Jautiva: CJEU Clarifies Public Access To Shareholder Information

On 3 September 2026, the Court of Justice of the European Union (the "CJEU") delivered its judgment in Case C-798/24, Jautiva (the "Judgment"), addressing the compatibility of unrestricted public access to shareholder information with European Union ("EU") company law and data protection rules.¹

The CJEU held that Directive (EU) 2017/1132 relating to certain aspects of company law (the "Company Law Directive") does not require the disclosure of information relating to all shareholders, including minority shareholders.²It also held that Regulation (EU) 2016/679 (the "GDPR") precludes national legislation making personal data relating to shareholders of public limited liability companies available to the general public where access is not subject to any conditions, such as the demonstration of a legitimate interest.

The Judgment follows the principles established in the 2022 judgment in Joined Cases C-37/20 and C-601/20, Luxembourg Business Registers ("LBR"), while considering them in the context of registeredshareholders rather than beneficial owners.³

The background

The case arose in Latvia, where 17 minority shareholders of a public limited liability company challenged legislation requiring information concerning shareholders to be made publicly available online. For natural persons, the information included identification and contact details, together with the class, number and nominal value of the shares held and the corresponding voting rights. The information was accessible to unidentified users and could be downloaded in bulk.

Latvia relied on three principal objectives to justify the disclosure regime: ensuring a transparent business environment and protecting third parties, preventing money laundering and terrorist and proliferation financing, and facilitating compliance with national, international and EU sanctions.

The Latvian Constitutional Court referred the matter to the CJEU to determine, among other things, whether EU company law required such disclosure and whether unrestricted access was compatible with the GDPR and Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (the "Charter").⁴

Shareholding does not, in itself, amount to control

Article 14 of the Company Law Directive requires disclosure of information concerning certain persons who represent a company or participate in its administration, supervision or control.⁵

The CJEU rejected the argument that this concept extends to every shareholder. A shareholder derives that status from participation in the share capital, whereas persons involved in the administration or supervision of a company are appointed to particular functions and exercise corresponding powers.  Minority shareholders, in particular, will not ordinarily represent the company, bind it towards third parties or exercise management or supervisory functions merely by virtue of their shareholding.

The CJEU therefore concluded that the Company Law Directive does not require information concerning every shareholder to be made publicly available.

Legitimate objectives, but disproportionate access

The CJEU then considered whether Latvia could nevertheless provide for unrestricted disclosure under national law.  The objectives relied upon by Latvia were capable of constituting legitimate objectives of general interest. This did not, however, remove the need for the disclosure regime itself to satisfy the requirements of necessity and proportionality under the GDPR and the Charter.⁶

The CJEU regarded the disclosure as a serious interference with the rights protected under Articles 7 and 8 of the Charter. The information made public could enable a profile to be developed concerning an individual’s financial position, the sectors in which that person invests and the companies in which investments are held. These concerns were greater where the information was available online to a potentially unlimited number of persons and could subsequently be retained and disseminated.

As regards corporate transparency, the CJEU found that disclosure of information concerning all shareholders, particularly minority shareholders without management or controlling functions, did not appear useful for the protection of third parties.

The objectives relating to anti-money laundering ("AML") and sanctions compliance did not justify unrestricted access either. Less intrusive alternatives were available, including limiting access to persons able to demonstrate a legitimate interest and, for sanctions purposes, adopting more targeted disclosure arrangements.  The existence of a recognised public interest objective therefore does not, on its own, justify making personal data freely available to everyone.

Beyond beneficial ownership registers

In LBR, the CJEU held that unrestricted public access to beneficial ownership information constituted a serious interference with the rights protected under Articles 7 and 8 of the Charter and went beyond what was strictly necessary for AML purposes.⁷

Jautiva applies the same proportionality considerations in the context of registeredshareholders. This is relevant in particular for minority shareholders who may neither qualify as beneficial owners under applicable thresholds nor exercise control over the company.

The Judgment does not prevent Member States from maintaining company registers or providing access to shareholder information. It does, however, confirm that the manner in which personal data are made available must remain consistent with the GDPR principles of purpose limitation, data minimisation and proportionality.  The current EU AML framework has already moved towards a more restricted model of access. Directive (EU) 2024/1640 provides for access to beneficial ownership information by members of the public who can demonstrate a legitimate interest, alongside the access available to competent authorities and obliged entities.⁸

Relevance for Cyprus

The Judgment may also be relevant to the Cyprus corporate disclosure framework. The Department of Registrar of Companies and Intellectual Property (the "Registrar") maintains the electronic register of business entities (the "Companies Register"), through which information concerning company members, including historic shareholder information, may be accessible.⁹

The Companies Register should be distinguished from the Register of Beneficial Owners (the "UBO Register"), public access to which was suspended following LBR. Under the current beneficial ownership framework, access may nevertheless be available in certain circumstances where a legitimate interest is demonstrated.¹⁰

In this respect, Jautiva is also relevant because of its treatment of legitimate interest and the limitations surrounding access to ownership-related personal data. The Judgment confirms that access to such information cannot be treated as unlimited and remains subject to the requirements of necessity, proportionality and data protection.

While the Judgment does not determine whether the existing Cyprus disclosure framework is compatible with the GDPR, its reasoning may therefore be relevant both to shareholder disclosure and, more broadly, to the conditions under which access to personal ownership information is justified. Any such assessment would need to take into account the information disclosed, the purpose served by access and the safeguards applying to its use.

Conclusion

Jautiva represents a further development in the CJEU case law on the interaction between corporate transparency and the protection of personal data. The Judgment confirms that the disclosure requirements imposed by EU company law should not be interpreted as extending automatically to information concerning all shareholders and that national measures providing wider public access to shareholder information remain subject to the GDPR and the principles of necessity and proportionality.

Its practical implications will depend on the structure of the corporate disclosure regime in each Member State. In Cyprus, the Judgment does not of itself alter the existing statutory filing or disclosure requirements. It may, however, provide a relevant framework for considering whether the nature, extent and manner of public access to personal shareholder information strike an appropriate balance between legitimate transparency objectives and the fundamental rights protected under EU law.

Footnotes

^{1 Court of Justice of the European Union, Jautiva, Case C-798/24, Judgment of 3 September 2026, ECLI:EU:C:2026:679; Court of Justice of the European Union, Press Release No 115/26, 3 September 2026.}

^{2 Directive (EU) 2017/1132 of the European Parliament and of the Council of 14 June 2017 relating to certain aspects of company law, in particular Articles 13, 14 and 16 and Annex II.}

^{3 Court of Justice of the European Union, Luxembourg Business Registers, Joined Cases C-37/20 and C-601/20, Judgment of 22 November 2022, ECLI:EU:C:2022:912.}

^{4 Charter of Fundamental Rights of the European Union, Articles 7, 8 and 52(1).}

^{5 Article 14(d) of the Company Law Directive.}

^{6 Regulation (EU) 2016/679, in particular Articles 5 and 6, read together with Articles 7, 8 and 52(1) of the Charter.}

^{7 Luxembourg Business Registers, Joined Cases C-37/20 and C-601/20, in particular paragraphs 63 to 85.}

^{8 Directive (EU) 2024/1640 of the European Parliament and of the Council of 31 May 2024, in particular Articles 12 and 13.}

^{9 Department of Registrar of Companies and Intellectual Property, Searching the Business Register. The Registrar confirms that a detailed electronic search includes historic information concerning company members.}

^{10 Department of Registrar of Companies and Intellectual Property, Suspension of access to the Beneficial Owners register for the general public, 28 November 2022.}

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.