As we reported in our newsletter dated 27 May 2022, the European Court of Justice (the “ECJ”) had to rule for several months on the compatibility of access to the Luxembourg Register of Beneficial Owners (the “RBO”) system with European law.

The legal opinion of Advocate General Pitruzzella raised in 2022 the issue of the open-data system: anyone, without specifying his or her identity, could have access to the RBO, which the Advocate General considered incompatible with the duties of the Member States concerning privacy.

The ECJ recently ruled in a judgment of 22 November 2022 that public access to beneficial ownership information under the amended AML Directive (the Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing) constitutes a serious interference with the fundamental rights to privacy and personal data protection enshrined in Articles 7 and 8 respectively of the Charter of Fundamental Rights of the European Union (hereinafter the “Charter”).

More specifically, the data that anyone could find on the RBO allows:

  • to draw up a profile of certain personal identification data, the state of wealth of the person concerned and the specific economic sectors, countries, and companies in which he or she has invested.
  • this information becomes accessible to a potentially unlimited number of persons so that such processing of personal data is likely to also allow persons who, for reasons unrelated to the purpose of this measure, seek information on the material and financial situation of a beneficial owner, to have free access to this information.
  • the potential consequences for data subjects resulting from possible misuse of their data are aggravated by the fact that once made available to the general public, they can not only be freely consulted, but also stored and disseminated and that it thus becomes all the more difficult, or even illusory, for those persons to defend themselves effectively against misuse.

The open-data system of the RBO affects the privacy rights of the listed beneficial owners. Therefore, the ECJ held that this serious interference can be derogated from and that in this respect the interference is justified by a general interest objective because the Directive at the source of the RBO institution: “aims at preventing money laundering and terrorist financing by creating, through increased transparency, an environment less likely to be used for these purposes.”

Firstly, the ECJ found that serious interference, even if justified, is not confined to what is strictly necessary. The conditions of access to the RBO go beyond what is strictly necessary, even if the press and the usefulness of the RBO to criminal investigations are not in dispute. Secondly, the ECJ finds that the interference is not proportionate either. In this respect, the Court finds that the substantive rules governing that interference do not meet the requirement of clarity and precision.

The fight against money laundering and terrorist financing is primarily the responsibility of the public authorities as well as of entities, such as credit or financial institutions, which, because of their activities, have specific obligations in this respect (the “KYC duties”). For this reason, the amended AML Directive provides that information on beneficial owners must be accessible, in all cases, to the competent authorities and financial intelligence units, without any restriction, as well as to reporting entities, in the context of customer due diligence.

In comparison with the previous regime, which provided access to information on beneficial owners not only for the competent authorities and certain entities but also for any person or organisation able to demonstrate a legitimate interest, the regime introduced by Directive 2018/843 represents a considerably more serious infringement of the fundamental rights guaranteed by Articles 7 and 8 of the Charter, without this aggravation being offset by the possible benefits, which could result from the latter regime compared to the former, as regards the fight against money laundering and terrorist financing.

Following this decision, access to the RBO was immediately suspended in Luxembourg as of 22 November 2022.