Latvia’s Constitutional Court (ST) has ruled that unrestricted public access to shareholders’ personal data is incompatible with the Constitution, the court announced.
During its examination of the case, the Constitutional Court asked the Court of Justice of the European Union (CJEU) to issue a preliminary ruling on EU legal requirements concerning the disclosure of shareholders’ personal data.
In the Jautiva case, the CJEU clarified that the General Data Protection Regulation (GDPR) does not permit the personal data of all shareholders, including minority shareholders, to be disclosed to anyone without any conditions governing access.
The Constitutional Court concluded that shareholders’ data is necessary for purposes such as preventing money laundering and ensuring compliance with sanctions. Individuals and institutions with statutory obligations in these areas already have access to the relevant information.
Similarly,
prospective share purchasers who need to establish whether a seller is listed in the shareholders’ register could obtain this information by submitting a justified request.
However, where individuals have no statutory obligations or responsibilities and cannot demonstrate a legitimate interest in obtaining the information, there is no way to ensure that publicly available shareholders’ data is used exclusively for the legitimate purposes established by the legislature, the Constitutional Court explained.
According to the court, unrestricted access to information without any requirement to justify the purpose of obtaining it creates a risk that the information could be used for illegitimate or even malicious purposes.
The court therefore concluded that public security and the rights of others could be protected through less intrusive measures, such as placing shareholders’ data in the non-public section of a company’s registration file and making it available as restricted-access information.
Such an approach would interfere less with shareholders’ rights to the protection of their personal data.
The provisions concerning the publication of sections of the shareholders’ register and the personal data of individuals contained in them will cease to have effect on the date the judgment is published.
For the applicants in the case, however, the provisions have been declared invalid retrospectively from the 1st of July, 2023.
The Constitutional Court’s judgment is final and cannot be appealed. It enters into force on the date of publication.
As previously reported, in November 2024, following an application submitted by shareholders of a joint-stock company, the Constitutional Court initiated proceedings to examine whether Section 4.15, Paragraph 2, Subparagraph (b) of the Law on the Enterprise Register of the Republic of Latvia complied with Article 96 of the Constitution.
The contested provision stipulates that the public section of a company’s registration file must include information from the register of shareholders or members of a capital company concerning its members and administrators of estates, as well as information about joint-stock company shareholders contained in notifications concerning the acquisition, increase or reduction of shareholdings.
The applicants argued that the provision required their personal data to be made public, disproportionately restricting their right to personal data protection guaranteed under Article 96 of the Constitution.
During its examination of the case, the Constitutional Court questioned whether shareholders of joint-stock companies should be regarded as persons participating in the management, supervision or control of a company within the meaning of the relevant European Parliament and Council directive concerning certain aspects of company law.
Consequently, the court also questioned whether that directive required information about all shareholders of joint-stock companies to be made public.
Further doubts concerned whether the principles established in EU regulations on the protection of individuals regarding the processing of personal data and the free movement of such data permitted national legislation allowing anyone to obtain the personal data of any shareholder without having to demonstrate a legitimate interest.
In light of these questions, the Constitutional Court decided to refer the matter to the CJEU.
The CJEU ruled that EU law does not require information about all shareholders of joint-stock companies to be made public and that Latvia’s legislation does not provide sufficient safeguards against the misuse of their personal data.
As the CJEU informed the LETA news agency, the court concluded that the relevant provision of the directive, considering its wording, context and objectives, does not impose an obligation to disclose information about all shareholders, including minority shareholders.
The court noted that the rights to respect for private life and the protection of personal data, guaranteed by the Charter of Fundamental Rights of the European Union, are not absolute and may be restricted in certain circumstances.
However, such restrictions must be established by law, respect the essence of fundamental rights and comply with the principle of proportionality.
The court found that the disclosure of the data in question was provided for by law and did not, in itself, undermine the essence of fundamental rights. Nevertheless, it constituted a serious interference with the rights to privacy and personal data protection.
According to the CJEU, the published information makes it possible to build a profile of a shareholder’s financial circumstances, as well as the sectors and specific companies in which the individual invests.
Furthermore, the information becomes accessible to a potentially unlimited number of people, including individuals whose interest in a shareholder’s financial position has no connection to the purposes for which the data was disclosed.
The court also emphasised that the risks of misuse are increased by the fact that information published online can not only be viewed but also saved and redistributed.
The CJEU pointed out that less privacy-intrusive alternatives are available, such as restricting access to shareholders’ data to individuals who can demonstrate a legitimate interest.
In the context of sanctions enforcement, the obligation to disclose information could instead be limited to data concerning individuals included on sanctions lists.
The CJEU also concluded that Latvia’s legislation does not provide sufficient safeguards to protect individuals against the misuse of their personal data, as the information is available online and can be downloaded in bulk, including by unidentified users.