Privacy First appeal against UBO register

Privacy First Foundation has appealed from the judgment of the judge in interlocutory proceedings of 18 March 2021. The summary proceedings judge confirmed that there is every reason to doubt the legality of the European money laundering directives that form the basis of the UBO register. On this point, the judge followed the highly critical opinion of the European privacy supervisor EDPS (European Data Protection Supervisor). The Dutch summary proceedings judge ruled that it cannot be ruled out that the highest European court, the Court of Justice of the EU, will come to the conclusion that the public nature of the UBO register is not compatible with the principle of proportionality. This question is already before the ECJ, as it has been questioned by a Luxembourg court. With this issue already on the plate of the highest European court, the Dutch interim relief judge did not find it necessary to ask questions about it himself.

Privacy First has appealed to the Hague Court of Appeal. The appeal summons can be found here (pdf). Privacy First asks the Court of Appeal of The Hague to still submit preliminary questions on the UBO register to the European Court of Justice itself and to render the UBO register inoperative until those questions are answered. Furthermore, Privacy First asks the court to temporarily suspend the openness of the UBO register, at least until the Court of Justice of the European Union has ruled on it. The Court's ruling is expected a few weeks after the hearing on 27 September 2021.

Privacy First's lawyer, Otto Volgenant of Boekx Lawyers: 'The UBO register puts privacy-sensitive data of millions of people on the street. There are doubts from all sides as to whether this is an effective tool in the fight against money laundering and terrorism. It is shooting a gun at a gnat. The highest European court, the EU Court of Justice, will ultimately rule on this. I expect it to draw a line through the UBO register. At least through disclosure. Until then, I advise UBOs not to submit any data to the UBO register. Once data is public, you cannot take it back.'

Background to the lawsuit against the UBO register

Privacy First is bringing an action in principle against the State over the UBO register introduced in 2020. In summary proceedings, it is invoking the invalidity of the regulations on which the UBO register is based. The consequences of this new legislation are far-reaching. After all, it involves highly privacy-sensitive information. Data on the financial situation of natural persons will be out in the open. All over 1.5 million legal entities listed in the Trade Register will have to disclose information on their ultimate beneficial owners (UBOs). The UBO register is accessible to everyone, for €2.50 per retrieval. Such disclosure is not proportionate.

On 24 June 2020, the 'Implementation law on registration of beneficial owners of companies and other legal entities' entered into force. Based on this new law, a new UBO register, linked to the Commercial Register of the Chamber of Commerce, will contain information on all ultimate beneficial owners (UBOs) of companies and other legal entities incorporated in the Netherlands. This should include information on the UBO's interest of 25-50%, 50-75% or more than 75%. In any case, the UBO's name, month and year of birth and nationality become publicly available for anyone to consult, with all the privacy risks that this entails.

Since 27 September 2020, newly incorporated entities must register their UBOs in the UBO register. Existing legal entities still have until 27 March 2022 to register their UBOs. The law gives very limited options for shielding information. This is only possible for persons under police protection, minors and those under guardianship. The result will be that almost all UBOs will be publicly known about their interests.

European anti-money laundering directive

This new law stems from the European Fifth Anti-Money Laundering Directive, which requires Member States to register personal data of UBOs and make it publicly available. Its purpose is to counter money laundering and terrorist financing. Registering and then making UBOs' personal data publicly available, including the UBO's interest in the company, contributes to that goal, according to the European legislator. Disclosure would act as a deterrent to individuals seeking to launder money or finance terrorism. But the effectiveness of a UBO register in the fight against money laundering and terrorism has never been substantiated.

Massive privacy violation and fundamental criticism

The question is whether the means misses the point. Registering and making the personal data of all UBOs accessible to anyone is a 'blanket measure' of a preventive nature. 99.99% of UBOs have nothing to do with money laundering or terrorist financing. If it did make it proportionate to collect information on UBOs, it should be sufficient if that information is available to those government departments dealing with money laundering and terrorism. It is going too far to make that information fully public. The European Data Protection Supervisor judged already that this privacy violation is not proportionate. But that judgement did not lead to an amendment of the European directive.

During the Dutch parliamentary debate on this law, fundamental criticism came from various quarters. The business community stirred because it feared - and now experiences - increased burdens and saw privacy risks. UBOs of family-owned companies that have so far remained out of the public eye run major privacy and security risks. There was also much attention to the position of parties that attach great importance to protecting data subjects, such as denominations and civil society organisations. And for associations and foundations that do not have owners, it leads to burdens: they have to put the same data that are already in the Trade Register in another register anyway. Unfortunately, this did not lead to regulatory changes.

Follow the Money looked into the social costs of the Dutch UBO register. Follow the Money writes: “The UBO register entails costs, red tape and sometimes slightly absurd bureaucracy for millions of entrepreneurs and directors. When asked by Follow the Money, the Ministry of Finance puts the total cost of the register for businesses at 99 million euros. To this must be added 9 million in one-off implementation costs for the government. When lawyer Volgenant sees that figure, he reacts in astonishment: 'The total cost is even much higher than I thought myself! If you extrapolate that for the entire EU, the costs are astronomical.”

Lawsuit is promising

Privacy First has launched a lawsuit against the UBO register for violating the fundamental right to privacy and protection of personal data. Privacy First asks the Dutch court to put the UBO register out of action in the short term and to submit questions of explanation on this matter to the highest European court, the Court of Justice of the European Union. Privacy-infringing regulations are more often set aside by courts. Privacy First has successfully litigated this before.

The Dutch law and also the underlying European directive violate the European Charter of Fundamental Rights and the AVG. The legislator created these regulations, but it is up to the courts to conduct a thorough review of them. Ultimately, the judge has the final say. If the (European) legislator does not pay sufficient attention to the protection of fundamental rights, the (European) court can declare the regulations inoperative. The Court of Justice of the European Union has previously declared regulations invalid for privacy violations, for instance the Telecom Data Retention Directive and the Privacy Shield. Dutch courts also regularly invalidate privacy-infringing regulations. Privacy First has previously successfully challenged the validity of legislation, for example in the proceedings on the Telecommunications Retention Act and in the proceedings on SyRI. Viewed against this background, the lawsuit against the UBO register is considered very promising.

Update 27 September 2021

this afternoon the court hearing took place at the Hague Court of Appeal; click here for our lawyer's pleading note (pdf). The court's ruling is tentatively scheduled for Tuesday 16 November next.

Any questions? Please take contact with us, or with our lawyer Otto Volgenant from Boekx Lawyers.