Founders’ and Beneficial Owners’ Data Transparency VS Personal Data Protection

Sergiu Bozianu,

President of the Privacy Research Association

On January 23, 2023, the decision of the Court of Justice of the European Union (CJEU) was published in the Official Journal of the European Union; it declared some provisions which unjustifiably interfered with the right to private and family life and personal data protection invalid. More exactly, it imposed an obligation to provide public access to the data on reporting entities’ beneficial owners in the member countries of the European Union.

It is about Art. 1 para. 15 c) of Directive (EU) 2018/843 of the European Parliament and of the Council, which was regarded by the CJEU as unreasonably limiting the right to private and family life and personal data protection, including the statement that providing such data to the general public would not be necessary or proportionate.

The decision announced upon request of a court in Luxembourg which was examining an appeal filed by an owner (beneficial owner) of several (35) companies; he complained that the obligation stipulated by the Directive in question was implemented by the public authorities by providing public access to such data on the beneficial owners as their last names, first names, month and year of birth, country of residence, nationality, nature and extent of their interest, and contact details in the Luxembourg Business Registers, i.e. publishing such data was breaching his right to private and family life. He also affirmed that the published data could be used to the detriment of his own physical safety and the safety of his family: it could result in some sorts of abuse, threats, blackmail, or other similar acts. Hence, the applicant complained that all the requests regarding the cessation of the publication of such data addressed to the authorities managing this register had been rejected on the grounds that Directive 2018/843 did not provide for any derogation regarding the refusal to publish such data.

We would like to remind you that the above definitions have the following meanings:

• a beneficial owner is a natural or legal person who is behind the decision-making process or who obtains ultimate pecuniary benefit on behalf of front persons;
• a reporting entity is a person practicing entrepreneurial activity (banks, currency exchange units, gambling organizations, real estate agents, entities working with precious metals, other types of persons practicing entrepreneurial activity pursuant to the provisions stipulated by the legislation) or persons practicing professional activity (lawyer, notary, etc.) who have an obligation to report the information on suspicious transactions which could result in money laundering and terrorist financing to the specialized state structures.

Thus, in the simplest terms, the CJEU stated that it was not correct to provide unrestricted public access to the lists which would include the last name, the first name, date, month, and year of birth, nationality, interest, and benefits of the beneficial owners. The reasons are the following:

1. the objective of countering and combating money laundering and terrorist financing can be achieved by the means which are less intrusive for private life (the control tools available to the public authorities which have access to all the information on the beneficial owners);
2. the amount of categories of personal data to be made public is not proportionate to the objectives pursued and causes imminent risks for private life (such as fraud, kidnapping, blackmail, extortion, harassment, etc.);
3. providing public access to the entire amount of data categories excludes the tools necessary to maintain the balance between transparency, access to information, and the right to privacy.

It should be mentioned that annulling these rules does not limit the “journalistic exceptions” stipulated by the legislation on personal data protection in any way (Art. 85 of the General Data Protection Regulation (GDPR) No 679/2018), for the reason that journalists can request access to the information which cannot be found in public registers, including personal data.

“Journalistic exceptions” imply the right of journalists (the notion of a journalist should be interpreted in a broader sense, as any person who systematically collects and publishes information of public interest, including bloggers, vloggers, etc.) to request and obtain the information which serves to inform society on issues of public interest.

THE WAY THINGS ARE IN THE REPUBLIC OF MOLDOVA

At the end of the last year, a group of deputies registered draft law No 427 amending a number of legislative acts, including Law No 308/2017 on Prevention and Combating Money Laundering and Terrorism Financing. This draft law aims to transpose Directive (EU) 2018/843. Thus, considering the issue of publishing data on beneficial owners, the national legislative authority took the relevant decision of the CJEU into account. The informative note to the draft law mentions that, during the approval procedure for the draft law, upon suggestion of the Centre for Harmonization of Legislation within the State Chancellery, the provisions similar to the invalid ones were excluded.

Do the voiding by the CJEU and the refusal to include these provisions in the draft law of the Republic of Moldova have no impact on journalistic activity?

Unfortunately, in the Republic of Moldova, the journalists’ right to request and to obtain information regarding beneficial owners is not fully complied with. A case of unjustified refusal occurred at the very beginning of this year, when the Intelligence and Security Service refused to provide the data on the beneficial owners of three TV channels, invoking the legislation on the state secret.

Although Art. 8 of Law No 245/2008 on State Secrets expressly provides for the prohibition to provide information on state secrets in case of information of public interest and cases of breaches of the law, and Art. 10 of Law No 133/2011 on Personal Data Protection expressly stipulates the right to access to personal data of public interest for journalistic purposes, the editorial board’s request was rejected without a reasoned argument; it demonstrates that the legal framework could be used as a reason for some excuses.

Moreover, there is a risk that the CJEU decision could be used within an approach unfavorable to the right of access to information and freedom of expression in the context of journalistic purposes; to prevent such a decline, draft law No 427 which regulates using the information on beneficial owners should include not only the information about the CJEU decision on annulling the reference standards, but also clear references to “journalistic exceptions” to ensure the proportionality of these standards and their compatibility with the legal framework, such as Law No 245/2008 on State Secrets, Law No 133/2011 on Personal Data Protection, the Criminal Code, the Criminal Procedure Code, etc.

It should be remarked that the explanations provided by the CJEU, the ECtHR, and the European acquis expressly determine the need to balance the legislation which stipulates a restricted regime of access to the information and the legislation regulating public access and the right to reuse information of public interest.

SUMMING UP

It would be a violation of the right to private life and personal data protection to affirm that “any public sector information related to beneficial owners should be exposed to unrestricted public access”; likewise, it would be a breach to consider that “the access for journalistic purposes should be limited in case of information of public interest, including access to information on beneficial owners.”