EU court strikes down public UBO register

Privacy First very much welcomes this critical and principled ruling by the Court of Justice. This has given a substantive ruling on the questions Privacy First previously raised about the UBO register. In a judgment of principle, the 15 judges of the Grand Chamber of the European Court explain that the fight against money laundering and terrorist financing is primarily a matter for the government. The fight against money laundering does not justify a register containing privacy-sensitive data being publicly available to everyone, said the highest European court. The full text of this landmark decision can be found here.

Summary proceedings

In early 2021, Privacy First filed a summary proceedings on the UBO register, asking the Dutch court to refer the case to the EU Court of Justice. The Dutch court did not want to do that because a similar Luxembourg case had just been referred to the ECJ at that time. The preliminary relief judge confirmed However, in doing so, it already stated that there is every reason to doubt the legality of the European money laundering directives that form the basis of the UBO register. The court ruled that it cannot be ruled out that the highest European court would come to the conclusion that the public nature of the UBO register is not compatible with the principle of proportionality. In appeal this verdict was confirmed.

Privacy First's lawyer Otto Volgenant of Boekx Lawyers said of this at the time: 'The UBO register puts privacy-sensitive data of millions of people on the street. There are doubts from all sides as to whether this is an effective tool in the fight against money laundering and terrorism. It is shooting a gun at a gnat. The highest European court, the EU Court of Justice, will ultimately rule on this. I expect it to draw a line under the UBO register.'

So on 22 November 2022, that is indeed what happened. The openness of the UBO register is off the table. The main considerations of the CJEU ruling can be summarised as follows:

making UBO data available to the general public is a serious intrusion into the privacy of UBOs. Based on the information from the UBO register, a profile can be created with certain personal identification data, the person's financial situation and the economic sectors, countries and specific companies in which they have invested. A freely accessible UBO register makes this data available to an unlimited number of people, including those who want to view it for reasons that need not be related to anti-money laundering rules. Not only is this UBO data freely accessible to anyone, it can then be stored and further disseminated by third parties, making it increasingly difficult or even illusory for the UBO to defend himself against abuse.

Combating money laundering and terrorist financing is a public interest objective that can justify the privacy intrusion that arises with a UBO register, but this does not automatically mean that everyone should have access to that register.

1. The court explains that the following three points need to be assessed in this context:
   Is the public accessibility of the UBO register an appropriate tool in the fight against money laundering?
2. Does the intrusion on the privacy of UBOs through access for all meet the requirement of subsidiarity and is limited to what is strictly necessary, in other words, can the fight against money laundering not reasonably be carried out as effectively in another way that affects the fundamental rights of the individuals concerned less?
   Is the privacy intrusion that results from full disclosure of the UBO register proportional and proportionate, when weighing up the importance of combating money laundering on the one hand and the severity of the privacy intrusion on the other?
3. On the first question, the Court of Justice spends few words: a publicly accessible UBO register may, through the resulting transparency, contribute to an environment that is less likely to be used for money laundering. But on the other two points, the publicness of the UBO register does not meet the requirements to be imposed on it.

The ECJ's answer to the second question is that the privacy violation resulting from full disclosure of the UBO register is not strictly necessary. A previous version of the anti-money laundering regulations stated that "persons or organisations that can demonstrate a legitimate interest" had access to the UBO register. The ECJ now names as groups that may have such a legitimate interest:

1. press and civil society organisations involved in preventing and combating money laundering and terrorist financing;
2. persons seeking to know the identity of a UBO in the context of a potential transaction; and
3. financial institutions and authorities involved in the fight against money laundering and terrorist financing.

The European Commission has previously stated that it is difficult to give a legal definition of the concept of "legitimate interest". The court found this too short-sighted: the fact that it is difficult to define this concept does not justify giving access to everyone. And so the public accessibility of the UBO register fails, because the privacy violation for the UBOs is not limited to what is strictly necessary.

In answering the third question, on the proportionality of the privacy intrusion to the importance of anti-money laundering objectives, the ECJ also let privacy prevail. The fight against money laundering and terrorist financing is primarily a task of the government and financial institutions. These also previously had full access to the UBO register. Extending access to the UBO register to the entire public results in a significantly heavier invasion of privacy, without being offset by benefits in the fight against money laundering and terrorist financing.

For the Netherlands, this means that the UBO register may no longer be publicly accessible with immediate effect. Immediately after this ruling, Privacy First called on the Minister of Finance to put this right as soon as possible. Still on the day of the ruling, this call was heeded and the public accessibility of the UBO register was closed. A big win for privacy. The goal of the lawsuit that Privacy First started in 2021 has thus been achieved. The UBO register is no longer publicly accessible. Failing this, Privacy First will launch a new summary proceedings to enforce the EU court's ruling.  

There will possibly be a discussion about the delineation of the group of persons who have access to the UBO register on the basis of a 'legitimate interest'. That discussion is best conducted at EU level, as anti-money laundering regulations are also EU regulations. In doing so, the European Data Protection Supervisor will then also be able to intervene substantively. This independent supervisor advised back in 2017 that public accessibility to the UBO register would not be proportionate.

Unfortunately, the European legislator did not heed that advice at the time. Unfortunately, it happens more often that the European legislator drafts rules that are a major invasion of privacy, and years later the highest European court rules that those rules are too gross a violation. It is good that the courts are critical and weigh up the importance of privacy. After all, the courts have the final say in a democratic constitutional state, and the EU Court of Justice's Grand Chamber has ruled in favour of privacy time and again in recent years. But it would be even better if regulators themselves valued the importance of privacy protection. Then many privacy violations by the government could be prevented.