Protecting UBO’s Privacy: Why Founders Should Care About The CJEU Decision

In November 2022, the Court of Justice of the European Union issued a ruling with significant implications, stating that the provision of public access to ultimate beneficial ownership (UBO) information of corporate and legal entities infringes on privacy, family life, and personal data protection rights under the Charter of Fundamental Rights. 

Who are UBOs and why do they need to disclose their personal information?

The Court of Justice of the European Union issued this decision in response to a request by a Luxembourg company and a company owner who wanted to limit public access to UBO information. Their requests reached the Court which ultimately decided that the UBO’s right to privacy and protection of personal data outweighs the public’s right to access this information.

Who are beneficial owners? Beneficial ownership of a legal entity is typically attributed to a natural person who has direct or indirect control or ownership of at least 25% of the entity’s shares or voting rights. However, beneficial ownership can also take other forms, such as through control or influence exerted through agreements with shareholders or the company. This includes minor investors who have the right to block decisions made by the general assembly.

Disclosure of the UBOs and their personal information is mandated by the EU Anti-Money Laundering and Countering the Financing of Terrorism Directive under which all EU states are obligated to obtain and hold information on the beneficial ownership of all legal entities incorporated within their territory, including the details of the beneficial interests held (AML Directive). The implementation of the AML Directive varies across the EU states – while, for example, the Czech UBO registry and Slovak UBO registry require the publication of the name, the month and year of birth, nationality and the address, the Luxembourg UBO registry also includes the UBO’s birth number (rodné číslo) which is a very sensitive piece of personal information. Under the AML Directive, this information is easily accessible by anyone.

The Slovak UBO Registry and the Czech UBO Registry are both available online. In the Slovak Republic, the legislature has gone beyond the requirements of the AML Directive and created the Registry of Public Sector Partners. This registry mandates the registration of all legal entities and individuals who intend to receive monetary or non-monetary assets from public sector entities. 

Does this decision impact startups?

A number of EU states immediately reacted to this decision by shutting down their national UBO registries while others only blocked the public from accessing the UBO information. Although startups that prioritize transparency and have no qualms about disclosing their UBOs may not be significantly affected by this decision, it could have a critical impact on their business relationships and transactions. In the startup world, knowing who your business partners are can be crucial, and finding this information may be harder following this decision.

In the Slovak Republic and the Czech Republic, the UBO registries continue to be publicly accessible after the decision and you can still verify who the UBO is on the other side of the business relationship. However, as a result of this decision, the Slovak and Czech state authorities are expected to limit the range of persons who will have access to the registers, or at least limit the information available to the general public. 

When incorporating a company in the Slovak Republic or the Czech Republic, you are still required to register at the UBO registers; otherwise, you are risking a fine to the tune of up to EUR 3,310 in the Slovak Republic and CZK 500,000 in the Czech Republic. Additionally, in the Slovak Republic, a fine of between EUR 10,000 and EUR 100,000 can be imposed for failing to register a UBO in the Registry of Public Sector Partners.

If you wish to complain against the publication of you personal information in the Czech and Slovak registries, you can (i) make a complaint to the Czech/Slovak Ministry of Justice; (ii) make a complaint to the Office for Personal Data Protection; or (iii) take legal action and file a claim for non-pecuniary damages resulting from the infringement of privacy and personal data protection rights due to the Ministry of Justice’s decision to keep the UBO registry publicly available despite the decision. However, these are only tentative options and it is difficult to say at this point how each of the authorities would respond to such a request.

In conclusion

Although the recent decision to restrict public access to UBO information may not have a direct impact on startups that prioritize transparency, obtaining UBO information of your business partners may become more challenging in the wake of this ruling.

For Slovak and Czech startups, it is still essential to keep in mind the ongoing legal obligation to register their UBOs, and it is also useful for them to know their right to take legal action if they want to have their details removed from the UBO registry. 

While it’s unclear how this decision will affect startups in the region, one thing is certain: complying with UBO regulations will remain a crucial issue for many businesses in the years ahead.

Author: Jitka Vrtělová and Martin Ďuriš
Editors: Tatiana Pavelková