Personal data protection has a sole purpose, and shielding corporate structures from sunlight isn’t it

In November 2022, the Court of Justice of the EU (CJEU) delivered its judgment that threw the cause of beneficial ownership transparency back by a decade. Now, EU decision-makers are negotiating revisions to the EU anti-money laundering directive that may serve as a stopgap to the damage caused by the CJEU. Nevertheless, we are not counting on this legislation for a long-term solution.

The time has come to start a discussion on the relationship between the rights to personal data protection and privacy, and beneficial ownership transparency.

In some forms, the right to privacy goes back centuries – from guaranteeing the secrecy of correspondence, through to protection from unwarranted searches. International human rights treaties started to protect privacy, private and family life, home and correspondence from the 1950s onwards. Chief among them are: the European Convention on Human Rights, the International Covenant on Civil and Political Rights, and the American Convention on Human Rights.

None mention data protection, however. It was only in 1985 that the first data protection convention – the Council of Europe’s Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data – came into force, defining its purpose as safeguarding “everyone’s rights and fundamental freedoms, and in particular the right to respect for privacy”.

And yet, it’s often forgotten that the protection of personal data is not an end in itself. Its sole purpose is to protect rights and fundamental freedoms – in particular, privacy. However, what privacy and private life actually entail is not defined in international law. Instead, it is court judgements, soft law and academic discussions that are gradually shaping the concept.

According to an oft-quoted 1992 judgment from the European Court of Human Rights (ECtHR), “respect for private life must also comprise to a certain degree the right to establish and develop relationships with other human beings” which also includes “activities of a professional or business nature”.

In 2010, when the CJEU ruled on the question of the transparency of EU farm subsidies, they disregarded the beautiful notion that individuals just want to make friends (and business partners). Instead, they merely referred to the same paragraph of the 1992 ECtHR judgment, and said that the term “private life” must not be interpreted restrictively and that “there is no reason of principle to justify excluding activities of a professional … nature from the notion of ‘private life’”.

In their ruling on the issue of public beneficial ownership registers last November, the CJEU judges cited this paragraph again. And yet again, the judges do not seem to have considered its original context. According to them, letting the general public identify beneficial owners of corporate and other legal entities in the context of anti-money laundering would violate these individuals’ right to private lives. Apparently, shining a light on their identities would mean that beneficial owners can no longer establish and develop relationships with other human beings.

Putting irony aside, this is flawed reasoning. The judgment has had a severe impact, including a spillover effect to countries beyond the EU. For example, Jersey and the British Virgin Islands have already put on hold making their beneficial ownership registers public.

Now, for the sake of argument, let’s assume that the CJEU was totally right and that building obscure, complex corporate structures is just part of privacy and private life. Still, they had an obligation to balance the right of personal data protection and the right to privacy with other rights and interests.

The CJEU recognised only that the “general public’s access to beneficial ownership information allows greater scrutiny of information by civil society” and that “both the press and civil society organisations that are connected with the prevention and combating of money laundering and terrorist financing have a legitimate interest in accessing information on beneficial ownership”.

Regarding the broader public, judges also acknowledged that those people who are likely to enter into transactions with a company or other legal entity also have legitimate interest in knowing their potential business partners’ beneficial owners.

Curiously, while the CJEU writes about legitimate interests – such as “EU legislature seeks to prevent money laundering and terrorist financing by creating, by means of increased transparency” – it does not give any recognition to freedom of information at all, which is a human right. Such a distinction would have been important, as rights weigh more on balance. And even though in the given case the CJEU was limited by the referral from the Luxembourg District Court to assess the provisions of the anti-money laundering directive, they still should not have disregarded their obligation under the European Charter to “respect the rights, observe the principles and promote the application thereof”.

Beneficial ownership disclosure rules are relevant to the rights to privacy and personal data protection, and at the same time also to the freedoms of information and of the press. An essential precondition to these rights is media pluralism, without which there is no functioning democracy. For example, to guarantee the pluralism of the media, the ultimate ownership of media companies has to be transparent, otherwise the same owners can control multiple media companies masked as independent from each other. And if that happens, then even journalists cannot act as watchdogs because of their potential or real conflicts of interests. This means that the public needs access and the ability to check ownership information for themselves.

The right to vote and to be elected through genuine periodic elections is another fundamental right. Free and fair political competition is not possible without ensuring the origins of political donations are clean, making beneficial ownership transparency indispensable.

Had the court done their balancing properly, they would have found these rights in the other pan of the scales. This balancing exercise is doable and the CJEU has previously resolved more complex matters by carefully considering competing rights at stake.

Beneficial ownership transparency rules are instrumental in a way beyond their original purpose of anti-money laundering directives, making the damage from the CJEU ruling more widespread.

The CJEU narrowly marked that legitimate interest is something they were willing to consider when they looked at reasons to restrict the rights to personal data protection and privacy. Journalists and civil society organisations working on anti-money laundering and terrorism financing have it, but ordinary citizens don’t.

The unfortunate reality is that investigative authorities often have limited resources and, in many countries, people also don’t trust them enough to report suspicions to. However, active citizens could still check the ownership of suspicious companies they come across – much like in a neighbourhood watch programme, except the crimes are more high stakes than burglary and vandalism. Besides active citizens, beneficial ownership registers that were open to the public had another important user group: investigative authorities of third countries, who no longer had to go through burdensome bureaucracy to find out who were the real individuals behind EU companies featuring in cross-border schemes.

Beneficial ownership information is also needed to create fair competition and make ownership of purported competitors transparent. In many cases, competitors, investors, creditors, the media and consumer protection organisations are the first to detect the signs of prevention, restriction or distortion of competition. With the help of information on companies’ real owners, they can trigger regulatory procedures. All this requires that any member of the general public has access to the information, as Transparency International argued in our amicus curiae submission to the CJEU over a separate case last year.

Finally, not knowing the ultimate owners of companies makes it a lot harder to hold corporations accountable for environmental and human rights law violations committed through their subsidiaries – which can be quickly and easily dissolved if investigators or authorities find out about wrongdoing.

As it turns out, these stakeholders’ legitimate interest to access beneficial ownership information was too distant to impact the judges’ thinking. It’s too bad that another round of law-making and, eventually, a new assessment by the CJEU is ahead of us.

After the 2010 judgment of the CJEU which rendered farm subsidies – the largest item in the EU budget – non-transparent, EU lawmakers had to go back to the drawing board and rework their approach. The outcome of this was crucial; after all, there was the transparency of approximately €50 billion per year in EU funds at stake. The new version of those transparency rules have been functioning for about a decade since.

The forthcoming 6th Anti-Money Laundering Directive is a crucial opportunity to ensure that at least civil society and journalists – actors whose legitimate interest the court recognised – retain meaningful access to information on EU companies’ real owners. But no matter how progressive and robust this legislation is, it will not be a well-rounded, long-term solution. The European Commission, Parliament and Council cannot afford to risk the repercussions of deprioritising beneficial ownership transparency, even in the medium-term. This time, much more than €50 billion per year is at risk.

A shorter version of this article was originally published in German in the July 2023 issue of Scheinwerfer, the magazine of Transparency International Germany.