In a landmark judgment, the Court of Justice of the European Union (CJEU) has held that registers containing the personal details of ‘beneficial owners‘ of companies and accessible to the public at large infringe fundamental rights.
The court said in a statement yesterday (22 November) "the provision of the anti-money-laundering directive whereby Member States must ensure that the information on the beneficial ownership of corporate and other legal entities incorporated within their territory is accessible in all cases to any member of the general public is invalid.
"According to the Court, the general public's access to information on beneficial ownership constitutes a serious interference with the fundamental rights to respect for private life and to the protection of personal data."
James Quarmby, partner and head of private wealth at Stephenson Harwood said the decision had "dealt a death blow to EU public registers".
In a LinkedIn comment he said: "This is huuuuuge news and I'm so happy about it that I feel like kissing the judges. I've always thought that public registers were an excessive response to the aims of the AMLD legislation and it turns out that quite a few people within the EU itself shared that view.
"It begs the question - how did we end up with public registers when the EU knew it was excessive ? I can't wait to see what the EU's official response will be. Will they repeal Article 30 of AMLD?
The judgment follows a small number of appeals in Luxembourg, including from Mishcon de Reya.
In a briefing note, Filippo Noseda, the Mishcon de Reya partner who led the firm‘s appeals said: "Today's judgment represents a victory for data protection and the Rule of Law in an extremely politicised context."
"Our research shows that the European Commission believed that providing indiscriminate access to sensible personal information on the ownership of companies to the public at large in the age of the GDPR was disproportionate and unacceptable. However, the Commission went along with proponents of public registers to assuage the demands of NGOs following the publication of the Paradise Papers at the end of 2017."
"Nobody should engage in money laundering or terrorism financing. However, the fight against crime must be conducted respecting the fundamental rights of compliant citizens. Nobody would condone search and entry powers without judicial scrutiny. In this country and abroad, there is a healthy debate in relation to the data protection implications of privacy-invading technologies deployed by e-commerce platforms, employers, the police or the intelligence community.
"However, when it comes to beneficial ownership of companies and bank accounts, high-profile public campaigns run by highly organised and single-minded transparency campaigners has succeeded in stymying the debate about ends and means, and the principle of proportionality, which is at the core of the Rule of Law.
"Today's judgment confirms that transparency campaigners were wrong in pursuing a single-minded approach and that public society needs a balanced debate over issues that raise data protection implications."
Today's judgment is likely to have practical implications beyond the EU, including the UK, the law firm continued. The UK was the first country to introduce public registers of beneficial ownership of UK companies and partnerships (known as 'PSC registers') in 2016, which was followed by public registers of overseas entities holding UK land ('ROE register') in March 2022. By the same token, the UK continues to adhere to the GDPR principles and therefore the EU judgment will be watched closely in the UK.
Central registers of beneficial ownership were first mentioned at a G8 meeting hosted by then UK Prime Minister David Cameron in Northern Ireland in June 2013.
In May 2015, the EU adopted a new version of the block's anti-money laundering directive (the 4th in order of time) whose Article 30 created a requirement for EU Member States to introduce central registers of beneficial ownership of companies.
Art 30 4AMLD provided for access to public authorities as well any person who could demonstrate a 'legitimate interest' in the fight against money laundering and terrorist financing, with the European Parliament singling out investigative journalists as people having a 'legitimate interest'.
4AMLD required Member States to introduce central registers by 26 June 2017. However, David Cameron's government went one step ahead and on 25 June 2014 it announced plans to make the UK's public registers wholly public. The UK Registers of Persona with Significant Control became effective in April 2016.
Following a string of terrorist attacks at the end of 2015 and 2016, the European Commission published plans to tighten 4AMLD to better combat terrorism. The first draft did not make any changes to the requirement of a 'legitimate interest'.
However, following the publication of the 'Panama Papers' in April 2016 the European Parliament soon tabled an amendment to Article 30 requiring the removal of the requirement to demonstrate a 'legitimate interest' and introducing the idea of wholly public registers of beneficial ownership.
Mishcon de Reya's research into internal EU documents show that the European Commission and the European Council (which represents the governments of EU Member States) were firmly against the removal of safeguards due to data protection concerns. The European Data Protection Supervisor, too, issued a critical opinion on 2 February 2017, stating that the amendments lacked proportionality, 'significant and unnecessary risks for the individual rights to privacy and data protection'.
These concerns were raised against the backdrop of the GDPR (the General Data Protection Regulation) that was adopted a year earlier (on 27 April 2016) following Edward Snowden's revelations.
As the institutional impasse could not be resolved, on 20 December 2017 EU Ambassadors reached a political agreement backing the European Parliament's position, paving the way for the adoption of the 5th EU Anti-Money Laundering Directive on 30 May 2018.
Luxembourg was one of the first EU Member States to implement a public register of beneficial ownership on 13 January 2019, with information freely searchable online.
In October 2020, Mishcon de Reya lodged five appeals before the Luxembourg District Court with the assistance of Luther, a local firm. Other appeals were lodged by NautaDutilh and Elvinger Hoss and on 13 November 2020 the District Court referred the question of the compatibility of the Luxembourg register with the fundamental rights to privacy and data protection to the European Court of Justice. Separately, the firm lodged a GDPR complaint with the Luxembourg data protection authorities.
Following the publication of the EU's Advocate General's opinion on 20 January 2022, Mishcon de Reya published a series of articles and 'amicus briefs ‘discussing the internal EU documents showing widespread opposition to the new rules.
Mishcon de Reya's research has also shown that the European Commission was opposed to the introduction of FATCA in the EU. As for public registers, concerns were brought to an end by action taken by the UK Government who concluded a FATCA agreement with the United States only a few weeks after a data protection report issued by the EU Data Protection Working Party on behalf of the European Commission concluded that 'a bulk transfer and the screening of all these data is not the best way to achieve [FATCA's] goal' and that 'alternative, more selective, less broad measures should be considered in order to respect the privacy of law-abiding citizens'.
On 28 October 2021, Mishcon de Reya filed a claim before the High Court in London on behalf of a US-born British citizen known as 'Jenny' alleging that the automatic processing and exchange of personal data under FATCA without any indicia of tax evasion breaches Jenny's fundamental right to privacy and exposes her data to disproportionate and unnecessary risks of hacking and data loss.
