Limits set on the disclosure of shareholders’ personal data

How public should the details of a company shareholder be? Does the need for corporate transparency justify allowing anyone to know a shareholder’s identity, the shares they hold, their voting rights and other personal data? And where should the line be drawn between the public’s right to information and a shareholder’s right to privacy?

The Court of Justice of the European Union provided answers to these questions in its judgment on September 3 in Case C-798/24, Jautiva. The judgment concerns the protection of shareholders’ personal data and is relevant to the company registers of member states, including Cyprus.

The case arose in Latvia, where 17 minority shareholders of a public limited company brought proceedings before the Constitutional Court challenging legislation that permitted the disclosure of shareholders’ personal data.

The information included names, identification and contact details, as well as the class, number and nominal value of the shares and the corresponding voting rights. The data was accessible online and could be downloaded in bulk by users without them being required to identify themselves.

The first conclusion of the CJEU concerns Directive 2017/1132 on company law. The court held that the obligation to disclose information concerning persons involved in the administration, supervision or control of a company does not mean that every shareholder performs such a role.

Consequently, EU law does not require the disclosure of information concerning all shareholders of a public limited company and, in particular, minority shareholders.

More significant is the CJEU’s ruling in the light of the General Data Protection Regulation and Articles 7 and 8 of the Charter of Fundamental Rights. Unconditional access by anyone to the personal data of all shareholders constitutes a serious interference with the rights to private life and the protection of personal data.

The court did not dispute that corporate transparency, the protection of third parties, the fight against money laundering and terrorist financing, as well as the implementation of sanctions, constitute legitimate objectives of general interest.

The issue is whether, in order to achieve those objectives, it is necessary and proportionate to make the personal data of every shareholder available to anyone without restriction.

The answer was negative. Particular importance was attached to the fact that the data could be found online and downloaded in bulk by users without them being required to identify themselves.

Once the information has been disseminated, the person concerned effectively loses control over its subsequent use. The CJEU indicated that less intrusive means are available, such as granting access to persons who can demonstrate a legitimate interest.

The judgment is relevant to Cyprus. The Registrar of Companies maintains an electronic register, while a company’s annual return contains information concerning its share capital and register of members.

Electronic searches also provide access to historical company information, including information concerning its members.

An important distinction must be made here. A shareholder and a beneficial owner are not necessarily the same person.

A shareholder is the person in whose name shares are registered. A beneficial owner is the natural person who ultimately owns or controls the company, directly or indirectly, through a shareholding, voting rights or other means of control. A minority shareholder, therefore, may not be a beneficial owner.

This distinction acquires additional significance because Cyprus maintains a separate Register of Beneficial Owners.

Public access to that register was suspended in November 2022 following the CJEU’s judgment in Joined Cases C-37/20 and C-601/20, Luxembourg Business Registers, in which the court held that general public access to beneficial ownership information constituted a serious interference with the rights guaranteed by Articles 7 and 8 of the Charter.

Jautiva takes the discussion one step further. It concerns not only beneficial owners, but also the personal data of shareholders, particularly those who, because of their limited shareholding, do not exercise control over the company.

The judgment does not abolish corporate transparency, nor does it require company registers to be closed. It does, however, emphasise that transparency is neither an end in itself nor an unrestricted right of access to other persons’ personal data. Any disclosure must serve a legitimate purpose and be limited to what is genuinely necessary.

For Cyprus, therefore, the new judgment provides an opportunity to reconsider the balance achieved by the existing system of corporate disclosure. The need for transparency in business transactions is indisputable.

Equally clear, however, is that the mere status of being a shareholder cannot turn a natural person into an “open book” for anyone who wishes to read it.