Court concludes serious violation of right to private life and protection of personal data
The introduction of the UBO register is part of the fourth anti-money laundering directive (directive n°2015/849 on the prevention of the use of the financial system for the purpose of money laundering or terrorist financing, as amended by directive n° 2018/843, also referred to as the fifth anti-money laundering directive). Europe wanted this UBO register to require member states to collect and manage certain data on the UBOs of companies and legal entities established in member states. This was intended to create more transparency regarding corporate structures and other entities in the wake of well-known media scandals such as the Panama Papers, and to counter money laundering and terrorist financing.
The case in which the European Court of Justice ruled specifically concerns the Luxembourg UBO register. Both the beneficial owner of a Luxembourg real estate company, as well as another Luxembourg company, had each separately seized the Luxembourg 'tribunal d'arrondissement' (court of first instance) to restrict the general public's unlimited access to the information contained in the Luxembourg UBO register. The argument in chief is the violation of the right to protection of private and family life, as well as the right to protection of personal data as enshrined in Articles 7 and 8 of the Charter. The Luxembourg court subsequently decided to refer to the European Court of Justice a series of preliminary questions on the interpretation of certain provisions of the anti-money laundering directive and their validity in the light of the Charter of Fundamental Rights of the European Union.
Any citizen - even for reasons unrelated to the objective pursued by the UBO register - can freely access the data recorded in the UBO register. Moreover, this effect is enhanced when this UBO information can be simply consulted via the internet. Moreover, not only can this data be freely consulted by anyone, but it can also be stored and disseminated. The Court therefore concludes that access by any citizen of information about identified natural persons affects the guaranteed fundamental right to the protection of private life. According to the Court's settled case-law, making those personal data available to third parties is also a serious interference with both the right to the protection of private life and the protection of personal data.
No justification in the light of the objective pursued, the fight against whitewash and terrorism financing
The Court recognises that the objective of the UBO register, namely to prevent money laundering and terrorist financing by creating a 'hostile' environment for criminals, constitutes a public interest objective. Such public interest objective can in principle justify heavy intrusions on the rights guaranteed by the Charter. However, this requires that the measures taken are appropriate, strictly necessary and proportionate to achieve that objective; criteria which, according to the Court, were not met in the present case:
- The fact that public access to UBO information "may help" to combat the abuse of companies and other legal entities, as well as "could help" in a criminal investigation, does not suffice for the Court as far as the necessity requirement is concerned.
- Combating money laundering and terrorist financing is primarily a matter for public authorities and subject entities such as credit or financial institutions that are already subject to a series of (identification) obligations under the Money Laundering Directive by virtue of their activities.
- The foreseen restrictions on making beneficial ownership information publicly available, such as prior online registration and providing for exceptions to access in exceptional circumstances, are insufficient to justify such a serious infringement of European fundamental rights. Nor are there sufficient safeguards to enable affected UBOs to effectively protect their personal data from misuse.
- Under the Fourth AMLD, it was provided that citizens could only access the UBO register upon demonstration of a legitimate interest. Under the fifth anti-money laundering directive, this condition of demonstrating a legitimate interest was removed as far as companies are concerned due to the lack of a uniform definition of this concept and the practical difficulties this had caused. This deletion results in a significantly heavier erosion of the fundamental rights guaranteed by the Charter, without compensating in any way compared to the initial regime.
Impact for the Belgian UBO register
The Belgian UBO register is regulated by the Act of 18 September 2017 (Anti-Money Laundering Act) and the Royal Decree of 30 July 2018 ('RD') that defines its operating modalities.
The Belgian UBO register grants (free) access to any citizen to consult the data of companies - at least until publication of the decision of the European Court of Justice. For this purpose, prior identification is required via electronic identity card. The information relating to this consultation will be kept for a period of 10 years. It is important to mention that this unlimited access to data only concerns companies. If one wishes to consult information in the UBO register regarding UBOs of a (i) non-profit organisation, foundation, trust, fiduciary or similar legal arrangement, a legitimate interest must be demonstrated.
In addition, an exception to access to the data in the UBO register may also be granted upon reasoned request if such access would expose the UBO to a disproportionate risk, a risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation. If the UBO is a minor or incapacitated, this derogation may be granted automatically.
Unbridled public access to the Belgian UBO register has also been criticised several times in the past by both the Council of State and the Data Protection Authority (then Privacy Commission). In May 2017, for example, the Data Protection Authority already pointed out that certain personal data obtained through the UBO register could be transferred, used and sold internationally and in an uncontrolled manner by data traders such as Graydon. The European regulator has also indicated on this issue that processing personal data collected for one purpose for a completely different purpose violates the purpose limitation principle of data protection and threatens the implementation of the proportionality principle.
Nevertheless, it was chosen to retain this arrangement, albeit with a limitation on the scope of UBO data that can be accessed. To this end, reference can also be made to the Report to the King accompanying the Royal Decree, which seeks to justify public access and its proportionality with the purpose of the Act.
Thus, it must be concluded that the implementation of the Belgian UBO register differs little from its little brother in Luxembourg. This also means, in my view, that because of this European Court ruling, public access to the Belgian UBO register should be a thing of the past as of 22 November 2022. The judgment as well as the official press release can be accessed here.
How does the UBO saga continue now?
Although the European Court's decision was made in response to a series of preliminary questions raised in the context of Luxembourg's UBO register, this ruling is primarily addressed to the European legislator and the European Commission and consequently also has an impact on all member states.
In the Netherlands, Finance Minister Sigrid Kaag asked the Chamber of Commerce to temporarily shut down public access to the register. The Luxembourg UBO register was also immediately taken offline. It can also be expected that the Luxembourg court will rule in line with this welcome decision of the European Court.
Regarding the Belgian UBO register, it was formally confirmed on the website of the FPS Finance that following the judgment of 22 November 2022, access to the general public to information on beneficial owners is temporarily suspended. It is also announced that a solution will soon be communicated that should allow access to data in the Belgian UBO register in accordance with the judgment. The public consultation of therefore also the Belgian UBO register is no longer possible as of today (24/11/2022).
The Court thus draws a line under the public consultability of the UBO register, but not the UBO register itself. The tax administration and other competent authorities, as well as the entities subject to notification, will still be able to consult the UBO register on a permanent basis.