Finding the right balance between adequately protecting a private individual's right to privacy while also addressing the public's interest in having certain information made available has been the subject of significant debate with proponents of freedom of information arguing that the public have an interest in having access to certain information.
In this respect, it is important to note that the European Convention on Human Rights, the EU Charter of Fundamental Human Rights ("EUCHR") and Malta's Constitution enshrine the notion of a right to private life while also creating room for such a right to be limited in circumstances.
Constitution of Malta
"Whereas every person in Malta is entitled to the fundamental rights and freedoms of the individual, that is to say, the right to... respect for his private and family life".
Those rights are "subject to such limitations of that protection as are contained in those provisions being limitations designed to ensure that the enjoyment of the said rights and freedoms by any individual does not prejudice the rights and freedoms of others or the public interest".
EUCHR
Article 7 – Respect for private and family life
Everyone has the right to respect for his or her private and family life, home and communications.
Article 8 – Protection of personal data
- Everyone has the right to the protection of personal data concerning him or
- Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
- Compliance with these rules shall be subject to control by an independent authority.
It is indeed critical that these rights are balanced against public interest and it is the search for this balance that has sparked significant debate.
The interpretation of this right has been the subject of a number of decisions of both the European Court of Human Rights ("ECHR") as well as the European Court of Justice ("ECJ").
Finding this balance has not always been easy and while the ECHR has held that "the notion of private life is a broad concept" (Bărbulescu v. Romania (Application no. 61496/08)), the ECHR has also expressly stated that where there is a conflict between two rights or the manner in which these rights are applied then the "the State is called upon to guarantee both rights and if the protection of one leads to an interference with the other, to choose adequate means to make this interference proportionate to the aim pursued" (Fernández Martínez v. Spain ((Application no. 56030/07)).
Judgements by the ECJ also identify that there needs to be a balance of rights. Of particular relevance was the case Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. This case centred around a complaint which was lodged by a Spanish citizen against a Spanish newspaper, Google Inc and Google Spain complaining that a notice regarding his repossessed home infringed his privacy rights since the proceedings had been fully resolved for a number of years and therefore the information was irrelevant. He requested that Google be ordered to remove the personal data relating to him.
In its ruling, the ECJ held that "Article 7 of the [EU Charter of Fundamental Human Rights] guarantees the right to respect for private life, whilst Article 8 of the Charter expressly proclaims the right to the protection of personal data" and that "a fair balance should be sought in particular between that interest [being the legitimate interest of internet users potentially interested in having access to that information] and the data subject's fundamental rights under Articles 7 and 8 of the Charter" (Case C‑131/12).
Of particular interest is that in this case, the ECJ went as far as to state "in the light of his fundamental rights under Articles 7 and 8 of the Charter.. it should be held... that those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject's name". Therefore, the ECJ makes it clear that the interest of the general public much largely be balanced again an individual's right to private life and it should only be in particular reasons that the "the interference with his fundamental rights is justified by the preponderant interest of the general public".
More recently, the ECJ has been called upon again to find a balance between Articles 7 and 8 of the EUCHR and Directive (EU) 2018/843 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and amending Directives 2009/138/EC and 2013/36/EU (the "AMLD").
In WM (C‑37/20) and Sovim SA (C‑601/20) v Luxembourg Business Registers (Joined Cases C‑37/20 and C‑601/20), a dispute arose in relation to whether Article 30(5)(c) of the AMLD (which provides that "Member States shall ensure that the information on the beneficial ownership is accessible in all cases to any member of the general public") is in fact valid when having regard to the provisions of Article 7 and 8 of the EUCHR.
In issuing its decision, the ECJ noted that:
- the AMLD aims to create an environment which is hostile to criminals and that enhancing the overall transparency of the economic and financial environment of the European Union could be a powerful deterrent; and
- the objective of the general public's access to information on beneficial ownership 'allows greater scrutiny of information by civil society, including by the press or civil society organisations, and contributes to preserving trust in the integrity of business transactions and of the financial system' (Recital 30 AMLD).
By means of this recital and recital 31 of the AMLD, the EU legislature has sought to create an objective of general interest which would allow an interference in the rights under Articles 7 and 8 of the EUCHR. The basis of this is that the ECJ has held that there are certain purposes which "undoubtedly constitute objectives of general interest of the European Union that are capable of justifying even serious interferences with the fundamental rights enshrined in Articles 7 and 8" (C‑817/19, Ligue des droits humains v Conseil des ministers).
