirement that the party seeking the information has a legitimate interest in that information, and, as the decision showed, this had only been dropped on account of problems with the definition of “legitimate interest”. In the ECJ’s opinion, that was not sufficient to justify the interference. Furthermore, public access to information on UBOs was not strictly necessary because of the effects resulting from such access. The Directive’s recitals mentioned scrutiny by civil society, but this, the ECJ argued, was not the responsibility of the general public, but primarily that of public authorities and institutions, such as credit and financial institutions.
Furthermore, the data to be made available to the public was not clearly and exhaustively defined because the Directive simply set minimum requirements and allowed states to make further data available.
The rule allowing Member States to require an online registration to get access to information on beneficial ownership and to provide, in exceptional circumstances, for an exemption from access to that information by the general public also did not alter the fact that the rule was disproportionate. According to the ECJ, this was not a sufficient guarantee for data subjects that their personal data would be protected against risks of misuse. Rather, the accessible information enables a potentially unlimited number of persons to gain knowledge of the material and financial situation of a UBO, to create profiles, to store the data and forward it to others.
Gleiss Lutz comments
The ECJ’s decision is to be welcomed because it strengthens the rights to informational self-determination; it also counteracts any further erosion of those rights. In particular, the ECJ has taken a clear stand against the almost complete subordination of data protection to anti-money laundering considerations. The decision is in line with the pro-data protection stance the Court has taken to date, especially in its rulings on data retention.
The corresponding German rule on access to the German Register of Ultimate Beneficial Owners (UBO Register) (section 23(1), no. 3 Money Laundering Act (Geldwäschegesetz, GwG)) also allows “all members of the public” to access personal data of UBOs (section 3 GwG). This notion of public accessibility, introduced in 2020, was sharply criticised by commentators and practitioners for the reasons now set out by the ECJ in its decision. In this context, critics were right to point out the risk of identity theft, risks of reputational damage on the basis of general suspicion directed at UBOs, competition-related risks, as well as the increased risk that UBOs may become victims of criminal offences. In Germany, persons who wish to inspect the information must register online. However, as the ECJ accurately pointed out, this is not sufficient to justify the serious interference with fundamental rights represented by the general public availability of information about UBOs.
It is now up to the German legislator to amend section 23(1), no. 3 GwG in line with European law in accordance with the requirements imposed by the ECJ. That aside, German courts must already comply with the ECJ’s decision when ruling on national cases. Whether this also applies to German public authorities, namely the Federal Office of Administration (Bundesverwaltungsamt, BVA), being the body responsible for scrutinising the work of Bundesanzeiger Verlag GmbH (publishers of the Federal Gazette), which maintains the UBO Register, is unclear. There are stronger arguments in favor of BVA and Bundesanzeiger Verlag GmbH being obliged to ensure that access to the UBO Register is restricted with immediate effect in such a way that personal information of UBOs can no longer be viewed by all members of the public. UBOs may also consider filing a request under section 23(2) GwG to restrict inspection of the UBO Register and transmission of the data stored there. If such request is refused and public access remains unrestricted, UBOs can sue for restriction of access based on the ECJ’s decision.
Forward