ⒾMachine translations by Deepl

Privacy First launches lawsuit against privacy-invading UBO register

Article
Surveillance
6 January, 2021

Privacy First is bringing an action in principle against the State over the recently introduced UBO register. In summary proceedings, it invokes the invalidity of the regulations on which the UBO register is based.

The UBO register aims to combat money laundering, but will result in blackmail. Data on the financial situation of natural persons will be out in the open. All over 1.5 million legal entities listed in the Trade Register will have to disclose information on their ultimate beneficial owners (UBOs). The UBO register can be accessed by anyone, for €2.50 per retrieval.

The privacy violation resulting from the UBO register and the public accessibility of sensitive data is not proportionate. The purpose of the UBO register is to prevent money laundering and combat terrorist financing. To achieve that goal, a UBO register is not needed, at least not one that is publicly accessible to everyone.

Privacy First is therefore asking the Dutch court to declare the UBO register inoperative and, if necessary, submit questions of explanation about it to the highest European court, the Court of Justice of the European Union. Ultimately, the courts have the final say in such matters. Privacy-infringing regulations are more often set aside by courts. Privacy First has successfully litigated about this before.

The lawsuit will be heard by the District Court of The Hague. The summary proceedings will be heard on 25 February 2021 at noon. The summons can be found here (pdf). The ruling follows two or three weeks after the hearing.

Any questions? Please take contact with us, or with our lawyer Otto Volgenant from Boekx Lawyers.

Background

On 24 June 2020, the 'Implementation law on registration of beneficial owners of companies and other legal entities' entered into force. Based on this new law, a new UBO register, linked to the Commercial Register of the Chamber of Commerce, will contain information on all ultimate beneficial owners (UBOs) of companies and other legal entities incorporated in the Netherlands. This should indicate the UBO's interest, i.e. of 25-50%, 50-75% or more than 75%. In any case, the UBO's name, month and year of birth and nationality become publicly available for anyone to consult, with all the privacy risks that this entails.

Since 27 September 2020, newly incorporated entities must register their UBOs in the UBO register. Existing legal entities still have until 27 March 2022 to register their UBOs.

The law gives very limited options for shielding information. This is only possible for persons protected by the police, minors and those under guardianship. The consequence will be that almost all UBOs will be publicly known about their interests. Anyone can access the UBO register, on payment of €2.50 per extract.

European anti-money laundering directive

This new law stems from the European Fifth Anti-Money Laundering Directive, which requires Member States to register personal data of UBOs and make it publicly available. Its purpose is to counter money laundering and terrorist financing. Registering and then making UBOs' personal data publicly available, including the UBO's interest in the company, contributes to that goal, according to the European legislator. Disclosure would act as a deterrent to persons seeking to launder money or finance terrorism.

Massive privacy violation and fundamental criticism

The question is whether the means misses the point. Registering and making the personal data of all UBOs accessible to anyone is a 'blanket measure' of a preventive nature. 99.99% of UBOs have nothing to do with money laundering or terrorist financing. If it is at all proportionate to collect information on UBOs, it should be sufficient if that information is available to those government departments dealing with money laundering and terrorism. Making that information fully public is going too far. The European Data Protection Supervisor judged already that this privacy violation is not proportionate. But that judgement did not lead to an amendment of the European directive.

During the Dutch parliamentary debate on this law, fundamental criticism came from various quarters. The business community stirred because it feared - and now experiences - increased burdens and saw privacy risks. UBOs of family-owned companies that have so far remained out of the public eye run major privacy and security risks. There was also much attention to the position of parties that attach great importance to protecting data subjects, such as denominations and civil society organisations. And for associations and foundations that do not have owners, it leads to burdens: they have to put the same data that are already in the Trade Register in another register anyway. Unfortunately, this did not lead to regulatory changes.

Lawsuit is promising

Privacy First has launched a lawsuit against the UBO register for violating the fundamental right to privacy and protection of personal data. Privacy First asks the Dutch court to put the UBO register out of action in the short term and, if necessary, to submit questions of explanation on this matter to the highest European court, the Court of Justice of the European Union.

The Dutch law and also the underlying European directive violate the European Charter of Fundamental Rights and the AVG. The legislator created these regulations, but it is up to the courts to conduct a thorough review of them. Ultimately, the judge has the final say. If the (European) legislator does not pay sufficient attention to the protection of fundamental rights, the (European) court can disapply the regulations. This happens more often. The Court of Justice of the European Union has previously declared regulations invalid because of privacy violations, for instance the Data Retention Directive and recently the Privacy Shield. Dutch courts also regularly invalidate privacy-infringing regulations. Privacy First has previously successfully challenged the validity of legislation, for example in the proceedings on the Telecommunications Retention Act and in the proceedings on SyRI. Viewed against this background, the lawsuit against the UBO register is considered very promising.

Update 25 February 2021

This afternoon the court hearing took place at the court in The Hague; click here for our lawyer's pleading note (pdf). The judge's ruling is scheduled for Thursday 18 March as.