Are privacy laws compatible with corporate transparency?

February 2023 | SPECIAL REPORT: CORPORATE FRAUD & CORRUPTION

Financier Worldwide Magazine

February 2023 Issue

Are privacy laws compatible with corporate transparency? This question has troubled legal commentators for many years. It arises in a multitude of different scenarios. How can someone’s private life remain private when there is a growing demand for transparency, arguably to protect the safety and security of the wider general public?

On 22 November 2022, the Court of Justice of the European Union (CJEU) delivered what some have described as a landmark decision reversing the ever-increasing demands for transparency and forcing policymakers to reflect on the compatibility of competing corporate transparency measures with privacy laws.

The CJEU ruled that aspects of the European Union’s (EU’s) anti-money laundering (AML) rules that required public access to registers recording information concerning the beneficial ownership of companies were “invalid” due to conflict with EU privacy rules.

The CJEU decision

The CJEU considered two separate cases referred from Luxembourg, which were joined for purposes of its decision, regarding the listing of beneficial ownership information on the publicly accessible Luxembourg company register. In both cases the complainant Luxembourg-registered companies challenged the decision of the register not to restrict access to beneficial ownership information under an exception that allows public access to be restricted (consistent with EU AML rules) in circumstances where it would expose persons to a risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation.

In one case the Luxembourg courts referred to the CJEU questions relating to what would constitute “exceptional circumstances” and “risk” sufficient to justify restricting access to information. In the other the company brought a challenge before the CJEU on the basis that: (i) public access to such information is inconsistent with the rights to private and family life and to personal data under articles 7 and 8 of the Charter of Fundamental Rights of the EU; and (ii) public access to such information constitutes an infringement of certain articles of the EU General Data Protection Regulation (GDPR).

In its decision, the CJEU held that the general public’s access to information on beneficial ownership constitutes a “serious interference” with article 7 and 8 rights under the Charter, but that such interference may be justified in the context of measures that seek to prevent money laundering and terrorist financing, which the CJEU accepted as an “objective of general interest” capable of justifying even serious interference with the fundamental rights in the Charter.

Having accepted this, the CJEU considered whether interference with rights that results from making available beneficial ownership information is appropriate, necessary and proportionate in relation to the prevention of money laundering and terrorist financing. In this regard, the CJEU held that the interference with Charter rights resulting from the publication of beneficial ownership information cannot be considered to be limited to what is strictly necessary.

The CJEU drew a distinction between the beneficial ownership information regime set out in the current 5th EU AML Directive (Directive 2018/843), which provided for general public access to beneficial ownership information, and the earlier 4th EU AML Directive (Directive 2015/849), which provided for more limited access to beneficial ownership information for competent authorities and certain entities (such as financial institutions), as well as by any person or organisation capable of demonstrating a “legitimate interest”.

The CJEU considered that the shift to the latter regime “amounts to a considerably more serious interference with the fundamental rights […], without that increased interference being capable of being offset by any benefits which might result from the latter regime as compared against the former regime, in terms of combating money laundering and terrorist financing”. Consequently, the court declared “invalid” article 1(15)(c) of the 5th AML Directive, which provided for access for the general public to beneficial ownership information on company registers.

EU impact

The CJEU decision does not impact upon the rights of access to beneficial ownership information of law enforcement authorities, or credit institutions (and other parties whom it has historically been accepted should have access to beneficial ownership information), as the cases focused specifically on issues of public access.

However, by invalidating the universal public access standard of the 5th AMLD, the CJEU decision reverts to the position under the 4th AMLD, where access to beneficial ownership information is available upon formal request to those with a legitimate interest. Accordingly, following the CJEU’s decision, online company registers in Austria, Belgium, Luxembourg and the Netherlands were taken offline and public access by default has ceased in these jurisdictions.

The legitimate interest requirement is not included in the current draft of the EU’s proposed 6th EU AML Directive (COM/2021/423), published in July 2021 as part of the EU’s broader package of proposals to “strengthen” AML rules (which also include proposals to establish an EU-wide AML enforcement authority and for the harmonisation of EU AML rules). The 6th AMLD, which will presumably be amended following the CJEU decision, included among its recitals: “Public access to beneficial ownership information can allow greater scrutiny of information by civil society, including by the press or civil society organisations, and contributes to preserving trust in the integrity of the financial system. It can contribute to combating the misuse of corporate and other legal entities and legal arrangements for the purposes of money laundering or terrorist financing, both by helping investigations and through reputational effects, given that anyone who could enter into a business relationship is aware of the identity of the beneficial owners.”

