Тhe disclosure of beneficial ownership information – an interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union

Summary:

On 22 November 2022, the Court of Justice of the European Union (CJEU) ruled in Joined Cases C-37/20 and C-601/20 (WM and Sovim SA v Luxembourg Business Registers) that the obligation on Member States to grant any member of the public unconditional access to beneficial ownership registers breaches the right to respect for private life (Article 7) and the right to protection of personal data (Article 8) under the EU Charter of Fundamental Rights. The Court declared Article 1(15)(c) of Directive (EU) 2018/843 (the Fifth Anti-Money Laundering Directive) invalid. Competent authorities and Financial Intelligence Units (FIUs) are unaffected – they retain full access to beneficial ownership data in all cases.

Key Facts at a Glance

• Case name: WM and Sovim SA v Luxembourg Business Registers
• Case numbers: Joined Cases C-37/20 and C-601/20
• Court: Court of Justice of the European Union (CJEU)
• Date of judgment: 22 November 2022
• Referring court: Tribunal d'arrondissement de Luxembourg (District Court of Luxembourg)
• Type of proceedings: Preliminary ruling reference
• Provision declared invalid: Article 1(15)(c) of Directive (EU) 2018/843, which amended Article 30(5) of Directive (EU) 2015/849
• Legal basis for invalidity: Articles 7 and 8 of the EU Charter of Fundamental Rights (respect for private life; protection of personal data)
• What falls away: Unconditional public access to beneficial ownership registers
• What remains unaffected: Access by competent authorities and Financial Intelligence Units (FIUs), which is preserved in all cases

Background: What the Case Is About

EU anti-money laundering law requires Member States to maintain registers of the beneficial owners of companies and other legal entities incorporated in their territory, as a tool for combating money laundering and terrorist financing. Under Directive (EU) 2018/843 (which amended the earlier Directive (EU) 2015/849), Member States were required to ensure that any member of the general public could access certain beneficial ownership information, without that person having to demonstrate any interest or reason for the request.

The District Court of Luxembourg referred a question to the CJEU asking whether this system of unrestricted public access was compatible with EU fundamental rights law.

The Court's Reasoning

1. Interference with fundamental rights. Giving the general public access to beneficial ownership data constitutes an interference with the right to respect for private life (Article 7 of the Charter) and the right to protection of personal data (Article 8 of the Charter) – regardless of how the recipient subsequently uses the information.

2. Risk of profiling. Combining a person's identifying data with information on the nature and extent of their holdings allows third parties to build a detailed profile of that person's wealth, business activity, and investments across different countries and sectors.

3. Unlimited and uncontrollable access. Because the data was accessible to a potentially unlimited number of people, with no requirement to show a reason or legitimate interest, it could be obtained by anyone – including people whose purposes had no connection at all to the anti-money laundering objective the rules were meant to serve.

4. Exposure to concrete risks. Public access could expose beneficial owners to disproportionate risks of fraud, kidnapping, extortion, harassment, violence, or intimidation – risks compounded by the fact that the data is stored long-term and can be widely disseminated.

5. Appropriate but not necessary. The Court accepted that public access to this data could contribute to combating money laundering and terrorist financing. It found, however, that the degree of interference with fundamental rights went beyond what was strictly necessary to achieve that goal.

6. Disproportionality. The rules did not meet EU law's requirements of clarity and precision. By allowing Member States to grant access to "at least" certain categories of data, the Directive failed to define with sufficient precision the actual scope of the information to be disclosed.

7. Lack of sufficient safeguards. Compared with the previous regime – under which access was limited to persons who could demonstrate a "legitimate interest" – the unconditional public access regime represented a significantly more serious interference, without providing sufficient safeguards for data subjects against misuse.

8. Authorities remain unaffected. None of the above affects the access of competent authorities and Financial Intelligence Units (FIUs) – their access to beneficial ownership registers remains fully preserved in all cases.

Legal Basis of the Ruling

The CJEU based its ruling on its settled case law, under which disclosing personal data to third parties in itself constitutes an interference with Articles 7 and 8 of the Charter – regardless of how that data is subsequently used. Because beneficial ownership data relates to identified natural persons, granting the general public access to it affects both the right to private life and the rules on personal data processing.

The Court also emphasized that the phrase "at least" in Article 30(5) of Directive (EU) 2015/849 (as amended) creates legal uncertainty: Member States could optionally disclose additional categories of data – potentially including a beneficial owner's date of birth or contact details – without a sufficiently clear upper limit on what could be disclosed.

What the Court Actually Ruled (Operative Part of the Judgment)

The CJEU declared invalid the part of Article 1(15)(c) of Directive (EU) 2018/843 under which Member States were required to ensure access, in all cases, for any member of the general public to beneficial ownership information. The invalidity relates specifically to the requirement of public access – not to the beneficial ownership register system itself, nor to access by competent authorities or Financial Intelligence Units.

What This Means in Practice

• Registers continue to exist: Member States are not required to remove beneficial ownership registers.
• Authorities' access is unaffected: Competent authorities and Financial Intelligence Units retain full, unconditional access for the purposes of combating money laundering and terrorist financing.
• Unconditional public access falls away: Member States can no longer lawfully grant the general public unrestricted access without requiring a reason or legitimate interest.
• The "legitimate interest" model may return: The ruling effectively revives the significance of the earlier legitimate-interest access standard as a more proportionate alternative.

Frequently Asked Questions

What did the CJEU decide in the Sovim case?

On 22 November 2022, in Joined Cases C-37/20 & C-601/20, the CJEU ruled that the requirement of unconditional public access to beneficial ownership registers breaches Articles 7 and 8 of the EU Charter of Fundamental Rights, and declared the corresponding provision of Directive (EU) 2018/843 invalid.

Which EU directive is affected?

Directive (EU) 2018/843 (the Fifth Anti-Money Laundering Directive), specifically Article 1(15)(c), which amended Article 30(5) of Directive (EU) 2015/849.

Do authorities still have access to beneficial ownership data?

Yes. Competent authorities and Financial Intelligence Units retain full access in all cases – the ruling affects only unconditional access by the general public.

Why did the Court find the public access rule unlawful?

Because it allowed an unlimited number of people, without any need to show a reason or legitimate interest, to access sensitive personal data – creating a risk of profiling and exposing beneficial owners to fraud, extortion and other harms without sufficient safeguards.

Is the beneficial ownership register system itself abolished?

No. Only the specific requirement of unconditional public access was declared invalid – the register system itself and authorities' access remain in force.

What legal standard could replace unconditional public access?

The ruling points back toward a "legitimate interest" model, under which access is granted only to those who demonstrate a relevant interest – similar to the standard applied before the 2018 amendment.