European court decides on public access to shareholder information

Personal data of shareholders of public limited liability companies should not be made available without any conditionsBy Kyriaki Stinga and Adonis Zachariou On September 3, the Court of Justice of the European Union (CJEU) delivered its judgement in Case C-798/24, Jautiva, addressing the compatibility of unrestricted public access to shareholder information with European Union company law and data protection rules. The CJEU held that EU Directive (EU) 2017/1132 relating to certain aspects of company law does not require the disclosure of information relating to all shareholders, including minority shareholders.It also held that Regulation (EU) 2016/679 (GDPR) precludes national legislation making personal data relating to shareholders of public limited liability companies available to the general public where access is not subject to any conditions, such as the demonstration of a legitimate interest. The judgement follows the principles established in the 2022 judgement in Joined Cases C-37/20 and C-601/20, Luxembourg Business Registers (LBR), while considering them in the context of registered shareholders rather than beneficial owners. The background The case arose in Latvia, where 17 minority shareholders of a public limited liability company challenged legislation requiring information concerning shareholders to be made publicly available online. For natural persons, the information included identification and contact details, together with the class, number and nominal value of the shares held and the corresponding voting rights. The information was accessible to unidentified users and could be downloaded in bulk. Latvia relied on three principal objectives to justify the disclosure regime: ensuring a transparent business environment and protecting third parties, preventing money laundering and terrorist and proliferation financing, and facilitating compliance with national, international and EU sanctions. The Latvian Constitutional Court referred the matter to the CJEU to determine, among other things, whether EU company law required such disclosure and whether unrestricted access was compatible with the GDPR and Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Shareholding does not, in itself, amount to control Article 14 of the Company Law Directive requires disclosure of information concerning certain persons who represent a company or participate in its administration, supervision or control. The CJEU rejected the argument that this concept extends to every shareholder. A shareholder derives that status from participation in the share capital, whereas persons involved in the administration or supervision of a company are appointed to particular functions and exercise corresponding powers. Minority shareholders, in particular, will not ordinarily represent the company, bind it towards third parties or exercise management or supervisory functions merely by virtue of their shareholding. The CJEU therefore concluded that the Company Law Directive does not require information concerning every shareholder to be made publicly available. Legitimate objectives, but disproportionate access The CJEU then considered whether Latvia could nevertheless provide for unrestricted disclosure under national law. The objectives relied upon by Latvia were capable of constituting legitimate objectives of general interest. This did not, however, remove the need for the disclosure regime itself to satisfy the requirements of necessity and proportionality under the GDPR and the charter. The CJEU regarded the disclosure as a serious interference with the rights protected under Articles 7 and 8 of the EU charter. The information made public could enable a profile to be developed concerning an individual’s financial position, the sectors in which that person invests and the companies in which investments are held. These concerns were greater where the information was available online to a potentially unlimited number of persons and could subsequently be retained and disseminated. As regards corporate transparency, the CJEU found that disclosure of information concerning all shareholders, particularly minority shareholders without management or controlling functions, did not appear useful for the protection of third parties. The objectives relating to anti-money laundering (AML) and sanctions compliance did not justify unrestricted access either. Less intrusive alternatives were available, including limiting access to persons able to demonstrate a legitimate interest and, for sanctions purposes, adopting more targeted disclosure arrangements. The existence of a recognised public interest objective therefore does not, on its own, justify making personal data freely available to everyone. Beyond beneficial ownership registers In LBR, the CJEU held that unrestricted public access to beneficial ownership information constituted a serious interference with the rights protected under Articles 7 and 8 of the EU Charter and went beyond what was strictly necessary for AML purposes. Jautiva applies the same proportionality considerations in the context of registered shareholders. This is relevant in particular for minority shareholders who may neither qualify as beneficial owners under applicable thresholds nor exercise control over the company. The judgement does not prevent member states from maintaining company registers or providing access to shareholder information. It does, however, confirm that the manner in which personal data is made available must remain consistent with the GDPR principles of purpose limitation, data minimisation and proportionality. The current EU AML framework has already moved towards a more restricted model of access. Directive (EU) 2024/1640 provides for access to beneficial ownership information by members of the public who can demonstrate a legitimate interest, alongside the access available to competent authorities and obliged entities. Relevance for Cyprus The judgement may also be relevant to the Cyprus corporate disclosure framework. The Department of Registrar of Companies and Intellectual Property maintains the electronic register of business entities, through which information concerning company members, including historic shareholder information, may be accessible. The companies register should be distinguished from the Register of Beneficial Owners (the UBO Register), public access to which was suspended following the Luxembourg Business Registers case. Under the current beneficial ownership framework, access may nevertheless be available in certain circumstances where a legitimate interest is demonstrated. In this respect, Jautiva is also relevant because of its treatment of legitimate interest and the limitations surrounding access to ownership-related personal data. The judgement confirms that access to such information cannot be treated as unlimited and remains subject to the requirements of necessity, proportionality and data protection. While the judgement does not determine whether the existing Cyprus disclosure framework is compatible with the GDPR, its reasoning may therefore be relevant both to shareholder disclosure and, more broadly, to the conditions under which access to personal ownership information is justified. Any such assessment would need to take into account the information disclosed, the purpose served by access and the safeguards applying to its use. Jautiva represents a further development in the CJEU case law on the interaction between corporate transparency and the protection of personal data. The judgement confirms that the disclosure requirements imposed by EU company law should not be interpreted as extending automatically to information concerning all shareholders and that national measures providing wider public access to shareholder information remain subject to the GDPR and the principles of necessity and proportionality. Its practical implications will depend on the structure of the corporate disclosure regime in each member state. In Cyprus, the judgement does not of itself alter the existing statutory filing or disclosure requirements. It may, however, provide a relevant framework for considering whether the nature, extent and manner of public access to personal shareholder information strike an appropriate balance between legitimate transparency objectives and the fundamental rights protected under EU law. Kyriaki Stinga is a partner and Adonis Zachariou is an associate at Elias Neocleous & Co LLC