The Court of Justice of the European Union (CJEU) ruled that national legislation making personal data of all shareholders of a company, including minority shareholders, publicly available and accessible online without conditions is contrary to Union law, as it constitutes a disproportionate interference with the fundamental rights to respect for private life and data protection.

Facts and context

The Court of Justice of the European Union (CJEU) issued a ruling clarifying that Union law opposes national regulations that impose the online disclosure, without access conditions, of personal data of all shareholders of public limited companies, including minority shareholders.

The case originated from a constitutional appeal filed in Latvia by 17 minority shareholders of a public limited company, challenging the compatibility of a national law with the right to respect for private life and data protection. This law required the publication of detailed information on all shareholders (name, first name, personal identification number, contact details, number of shares, etc.), made accessible online and downloadable en masse by any user, even if not identified. Faced with this question, the Latvian Constitutional Court referred a preliminary ruling request to the CJEU.

Reasons for the decision

The Court analyzed Latvian legislation in light of Directive 2017/1132 and the GDPR, based on the following arguments:

• Interpretation of Directive 2017/1132: The Court first held that this directive, relating to certain aspects of company law, does not require Member States to make public information relating to all shareholders of public limited companies, including minority shareholders. The text, its context and objectives cannot justify such a generalized disclosure obligation.

• Incompatibility with the GDPR: The Court then examined the compatibility of the measure with the GDPR. Although the objectives pursued by Latvia (business environment transparency, combating money laundering and terrorist financing, implementation of sanctions) are recognized general interest objectives by the Union, the disclosure measure proved disproportionate. The Court considered that public online access to shareholders' personal data, without the need for the viewer to justify a legitimate interest, constitutes a serious interference with the fundamental rights guaranteed by the Charter of Fundamental Rights of the European Union. Echoing its judgment of 22 November 2022, "Luxembourg Business Registers," the Court concluded that the prevention of misuse of these data was not sufficiently guaranteed.

Authority's decision

Consequently, the Court ruled that Union law, and in particular the GDPR, opposes national legislation providing for the public online disclosure of personal data relating to all shareholders of public limited companies, when access to such data is not subject to any condition, such as demonstrating a legitimate interest.

Lessons

This decision clarifies that:

• The pursuit of general interest objectives, such as business transparency or combating money laundering, does not justify a serious and disproportionate interference with the fundamental rights of the data subjects.
• The public availability of personal data online, without any access restriction or control of the identity or legitimate interest of those consulting it, is incompatible with the principle of proportionality.
• Member States must ensure that their national laws establishing transparency regimes respect a fair balance with the right to data protection, by providing adequate safeguards against abuse.