Beneficial owner — will information be harder to access?

Do EU UBO registers disclose too much information about beneficial owners?

Public access to information about beneficial owners to be found in the registers was intended to minimise the risk of money laundering and terrorist financing. However, CJEU found that making such information available to the general public was unreasonable as it infringes on the right to respect for private and family life and to protection of personal data guaranteed by the Charter of Fundamental Rights of the European Union (“the Charter”).

Article 30(5)(c) of the AML Directive — which gave rise to the judgement — stipulates that Member States are obliged to provide access to the information on the beneficial ownership in all cases to any person.

Under Article 30(9) of the same Directive, member states may provide for an exemption to the public access to the information on the beneficial ownership. However, such restriction may be applied only in exceptional circumstances where such access would expose the beneficial owner to a disproportionate risk.

Access to the beneficial owners’ information. What will the judgment change?

The judgment was given following two requests for a preliminary ruling lodged by a court in Luxembourg which heard two cases regarding a refusal to restrict public access to information to be found in the Luxembourg’s register of beneficial ownership.

Luxembourg’s laws allowed a very wide access to information on beneficial ownership to be found in the registers (also via the Internet, which is similar to Poland) and restricting access to such information on request of the registered entity or the beneficial owner. A Luxembourg’s company and its beneficial owner requested that Luxembourg Business Registers (an entity keeping the Luxembourg register of beneficial ownership) restrict access to information claiming that the beneficial owner and their family could fall victim of crime as potential offenders could at any time check the beneficial owners of a company and this way identify their targets. The requests were refused which led to an action being brought before a Luxembourg’s court. However, the court had doubts whether disclosing the information is not an infringement on the fundamental rights guaranteed by the Charter.

CJEU decided that the provisions of the AML Directive are invalid under the Charter insofar as they order the information about beneficial owners to be disclosed to any person.

It ruled that the general public’s access to information on beneficial ownership constitutes too much of an interference with the right to respect for private life and to protection of personal data of the beneficial owners. It may also increase the risk that the information on beneficial ownership will be used for purposes other than preventing money laundering and financing of terrorism, which may pose a threat to the beneficial owner and their family.

- Karol Ciszak, Attorney-at-Law, Partner Associate | Deloitte Legal

CJEU ruled that — contrary to the position of the European Commission — the infringements on the Charter are not offset by the benefits in the form of more effective anti-money laundering and terrorist financing measures. Hence, the interference with the above rights is neither minimised nor proportionate to the objective.

Moreover, laws which allows member states to make information on beneficial ownership available on condition of online registration and to provide, in exceptional circumstances, for an exemption from access to that information by the general public are not sufficient safeguards against the risks of abuse.

Notably, CJEU’s judgment does not question the obligation to report certain data to the register of beneficial ownership, but objects to the wide access to the information on beneficial ownership to be found in the register.

- Jędrzej Siarkowski, Attorney-at-Law, Managing Associate | Deloitte Legal

What are the potential consequences of the judgment for Polish entities?

The identity of the beneficial owners of an entity entered in the Central Register of Beneficial Ownership (“CRBR”) can be determined using the NIP number of the entity (which can be easily found in the National Court Register or the REGON database). With a PESEL number, one can easily determine which entities entered in CRBR and how a given person is linked to. There is no CRBR user account necessary, data request or legitimate interest necessary to access the data.

Therefore, one can conclude that in the light of the judgment of CJEU, CRBR fails to provide sufficient protection to the beneficial owners’ data. The arrangements in place in Poland have already been questioned, e.g. by Poland’s Commissioner for Human Rights and the Personal Data Protection Office.

Most likely, CJEU’s judgment will lead to a change of the EU laws and consequently — amendments to the Poland’s Act on prevention of money laundering practices and financing of terrorism.

- Jakub Markiewicz, Advocate, Senior Managing Associate | Deloitte Legal

Moreover, the entities subject to the obligation may question the lawfulness of how CRBR now operates. Specifically, it cannot be ruled out that the judgment will be used as the basis to question the post-inspection proceedings regarding failure to disclose information in CRBR and any resultant fines.

The judgment has been met with a response from certain member states, such as Cyprus, Luxembourg and the Netherlands, which have restricted access to their registers of beneficial ownership. Poland so far has not taken any similar measures; however, it may do so in future.