However, in this case the ECJ also noted "that derogations from and limitations on the protection of personal data should apply only in so far as is strictly necessary. In addition, an objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure, by properly balancing the objective of general interest against the rights at issue".
In examining whether there had been a proper balancing exercise, the ECJ noted that the Council and Commission had in fact conducted an impact assessment prior to proposing amendments to the AMLD in order to determine the most appropriate legislative solution (the "Impact Assessment"). In this regard, it was noted that access to beneficial ownership information could be restricted to those persons who can demonstrate a legitimate interest. In fact, in terms of the General Data Protection Regulation ("GDPR"), processing of personal data in furtherance of legitimate interests pursued by the controller is permitted "except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child".
The difficulty with this is that providing a definition of this somewhat elusive concept is difficult. The Impact Assessment specifically noted that "this concept [legitimate interest] aims at addressing potential data protection and privacy concerns and has to be defined and assessed at national level. However, this criterion related to the legitimate interest left to national discretion may lead to excessive limitations of the access to the register as well as to a lack of a level playing field". Therefore the risks here were that diverse definitions may lead to a non-uniform application of the AMLD. The other option considered was to grant full access to the public. The Impact Assessment noted that "full public access needs to be carefully assessed regarding its compatibility with the Charter" given that there are "legal risks in terms of compatibility with the Charter of Fundamental Rights".
While it is clear that the EU legislature identified that balance needed to be struck, the decision to then grant full access by members of the public tipped the balance firmly to the transparency side despite the weight of the other elements discussed above. Recital 30 of the AMLD notes that "[p]ublic access to beneficial ownership information allows greater scrutiny of information by civil society, including by the press or civil society organisations, and contributes to preserving trust in the integrity of business transactions and of the financial system" and therefore, it is clear that this was the impetus behind allowing access to the general public.
As the ECJ notes in its judgement "both the press and civil society organisations that are connected with the prevention and combating of money laundering and terrorist financing have a legitimate interest in accessing information on beneficial ownership. This has also clearly been the case in relation to investigations conducted by the Fourth Estate which have come to light in recent years. However, it is hard to quantify how, and to what extent, mass access by the public can help reduce money laundering and ensure that the objective of general interest outlined above is met. In its own Impact Assessment, it was noted that "giving full public access rights to the information held in the registers will ensure more consistency in the EU framework as regards the access to beneficial ownership information and more efficiency in the traceability of the beneficial owner" with respect to limited liability companies but appeared to stop short of actually identifying how access by the public would achieve these general interest objectives.
Having regard to (i) the above considerations and (ii) that combatting money laundering and terrorist financing is largely an obligation of public authorities, competent authorities and obliged entities the ECJ concluded that "providing for the general public's access to information on beneficial ownership, amounts to a considerably more serious interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter, without that increased interference being capable of being offset by any benefits which might result from the latter regime as compared against the former regime, in terms of combating money laundering and terrorist financing" and on that basis held that the amendment to the AMLD to allow access to the general public is invalid.
The main issue here is the decision to move from the original wording which provided that "Member States shall ensure that the information on the beneficial ownership is accessible in all cases to: any person or organisation that can demonstrate a legitimate interest" to full blown access by the general public. While one recognises the risks that come with attempting to define a 'legitimate interest' since a definition may be unduly restrictive or broad, it is entirely possible to identify categories of persons who have a legitimate interest. In fact, the AMLD teeters close to the point of doing so when identifying members of the press or civil society organisations in its Recital. This, in and of itself, gives insight to the frame of mind of the EU legislature. Unfortunately, failure to do so essentially forced the ECJ's hand since it is critical that fundamental rights are protected and that a general interest objective needs to be clearly identified.
One could also argue that the wording of the AMLD would even appear to violate the provisions of GDPR given that it may result in mass processing of personal data by individuals who might not necessarily be in a position to demonstrate a legitimate interest which overrides the interests of the data subjects (being the beneficial owners) in question. This is quite apart from the risks of cross-border data transfers to countries which do not afford the same level of protection granted pursuant to GDPR.
These concepts clearly identify how important it is for the legislator to identify (so as not to define) different examples of a legitimate interest or alternatively persons who are deemed to have a legitimate interest in order to ensure that the aims of the EUCHR, our Constitution and the AMLD align and work together. Unfortunately, the current wording of Article 30(5)(c) is quite categoric in favour of transparency over privacy on this particular subject matter and the decision of the ECJ though apparently equally categoric and potentially draconian, is not surprising. Following this decision, the task of the legislators now is to find an appropriate middle in order to ensure that the aims of the AMLD are met while at the same time the rights under Articles 7 and 8 are respected.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.