Judgment of the Court in Joined Cases C-37/20 | Luxembourg Business Registers and C-601/20 | Sovim S.A.
The long-awaited decision of the European Court of Justice in Luxembourg Business Registers and Sovim S.A. (Cases C-37/20 and C-601/20 respectively) has been given. The Court has held that the provision in the anti-money laundering directive whereby the information on the beneficial ownership of companies incorporated within the territory of the Member States is accessible in all cases to any member of the general public is invalid. The interference with the rights guaranteed by the Charter of Fundamental Rights of the European Union entailed by that measure is neither limited to what is strictly necessary nor proportionate to the objective pursued.
Background
In accordance with the anti-money-laundering directive, a Luxembourg law adopted in 2019 established a Register of Beneficial Ownership and provided that a whole series of information on the beneficial owners of registered entities must be entered and retained in that register. Some of that information was accessible to the general public (including in particular information that was accessible by internet search). The law also provided that a beneficial owner may request Luxembourg Business Registers (LBR), the administrator of the Register, to restrict access to such information in certain cases.
In that context, the Luxembourg District Court was seized of two actions, brought by a Luxembourg company and its beneficial owner, who had previously unsuccessfully requested LBR to restrict the general public's access to information concerning them. The Luxembourg District Court considered that the disclosure of such information is capable of entailing a disproportionate risk of interference with the fundamental rights of the beneficial owners concerned, it referred a series of questions to the European Court of Justice for a preliminary ruling concerning the interpretation of certain provisions of the anti-money laundering directive and the validity of those provisions in the light of the Charter of Fundamental Rights of the European Union (the “Charter”).
The Court of Justice held that the provision of the anti-money-laundering directive whereby Member States must ensure that the information on the beneficial ownership of corporate and other legal entities incorporated within their territory is accessible in all cases to any member of the general public is invalid. In the view of the Court, the general public's access to information on beneficial ownership constitutes a serious interference with the fundamental rights to respect for private life and to the protection of personal data enshrined in Articles 7 and 8 of the Charter, respectively. Indeed, the information disclosed enables a potentially unlimited number of persons to find out about the material and financial situation of a beneficial owner. Furthermore, the potential consequences for the data subjects resulting from possible abuse of their personal data are exacerbated by the fact that, once those data have been made available to the general public, they can not only be freely consulted, but also retained and disseminated.
That said, the Court found that, by the measure at issue, the EU legislature seeks to prevent money laundering and terrorist financing by creating, by means of increased transparency, an environment less likely to be used for those purposes. This is an objective of general interest capable of justifying even serious interferences with the fundamental rights enshrined in Articles 7 and 8 of the Charter, and that the general public's access to information on beneficial ownership is appropriate for contributing to the attainment of that objective. The Court held, however, that the interference entailed by that measure was neither limited to what is strictly necessary nor proportionate to the objective pursued. Additionally, by the fact that the provisions allowed for data to be made available to the public which was not sufficiently defined and identifiable, the regime introduced by the anti-money-laundering directive amounted to a considerably more serious interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter than the former regime (which provided, as well as access by the competent authorities and certain entities, for access by any person or organisation capable of demonstrating a legitimate interest), without that increased interference being capable of being offset by any benefits which might result from the new regime as compared against the former regime, in terms of combating money laundering and terrorist financing. In particular, the fact that it may be difficult to provide a detailed definition of the circumstances and conditions under which such a legitimate interest exists, relied upon by the Commission, is no reason for the EU legislature to provide for the general public to access the information in question.
The Court added that optional provisions which allow Member States to make information on beneficial ownership available on condition of online registration and to provide, in exceptional circumstances, for an exemption from access to that information by the general public, respectively, are not, in themselves, capable of demonstrating either a proper balance between the objective of general interest pursued and the fundamental rights enshrined in Articles 7 and 8 of the Charter, or the existence of sufficient safeguards enabling data subjects to protect their personal data effectively against the risks of abuse.
Comment
This ruling will be read with interest by regulators and legislators, as it affirms the need for proportionality and a sense of balance as they pursue the policy objectives of crime prevention while weighing the rights of private citizens. As this case illustrates, a focus on one objective to the exclusion of others is undesirable (and potentially unlawful). The experience of the BVI may be a helpful contrast for other jurisdictions to consider as they seek to achieve well-regulated compliance, whilst balancing legitimate interests of privacy and data protection.
Regulatory oversight in the United Kingdom Overseas Territories has transformed over the last 25 years (and in particular since 2016), and jurisdictions such as the BVI and Cayman Islands now regulate corporate service providers to a very high standard. In the BVI, there is an obligation for all companies to have a licensed (and regulated) registered agent, which is obliged to obtain and maintain beneficial ownership information. (In the cases of politically exposed persons (PEPs), there are heightened obligations.)
The BVI Government entered into an agreement (by exchange of notes) with the UK Government in April 2016. To facilitate the provision of information envisaged by that agreement, the BVI introduced the Beneficial Ownership Secure Search System Act 2017, which established a regime to facilitate the effective storage and retrieval of beneficial ownership information for all BVI companies and legal entities using the Beneficial Ownership Secure Search system. This beneficial ownership information is also available to other authorities in the BVI to facilitate regulatory compliance and to help the BVI meet its international obligations. Importantly, however, the system is not generally accessible to the public.
In 2023 further important changes will be introduced in the BVI (introducing changes in areas such annual returns, and corporate dissolution, for example). Upon request and payment of a search fee, the names of a company's current directors may be made available publicly on application to the Registrar of Companies via the BVI online filing platform, VIRRGIN. Other information about the directors besides the names will not be produced on the search.
Where a company has been involved in wrongdoing, there is a plethora of remedies available in the BVI (including ordering the production of details of ownership and control), and the BVI has a Commercial Court that is both sophisticated and willing to provide assistance in the case of legitimate applications for such relief.
If ownership information falls into the wrong hands, however, the consequences can be devastating, as the Court of Justice implicitly recognises. It is not simply a case of public embarrassment: in many countries the dissemination of such information could in some cases present serious risks of extortion, kidnap and death.
By contrast, systems which are ostensibly more public, but which do not require the involvement of regulated professionals in the incorporation process are vulnerable to widespread abuse. For instance, despite recent efforts to introduce a requirement for evidence of the existence of registered directors of UK companies to be provided on incorporation https://www.bbc.com/news/business-54209977, for example, a recent BBC investigation found that some 150,000 UK companies had been established by criminal gangs, stealing the identities and addresses of unsuspecting and innocent private citizens: https://www.bbc.com/news/uk-england-manchester-62494987
This is not to single out the UK: there are abundant, sometimes eye-stretching, stories from other jurisdictions. What it illustrates, however, is that compliance is a challenge that cannot be met by a single set of criteria. Where company incorporation can only be performed by a regulated service provider, a substantial compliance burden is passed to that provider. Where the incorporation process can be done by anybody, however, it is open to abuse by criminals, and the fact that information may be publicly available is no benefit (and can cause serious collateral damage) when the information turns out to be false.
By requiring companies to have a regulated corporate service provider, the BVI effectively co-opts the private sector to its compliance mission. By resisting demands for unrestricted public access to beneficial ownership details, however, the BVI regime both requires such information to be given, while lessening the incentive for it to be false.
As regulatory burdens evolve to meet challenges and co-opt technological opportunities there is unlikely to be a model of universal application. However good and bad regulatory experiences of other jurisdictions can be heeded, and used to develop legislation and regulatory practices that fulfil legitimate compliance objectives, whilst permitting business to be done with ease without infringing the rights of private individuals.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
