Why did the EU’s highest court strike down transparency on company ownership?

Last week, the Malta Business Registry (MBR) shut down public access to information on the owners of Malta-registered companies, citing a ruling by the European Union’s highest court that repealed a key provision of the bloc’s stringent anti-money laundering rules.

Criticism was swift and furious, both locally and abroad, with the Opposition describing the move as “manifestly disproportionate and hasty” and demanding access for the press and civil society, while international anti-corruption watchdog Tax Justice Network warned that the decision will throw the EU back into “the dark ages of dirty money”.

While the news came as a shock amidst the EU’s continuing tightening of the rules and regulations regarding the use of its financial system to prevent its use by criminal elements, a deeper reading into the landmark judgement shows a degree of nuance that has largely been buried under bombastic headlines.

The story begins with two court cases in Luxembourg, with an individual and a company suing the Luxembourg Business Registers (LBR) for failing to accept their request to prevent access by the general public to their ownership information.

The individual, ‘WM’, argued that his business interests frequently require him to travel to countries whose political regime is unstable and where there is a high level of crime, which creates a significant risk of his being kidnapped, abducted, subjected to violence or even killed.

The other case was brought by Sovim, a real estate firm, which argued that providing unrestricted access to information about its owner was in breach of GDPR (the EU’s strict data protection code) provisions.

It is pertinent to note that the information stored – and therefore accessible – through Luxembourg’s registry is quite extensive, and includes an owner’s full name, nationality, date and place of birth, country of residence and complete private or professional address, ID number, and the nature and extent of the beneficial interests held.

While hearing these two cases, the Luxembourg District Court asked the Court of Justice of the European Union – the court tasked with interpreting and meting out judgement on EU law – for its opinion on how the provision within the 5th anti-money laundering directive allowing public access to ownership information should be understood.

In its opinion, the Court of Justice (CoJ) considered the conflict between the EU’s efforts to combat dirty money flows through its financial system with the provisions of the EU Charter of Fundamental Rights guaranteeing the right to respect for one’s private and family life, home and communications, and expressly conferring on everyone the right to the protection of their personal data.

It referred to case law making clear that making personal data available to third parties constitutes an interference with the fundamental rights.

Additionally, it stated that “it is inherent in making that information available to the general public in such a manner that it is then accessible to a potentially unlimited number of persons, with the result that such processing of personal data is liable to enable that information to be freely accessed also by persons who, for reasons unrelated to the objective pursued by that measure, seek to find out about, inter alia, the material and financial situation of a beneficial owner”.

In effect, once the data is public for any one reason, it is effectively public for any reason, and may be consulted by anyone – even those with ulterior motives.

However, the CoJ continued, the right to privacy is not an absolute right, reminding that “limitations may be made on those rights and freedoms, [but] only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others”.

The CoJ explained that access to ownership information is acceptable in both legal terms and with respect to the essence of fundamental rights.

Responding to the CoJ’s questioning of the reasoning behind the directive, the European Commission said that the previous access to such information by those with “legitimate interest” posed a problem due to the difficulty of ascertaining what such legitimate interest could include.

However, the court dismissed this argument, referring to case law establishing that difficulty to legislate particular details is no reason to simply open the doors to general access.

It also dismissed the European Commission and European Parliaments arguments that allowing greater scrutiny of information by civil society would make criminals think twice about using the EU’s financial system for criminal proceeds, finding that the EU already has a well-structured system of financial watchdogs in place, and which already have access to such information.

As for the protections business owners could avail of, under the provision, to petition registries to restrict access to their data on account of risks to their person or company, the court found that they are insufficient to act as proper safeguards against such risk.

It therefore found that allowing the general public access to ownership information goes far beyond what is necessary to keep the EU’s financial system free from dirty money.

However, it also recognised that civil society organisations and the press do have legitimate interest in accessing such information, given their role in the fight against money laundering, providing such entities a basis for greater scrutiny.

In this regard, the MBR’s decision to limit access to information on companies’ ultimate beneficial owners (UBO) to competent authorities and subject persons (such as Money Laundering Reporting Officers and similar official roles) may be seen as a decision that respects the letter, but not the spirit, of the court’s judgement.

It remains to be seen whether this narrow interpretation holds up to challenge, with the Opposition having already called on Justice Minister Jonathan Attard and Economy Minister Silvio Schembri to table legislative amendments to recognise the rights of local journalists and civil society activists to access the MBR’s UBO registry.

Additionally, the CoJ did leave the door open to further legislation in this area, through its statement that the protection of privacy may indeed be severely curtailed to prevent money laundering – but only if such legislation is delicately crafted to ensure a proper balance between the public private interest.

In allowing the general public access to sensitive personal information about company owners, the Court of Justice found, the EU had failed in this legislative task.