In a consequential ruling from November last year, the European Court of Justice struck down public access for beneficial ownership registries in the EU (ECJ judgment) on the basis of their interference with rights to privacy and personal data protection under the EU Charter of Fundamental Rights. Opening up beneficial ownership registries to the general public was a key provision of the 5th EU Anti Money Laundering Directive that was celebrated as a major step forward, a game changer, by anti-corruption activists and transparency campaigners in 2018 when the directive was adopted. This decision marks a consequential shift in the EU’s approach towards BO registries, and many countries outside of Europe, including countries that we assist with their legislation or implementation of beneficial ownership reforms, look towards the EU to inform their own decisions about registries and public access. Some European countries immediately took their registries offline following the ruling (Luxembourg, Austria, Germany, Netherlands, Ireland). Other countries are - so far - keeping their registries open to the public.
The ruling, which was fiercely criticized by many in the anti-corruption community as “the ECJ’s gift to oligarchs under sanctions” and “opening the floodgates for dark money”, does not say that public access to beneficial ownership information is never, under any circumstances, justified. But - for the specific purpose of fighting money laundering and in the specific European legislative context, under EU data protection laws - it limits access to those that can be said to have, in the language of the previous AML directive, “a legitimate interest” in such information.
Importantly, the Court confirmed in this ruling that journalists and civil society organizations that investigate or campaign on crime and corruption, as well as financial institutions and other entities with AML obligations, have a legitimate interest in access to beneficial ownership information. The court even felt the need to issue a clarification on LinkedIn since this aspect was mostly overlooked in initial panicked reactions to the decision.
The Court’s argument centers on balancing a public interest objective (fighting crime and money laundering) with individuals’ rights to privacy and protection of personal data under the EU Charter. On this legal question, it found that the publication of personal data of beneficial owners to any member of the general public, beyond those groups that can demonstrate a legitimate interest of sorts, is not proportionate and not limited to what is ‘strictly necessary’ for AML objectives. Clearly, the ECJ did not consider geopolitics or practical challenges to designing layered access models to databases, and nor should it have.
Given the realities of limited law enforcement and financial intelligence resources and the frequent failure by governments to prioritize corruption and money laundering offenses, one can certainly take issue with the Court’s views on the necessity of public access for deterring, detecting and investigating international corruption with complex cross border flows of money and assets. OCCRP, a network of investigative journalists focused on reporting about corruption and organized crime, illustrated this by laying out exactly how critical public beneficial ownership registers in Cyprus, Malta and Luxembourg (where the ECJ case was brought to court) were for their reporting on corruption and crime issues in Russia, Serbia, Hungary, and Lebanon. It goes without saying that such media investigations are often important leads for investigative and prosecution authorities, and that journalists and civil society organizations play an essential role in anti-money laundering defenses.
The main reason why the 5th AML directive replaced the ‘legitimate interest’ access provision with general public access for beneficial ownership registries was a practical matter, not a legal matter. Europe’s experience with the previous directive showed that in practice, in the absence of a common definition of ‘legitimate interest’, procedures for people to request access to non-public ownership data were too cumbersome and time-consuming. The same practical challenges apply now that the ECJ’s decision has invalidated general public access in the EU: How can countries give rapid access to restricted registries to financial institutions, journalists, activists, and foreign law enforcement officials? Who is a journalist or a member of a civil society organization, and how do you prove that?
Consequently, some of the most interesting questions about the ruling are about the definition of ‘legitimate interest’ in information on company ownership and about finding practical solutions to difficult challenges of giving rapid access to all the right people.
This decision also means that countries in the process of reforming their legal frameworks should consider which policy objectives their beneficial ownership registries serve and, whether in their specific national context, establishing a legal basis for beneficial ownership registries that goes beyond ‘pure AML’ objectives, including for example anti-corruption, business integrity, competition and trade, widens the circle of those that have a legitimate interest. Of course, what applies to the European legal context is not automatically the right course of action for countries outside of Europe that face very different risks, resource constraints, and other practical realities.
Irrespective of geography or income level, interrogating whether the collection and publication of personal data (and company data that includes personal data) by governments is limited, necessary, and proportionate to policy objectives is important and healthy in a democracy. Thinking hard about some of these questions now may ultimately prove helpful in the nascent negotiations around beneficial ownership registries which require balancing fighting crime and corruption, holding governments accountable, protecting personal data, and upholding the rule of law.