In a recent judgement of the European Court of Justice (CJEU), the court stated that EU law does not require the disclosure of information relating to all shareholders of public limited liability companies, including minority shareholders.

Furthermore, EU law precludes the online disclosure of personal data relating to such shareholders where access to those data is not subject to any conditions, such as demonstrating a legitimate interest, even if such disclosure pursues an objective of general interest recognised by the European Union.

A constitutional complaint has been brought before the Constitutional Court of Latvia by 17 minority shareholders of a public limited liability company who are challenging the compatibility with the right to respect for privacy and the protection of personal data, guaranteed by the Latvian Constitution, of a provision of national law requiring that information relating to the shareholders of public limited liability companies be made available to the public.

Where such a shareholder is a natural person, that information is to include the surname, first name, personal identification number or, in the absence of such a number, the date of birth, the number and date of issue of an identity document, the country and issuing authority, and the address at which the shareholder can be contacted. In addition, and regardless of whether the shareholder is a natural person, that information is also to include the shareholder's email address, the class, number and nominal value of the shares held by that shareholder, and the number of votes attaching to the shares. That information is to be accessible online and may be downloaded in bulk, including by any unidentified user.

The applicants contend that the Latvian legislature has failed to justify the need to disclose that information to the public, pointing to a high risk of it being used for dishonest purposes. Moreover, once disclosed, it is not possible to place any restrictions on its subsequent use. They rely, in particular, on the judgment of the Court of Justice of 22 November 2022, Luxembourg Business Registers, concerning public access to information about the beneficial owners of companies.

The Constitutional Court of Latvia considers that, in this instance, that disclosure pursues three objectives, namely, first, to ensure a transparent business environment so as to protect the interests of third parties, second, to prevent money laundering and the financing of terrorism and the proliferation of weapons of mass destruction, and, third, to provide the information necessary for the implementation of national, international and EU sanctions.

Harbouring doubts as to whether EU law and, in particular, Directive 2017/1132 imposes a disclosure requirement, the Constitutional Court of Latvia made a reference to the Court of Justice for a preliminary ruling. That reference also concerns whether the General Data Protection Regulation (GDPR) precludes national legislation requiring personal data relating to all shareholders of public limited liability companies, including minority shareholders, to be made available to the public in order to achieve the three objectives referred to above, where access to those data is not subject to any conditions, such as demonstrating a legitimate interest.

In the judgment, the Court holds, first, that, having regard to its wording, context and the objectives it pursues, the relevant provision of Directive 2017/1132 does not require the disclosure of information relating to all shareholders of public limited liability companies, including the minority shareholders of such companies.