EU Court finds unrestricted access to shareholder data incompatible with GDPR
The Court of Justice of the European Union, in a case originating in Latvia, ruled that the personal data of shareholders of public limited liability companies cannot be accessible to everyone without any conditions. The court delivered its judgment in case C-798/24 Jautiva on September 3, Cyprus Mail reports.
The case of minority shareholders
Seventeen minority shareholders of a Latvian public limited liability company brought the case before the court. They challenged legislation providing for the publication of shareholder information online. For natural persons, the register contained identification and contact data, the class, number and nominal value of shares, as well as the corresponding voting rights.
This information could be viewed by unidentified users and downloaded in bulk. Latvia justified this regime by the need to ensure a transparent business environment and protect third parties, prevent money laundering, the financing of terrorism and proliferation, and facilitate compliance with national, international and European sanctions.
More current news is available on the UA.News Telegram channel Telegram.
The requirement of proportionality
The EU Court noted that Directive (EU) 2017/1132 does not require the disclosure of data on all shareholders, including minority shareholders. It provides for the disclosure of information on persons who represent the company or participate in its management, supervision or control. The mere fact of owning shares, the court concluded, does not mean exercising control over the company.
The court found the objectives invoked by Latvia to be legitimate, but stressed that access to personal data must comply with the requirements of necessity and proportionality under the GDPR and the Charter of Fundamental Rights of the European Union. Public disclosure of such information may make it possible to build a profile of a person's financial situation, investment areas and the companies in which they hold investments.
In the court's view, less burdensome measures may include granting access to persons who demonstrate a legitimate interest or introducing targeted data disclosure mechanisms for sanctions purposes. The ruling does not prohibit member states from maintaining company registers or providing access to shareholder information, but requires compliance with the principles of purpose limitation, data minimisation and proportionality.
