Mishcon de Reya has filed a lengthy GDPR Complaint in two languages (English and French) with the Luxembourg National Data Protection Commission (CNPD), bringing together the concerns raised by the European data protection community and relevant European judgments, including the 21 Oct 2016 judgment from the French Constitutional Council on the illegality of public trust registers, (2016-591 QPC), 'Schrems II' and a wealth of other EU case law.
This follows last week news that the Luxembourg District Court ('Tribunal d'Arrondissement' ) referred the validity of the RBE law establishing public registers and their compatibility with fundamental rights to the Court of Justice of the European Union ('CJEU').
The complaint also mentions internal documents from the European Commission, which show that during the legislative process that led to the amendment of Art. 30 4AMLD, the Commission was opposed to the introduction of fully public registers and instead wanted to maintain the requirement of a demonstrable 'legitimate interest' in order to access information contained on the registers.
It urges the CNPD to:
- order the suspension of the processing and publication of sensitive personal data of new and existing 'beneficial owners' of Luxembourg companies;
- launch of an investigation; and
- report urgently to the Luxembourg Parliament on the implications of the judicial reference to the CJEU for the rights of compliant citizens.
Filippo Noseda, who is leading the team, commented: "Unfortunately, due to the busy schedule of the CJEU, it will take several many months before the preliminary questions will be heard from the Court.
In the meantime, the names of thousands of compliant citizens will continue to be disclosed publicly and other EU countries will continue on their journey to introduce public registers, unless they have already done so, thus infringing the rights of hundreds of thousands, if not millions, of compliant citizens.
We are planning similar steps in other EU Member States to raise awareness and put the issue of public registers at the centre of the data protection debate across the continent."
This GDPR complaint and the recent appeals in Luxembourg have been a long time coming are the result of many years of work and thought leadership in this area. The main arguments were first explored in our report 'Transparency Versus Privacy' that was published in January 2018.