The disclosure of beneficial ownership information – an interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union
Summary
On 22 November 2022, the Court of Justice of the European Union (CJEU) ruled in Joined Cases C-37/20 and C-601/20 (WM and Sovim SA v Luxembourg Business Registers) that requiring EU Member States to give any member of the public unconditional access to beneficial ownership registers violates the right to privacy (Article 7) and the right to data protection (Article 8) of the EU Charter of Fundamental Rights. The Court struck down Article 1(15)(c) of Directive (EU) 2018/843 (the Fifth Anti-Money Laundering Directive) as invalid. Competent authorities and Financial Intelligence Units (FIUs) are unaffected — they retain full access to beneficial ownership data in all cases.
Key Facts at a Glance
- Case name: WM and Sovim SA v Luxembourg Business Registers
- Case numbers: Joined Cases C-37/20 and C-601/20
- Court: Court of Justice of the European Union (CJEU)
- Date of judgment: 22 November 2022
- Referring court: Tribunal d’arrondissement de Luxembourg (Luxembourg District Court)
- Procedure type: Preliminary ruling
- Provision invalidated: Article 1(15)(c) of Directive (EU) 2018/843, which amended Article 30(5) of Directive (EU) 2015/849
- Legal basis for invalidity: Articles 7 and 8 of the EU Charter of Fundamental Rights (respect for private life; protection of personal data)
- What’s struck down: Unconditional public access to beneficial ownership registers
- What’s unaffected: Access for competent authorities and Financial Intelligence Units (FIUs), which remains intact in all cases
Background: What Was This Case About?
EU anti-money-laundering law required Member States to maintain registers recording the beneficial owners of companies and other legal entities incorporated in their territory, as a tool for combating money laundering and terrorist financing. Under Directive (EU) 2018/843 (which amended the earlier Directive (EU) 2015/849), Member States had to make certain beneficial ownership information accessible to any member of the general public, without that person needing to demonstrate any interest or reason for the request.
The Luxembourg District Court referred questions to the CJEU asking whether this unrestricted public-access system was compatible with EU fundamental rights law.
The Court’s Reasoning
- Interference with Fundamental Rights:
Giving the general public access to beneficial ownership data interferes with the right to private life (Charter Article 7) and the right to data protection (Charter Article 8) — regardless of how the information is later used by whoever accesses it.
- Profiling Risk:
Combining a person’s identity with details about the nature and extent of their beneficial interests allows third parties to build a detailed profile of that individual’s wealth, business activity, and investments across countries and industries.
- Unlimited, Unmonitored Access:
Because the data is accessible to a potentially unlimited number of people with no requirement to show a reason or legitimate interest, it can be obtained by anyone — including people entirely unconnected to the anti-money-laundering purpose the rules were designed to serve.
- Exposure to Concrete Harms:
Public access can expose beneficial owners to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence, or intimidation — risks made worse because the data is retained long-term and can be widely disseminated.
- Appropriate, But Not Necessary:
The Court accepted that public access to this data can help combat money laundering and terrorist financing. However, it found that the level of interference with fundamental rights went beyond what is strictly necessary to achieve that goal.
- Not Proportionate:
The rules lacked the clarity and precision EU law requires. By allowing Member States to grant access to “at least” certain categories of data, the Directive left the actual scope of disclosure insufficiently defined.
- No Adequate Safeguards:
Compared to the earlier regime — where access was limited to people who could show a “legitimate interest” — the unconditional public-access regime represented a significantly more serious interference, without adequate safeguards for individuals to protect themselves against misuse of their data.
- Authorities Remain Unaffected:
None of these findings disturb access for competent authorities or Financial Intelligence Units (FIUs) — their access to beneficial ownership registers remains fully intact in all cases.
Legal Basis for the Ruling
The CJEU grounded its decision in its own settled case law, holding that making personal data available to third parties is itself an interference with Charter Articles 7 and 8 — independent of how that data is subsequently used. Because beneficial ownership data concerns identified individuals, granting the general public access to it engages both the right to privacy and the rules on personal data processing.
The Court also emphasized that “at least” language in Article 30(5) of Directive (EU) 2015/849 (as amended) created legal uncertainty: Member States could choose to disclose additional categories of data — potentially including a beneficial owner’s date of birth or contact details — without a sufficiently defined outer limit on what could be disclosed.
What the Court Actually Ruled (Operative Part)
The CJEU declared invalid the part of Article 1(15)(c) of Directive (EU) 2018/843 that required Member States to ensure beneficial ownership information is accessible, in all cases, to any member of the general public. The invalidity applies specifically to the general-public-access requirement — not to the underlying beneficial ownership register system itself, and not to access by competent authorities or Financial Intelligence Units.
What This Means in Practice
- Registers still exist: Member States are not required to dismantle their beneficial ownership registers.
- Authority access is untouched: Competent authorities and FIUs retain full, unconditional access for AML/CFT purposes.
- Unconditional public access is gone: Member States can no longer lawfully grant the general public unrestricted access without any requirement to show a reason or legitimate interest.
- Legitimate-interest models may return: The judgment effectively revives the relevance of the earlier “legitimate interest” access standard as a more proportionate alternative.
Frequently Asked Questions
What did the CJEU decide in the Sovim case?
On 22 November 2022, in Joined Cases C-37/20 and C-601/20, the CJEU ruled that requiring unconditional public access to beneficial ownership registers violates Articles 7 and 8 of the EU Charter of Fundamental Rights, and declared the relevant provision of Directive (EU) 2018/843 invalid.
Which EU directive was affected?
Directive (EU) 2018/843 (the Fifth Anti-Money Laundering Directive), specifically Article 1(15)(c), which had amended Article 30(5) of Directive (EU) 2015/849.
Do authorities still have access to beneficial ownership data?
Yes. Competent authorities and Financial Intelligence Units retain full access in all cases — the ruling only struck down unconditional access for the general public.
Why did the Court find the public-access rule unlawful?
Because it allowed an unlimited number of people, without any need to show a reason or legitimate interest, to access sensitive personal data — creating profiling risks and exposing beneficial owners to fraud, extortion, and other harms, without adequate safeguards.
Is the beneficial ownership register system itself abolished?
No. Only the specific requirement of unconditional public access was declared invalid — the underlying register system and authority access remain in place.
What legal standard might replace unconditional public access?
The judgment points back toward a “legitimate interest” model, where access is granted only to those who can demonstrate a relevant interest, similar to the standard used before the 2018 amendment.