The same recitals do go on to refer to the need to strike a balance between public access and the fundamental rights of data subjects. Notably, the 6th AMLD does include a “legitimate interest” standard with respect to information relating to “express trusts and similar legal arrangements”, where legitimate interests will explicitly extend to “preventive work in the field of anti-money laundering and its predicate offences and counter-terrorist financing undertaken by non-governmental organisations and investigative journalists”, but notably not to the general public.

As such, there is inconsistency between the “legitimate interest” standard as framed with respect to trusts in the current draft of the 6th AMLD and the general principle of public access to beneficial ownership information, to which the foregoing recital refers, even where such public access is conditional upon legitimate interest as it was formulated in the 4th AMLD. In responding to the CJEU decision, EU policymakers will need to carefully consider and clarify what constitutes a “legitimate interest” sufficient to allow access to beneficial ownership information, which will be complex given the need to balance the competing desire for transparency against privacy rights.

In any event, and whatever the eventual standard for legitimate interests, the requirement for bodies that administer company registers in EU member states to respond to access requests and make determinations on the sufficiency of legitimate interests is likely to result in significant expense and to delay access to information even for those who can establish a legitimate interest.

UK impact

As a result of Brexit, the CJEU decision does not apply directly to the UK and its impact is further limited by the fact that the CJEU based its decision upon privacy rights under the Charter rather than the GDPR, which is largely retained in UK law in the form of the UK GDPR (though it should be noted that the Charter rights upon which the decision was based are broadly replicated in the European Convention on Human Rights, which is separate from EU law and was incorporated into UK law through the Human Rights Act, so a similar challenge could conceivably be brought in the UK).

However, notwithstanding its applicability in the UK, the CJEU decision poses potential policy issues for the UK. First, it creates significant divergence between the EU and the UK with respect to beneficial ownership transparency, which some may see as impacting the UK’s comparative attractiveness as a place to set up a business.

Second, the UK has taken steps toward greater corporate transparency during the past year through both the Economic Crime (Transparency and Enforcement) Act 2022, which passed into law in 2022 and the proposed Economic Crime and Corporate Transparency Bill, which is currently before parliament at the committee stage and includes a wide range of measures aimed at reform of Companies House in the name of greater transparency.

Given that the long-awaited introduction of the Economic Crime Act, and the subsequent introduction of the Economic Crime Bill, were both framed by the UK government as having been introduced in response to Russia’s invasion of Ukraine, it may be difficult politically for the UK to dramatically reverse its current direction of travel on corporate transparency.

Conclusion

The CJEU decision highlights the tension between, and questions over the compatibility of, AML and privacy rules. The EU (and the UK) will need to consider the extent to which privacy rights and laws should impact upon measures designed to combat money laundering and terrorist financing and to promote corporate transparency more generally. Of particular note in this regard is the possible impact of the CJEU decision on compliance with economic sanctions measures, which the CJEU did not consider.

The CJEU decision arrives just as transparency of beneficial ownership information has taken on increased importance for businesses globally following the expansion of economic sanctions targeting Russia in response to the war in Ukraine. EU and UK asset freezing sanctions, which prohibit dealings with specified parties, extend also to parties owned or controlled by such parties (and US sanctions extend to parties that are majority owned by designated parties), meaning it has become increasingly important for those engaged in business to be able to identify who are the beneficial owners of counterparties with whom they are dealing. One unintended consequence of the CJEU decision is to complicate this assessment.

Ian Hargreaves is a partner and Thomas McGuire is an associate at Covington & Burling LLP. Mr Hargreaves can be contacted on +44 (0)20 7067 2128 or by email: ihargreaves@cov.com. Mr McGuire can be contacted on +44 (0)20 7067 2139 or by email: tmcguire@cov.com.

Ian Hargreaves and Thomas McGuire

Covington & Burling LLP

Corporate fraud & corruption

Q&A: Offshore AML regulation and enforcement

International executives facing a US internal investigation: what to consider

Chats, texts and other messages: US authorities expand expectations on data collection of business-Related communications

New protections and financial incentives for whistleblowers in the US