Critical comments Privacy First on consultation UBO register

Early 2021 made Privacy First with Boekx Advocaten filed a lawsuit against the State over the new UBO register. Under the legislation on which the UBO register is based, all 1.5 million legal entities registered in the Trade Register had to disclose all kinds of privacy-sensitive information about their UBOs ('ultimate interested parties'). This concerned millions of directors, shareholders and senior executives of all Dutch companies, foundations, associations, churches, etc. Privacy Firste considered this a massive privacy violation with major personal security risks. Privacy First therefore requested the court to declare the UBO register unlawful. After all, much of the information in the UBO register would be publicly accessible. Privacy First considered this completely disproportionate and in violation of European privacy law. The District Court of The Hague judged subsequently that the legality of the European money laundering directives on which the UBO register was based could indeed be questioned. In appeal the Hague Court of Appeal also stressed that a UBO fearing for its security could shield this personal data from the general public. In a similar Luxembourg case supported by Privacy First judged the EU Court in November 2022 subsequently that the public accessibility of all UBO registers in the European Union violates European privacy law.

Since then, the Dutch UBO register has not been publicly accessible. This, however, to the displeasure of some in the social forces, so Privacy First has continued to critically monitor all developments surrounding the UBO register. In this context, there was recently a internet consultation on a draft bill containing new rules on the accessibility of the UBO register. Privacy First took that opportunity to submit a comprehensive commentary on the draft bill and some related issues. Our comments cover the following topics:

• Access only for Wwft-compliant companies under integrity supervision and with whom data protection measures are in place.
• Careful regulation of possible access on grounds of 'legitimate interest'.
• Measures against misuse of UBO data.
• Adverse impact measures for non-profit organisations (NGOs).
• Correction of incorrect implementation of European rules on endangered UBOs.
• Correction of retention period.

Privacy First's full consultation contribution can be found HERE (pdf).

If necessary, Privacy First will again go to court in the future as soon as another massive privacy breach is threatened by the UBO register.