On 3 September, the Court of Justice of the European Union (CJEU) delivered its judgment in Case C-798/24 Jautiva, holding that EU law does not require information on private individuals, shareholders of joint-stock companies, to be made publicly available. The Court also held that the General Data Protection Regulation (GDPR) precludes national legislation requiring the personal data of all shareholders of joint-stock companies to be made publicly available.
“With this significant judgment, the Court of Justice of the European Union has drawn a clear line as regards public access to individuals’ personal data and emphasised responsibility of the State to ensure that not all shareholder data submitted to public authorities is made publicly available. The Court acknowledged our clients’ concerns that, once disclosed, detailed information of shareholders becomes accessible to a potentially unlimited number of persons, including those seeking to ascertain, for example, material and financial situation of such shareholders (paragraph 71). Against the backdrop of recent events in Latvia, where several public data bases have experienced cyberattacks and large-scale personal data breaches, the Court’s observation in paragraph 72 is particularly pertinent: ‘The potential consequences for the data subjects resulting from possible abuse of their data are exacerbated by the fact that, once those data have been made available to the public, they can not only be freely consulted, but also retained and disseminated and that, in the event of such successive processing, it becomes increasingly difficult, or even illusory, for those data subjects to defend themselves effectively against abuse’. The judgment is significant not only for our case, which will now continue before the Constitutional Court of Latvia, but also more broadly in strengthening the protection individual’s right to privacy. The judgment makes clear that the legislator must strike the appropriate balance between the need for effective risk management and interference with individuals’ right to privacy,” says Lauris Liepa, Managing Partner at COBALT and counsel for the shareholders in the proceedings.
The case was referred to the CJEU following a request for a preliminary ruling from the Constitutional Court of the Republic of Latvia. The Constitutional Court is examining a case of 17 minority shareholders of a joint-stock company, represented by COBALT, concerning provisions of the Law On the Enterprise Register of the Republic of Latvia that provide for public access to information contained in the shareholder registers of joint-stock companies, and their compatibility with the right to respect for private life guaranteed by Article 96 of the Constitution of Latvia.
In its request to the CJEU, the Constitutional Court sought clarification, among other matters, as to whether EU company regulation requires information on every shareholder of a joint-stock company to be made publicly available and whether such disclosure of personal data is permissible under the GDPR.
Interpreting the relevant provisions of EU law, the CJEU concluded that they do not require information on all shareholders of joint-stock companies, including minority shareholders, to be made publicly available.
At the same time, the Court held that Articles 5 and 6 of the GDPR, read in the light of the rights to respect for private life and to the protection of personal data guaranteed by the Charter of Fundamental Rights of the European Union, preclude legislation requiring the public disclosure of personal data concerning all shareholders of joint-stock companies, including data relating to their identity and contact details, as well as the shares they hold and the voting rights attached to those shares.
The Court also considered the objectives invoked by Latvia to justify the public disclosure of such data: ensuring a transparent business environment and protecting the interests of third parties; preventing money laundering and terrorist and proliferation financing; and ensuring access to information necessary for the implementation of sanctions.
While recognising the importance of these objectives, the Court concluded that achieving them does not require general public access to the personal data of all shareholders of public limited liability companies. Those objectives can be achieved through measures that interfere to a lesser extent with individuals’ rights to respect for private life and to the protection of personal data.
Following the CJEU’s preliminary ruling, the Constitutional Court will continue its examination of the case and assess the compatibility of the relevant Latvian legislation with the Constitution of Latvia.
The applicants in the proceedings before the Constitutional Court are represented by the COBALT team comprising Managing Partner Lauris Liepa, Senior Associate Gabriela Šantare, and Junior Associate Marisa Aktumane.
Leading experts
