On 3 September 2026, the Court of Justice of the European Union (the “CJEU”) ruled that EU law does not require the public disclosure of information relating to shareholders of public limited liability companies. It also held that the General Data Protection Regulation (“GDPR”) precludes national legislation which makes such data available to the public where access is not subject to any conditions, such as the demonstration of a legitimate interest. Jautiva (C‑798/24) is a significant judgment which addresses the inherent risks in making shareholder data publicly available particularly where it can be accessible to an unlimited number of people and may be downloaded in bulk by any unidentified user. The decision represents a further development in recent CJEU case law on the interaction between corporate transparency, the protection of personal data and public-interest objectives.
Background
In this case, a complaint was raised before the Latvian Constitutional Court by 17 minority shareholders of a Latvian public limited liability company, who had challenged the compatibility of a provision of national law which required certain information relating to shareholders of public limited liability companies to be made publicly available with the right to privacy guaranteed by the Latvian Constitution.
Under the Latvian law, the disclosed information could include identity and contact details, class, number, nominal value of the shares of each shareholder and the relevant voting rights attached to them. The applicants in this case had sought to rely on a previous CJEU ruling in Luxembourg Business Registers (joined cases C‑37/20 and C‑601/20) which found that allowing unrestricted access to beneficial ownership registers was a disproportionate interference with the right to respect for private life and the protection of personal data under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (the “EU Charter”) and the GDPR. Central to their argument was the contention that minority shareholders, who do not have the status of beneficial owners, who exercise no control and hold no management positions, should also be entitled to equal protection from unrestricted public access to their data.
The Latvian Constitutional Court referred several questions to the CJEU for a preliminary ruling, including whether unrestricted access was compatible with the GDPR and Articles 7 and 8 of the EU Charter, and clarification on whether Article 14(d) of Directive 2017/1132 relating to certain aspects of company law (the “Company Law Directive”) required the disclosure of the personal data of all shareholders of a public limited liability company, including its minority shareholders. Article 14(d) compels Member States to take measures to ensure compulsory disclosure by companies of certain documents and particulars relating to persons who are authorised to represent the company in dealings with third parties and in legal proceedings, or who take part in the administration, supervision or control of the company.
The Latvian Constitutional Court had identified three objectives pursued by the Latvian law, namely to ensure a transparent business environment so as to protect the interests of third parties, preventing money laundering and the financing of terrorism and the proliferation of weapons of mass destruction, and to provide the information necessary for the implementation of national, international and EU sanctions.
The decision
In its ruling, the CJEU primarily held that Article 14(d) of the Company Law Directive must not be interpreted as requiring the public disclosure of information relating to all the shareholders of the companies covered by that provision, including minority shareholders. The CJEU found that the blanket disclosure of shareholder data did not appear to serve any useful purpose in light of the objective of protecting the interests of third parties and legal certainty as minority shareholders are not, in principle, authorised to represent a public limited liability company, nor do they perform management or supervisory functions for the company.
The CJEU had also assessed the serious implications arising from the indiscriminate disclosure of shareholder data, noting that information of this nature could potentially be used by an unlimited number of persons to create a profile of a person’s state of wealth and the economic sectors and specific undertakings in which that person has invested. While the Court held that making this data available to the public did not undermine the essence of the rights to privacy and data protection under Articles 7 and 8 of the EU Charter, it nevertheless found this to constitute a serious interference with those rights. The decision acknowledged the potential consequences for data subjects resulting from the possible abuse of their data which has been made publicly available and noted the practical difficulties for shareholders to effectively defend against the abuse of such information. The CJEU found that the national legislation was not appropriate or necessary to achieve the general interests pursued in ensuring a transparent business environment and that national measures remain subject to the GDPR and the principles of necessity and proportionality.
The CJEU went on to find that unrestricted public access was also disproportionate in relation to the other two objectives relied on by the Latvian Parliament, namely preventing money laundering and terrorism financing and facilitating the enforcement of sanctions. While increased transparency could in principle assist those aims, the Court considered that less intrusive alternatives were available, such as restricting access to persons able to demonstrate a legitimate interest or, for sanctions purposes, limiting mandatory disclosure to shareholders actually named on sanctions lists.
Conclusion
Publicly available statutory registers will likely hold important personal information about beneficial owners and shareholders of a public limited liability company. The judgment dispels any assumption that EU disclosure requirements operate as a blanket mandate for the public availability of shareholder information, confirming instead that such requirements are directed at those who represent or manage the company and do not extend automatically to all shareholders.
In Ireland, public access to the Central Register of Beneficial Ownership of Companies and Industrial and Provident Societies has been further overhauled in 2026 by the European Union (Anti-Money Laundering: Beneficial Ownership of Corporate Entities) (Amendment) Regulations 2026 so that an applicant must now obtain a certificate from the Registrar confirming a demonstrated legitimate interest before inspecting the register. This offers a practical illustration of the trend of seeking to balance the aim of beneficial ownership transparency with the data privacy rights of beneficial owners.
Jautiva provides an important clarification in the field of corporate transparency: unrestricted access to shareholder data, in the absence of any condition such as a legitimate interest requirement or other adequate safeguards against the risk of abuse, is incompatible with the GDPR and the EU Charter. The judgment is likely to be of broader relevance to company registers and beneficial ownership regimes across the EU, building on the approach taken in Luxembourg Business Registers and reinforcing the trend towards conditioning public access to personal data held on company registers on a demonstrated legitimate interest.
Contact us
For more information on this, please contact a member of the Matheson Corporate team.
