In a ground-breaking judgment, the Court of Justice of the European Union (CJEU) held that registers containing the personal details of ‘beneficial owners‘ of companies and accessible to the public at large infringe fundamental rights or privacy. The judgment (Joined cases C-37/20) follows a small number of appeals in Luxembourg, including from Mishcon de Reya, led by Filippo Noseda.
Privacy versus Public Registers
In Europe, the right to privacy is enshrined in the European Convention on Human Rights and the EU's Charter of Fundamental Rights. The public nature of beneficial ownership registers represents the negation of these rights, and the automatic transfer of personal and financial data signifies, at the very least, a limitation. In the wrong hands, such information can be dangerous; made more dangerous in times of conflict. The EU's data protection experts have on several occasions warned that public registers put people at risk.
The right to privacy and data protection is of course not absolute. For example, public authorities can process personal data where there is sufficient legal basis and a valid public objective (such as in the fight against terrorism and money laundering). In such a case however, any limitation to the fundamental rights needs to be proportionate.
The UK was the first country to introduce public registers of beneficial ownership of UK companies and partnerships (the PSC register) in 2016, which was followed by public registers of overseas entities holding UK land (the ROE register) in March 2022.
In October 2021, Mishcon de Reya filed a claim before the High Court for a US-born British citizen ("Jenny"), alleging that the automatic processing and exchange of personal data under FATCA without any indicia of tax evasion breaches Jenny's fundamental right to privacy, and exposes her data to disproportionate risks of hacking and data loss. The case was considered in a pool of similar international claims, of which the CJEU selected a few for the Joined Cases.
CJEU Judgment for Privacy
The CJEU held that public registers of beneficial ownership are disproportionately against rights to privacy.
The judgment represents a victory for data protection in an extremely politicised context. It is likely to have practical implications beyond the EU, including the UK. Following the judgment, public registers in Austria, Cyprus, Germany, Ireland, Malta and the Netherlands have been taken down. More may follow.
Find further information on the privacy work by Mishcon here.