The UBO register and public access: Privacy First v the State (2021) and WM and Sovim (C-37/20)

The judgments

The question

Since 27 September 2020 Dutch companies and other legal entities, from BVs and NVs to foundations, associations and partnerships, must record their ultimate beneficial owners (UBOs) in the trade register kept by the Chamber of Commerce (KVK); entities that already existed had until 27 March 2022. The obligation itself comes from EU law: Article 30 of the fourth Anti-Money Laundering Directive, Directive (EU) 2015/849, requires a central register of beneficial ownership in each Member State. The fifth Directive, Directive (EU) 2018/843, went further: it replaced access for persons with a “legitimate interest” by access for “any member of the general public”. The Netherlands implemented that by making the UBO’s name, month and year of birth, residence, nationality and the band of his economic interest open to anyone who paid €2.50.

The question for founders, family-business owners and their advisers was whether that public access could stand. A Dutch privacy foundation tried to stop it in interim relief proceedings in The Hague and lost twice, in March and November 2021. A year later, in joined cases referred by a Luxembourg court in proceedings brought by a businessman and a company, the Grand Chamber of the Court of Justice declared the public-access rule of the fifth Directive invalid. The three judgments answer different questions. The Dutch courts asked whether a national court may suspend legislation implementing a directive whose validity is in doubt; the Court of Justice asked whether the directive itself was compatible with the rights to private life and data protection. Read together, they show both the limits of national interim relief against EU-based legislation and the substantive standard that EU legislation on public registers of personal data must meet.

The legal framework

The directive

Article 30(1) and (3) of Directive 2015/849 require Member States to ensure that corporate and other legal entities incorporated in their territory obtain and hold adequate, accurate and current information on their beneficial ownership, and that the information is held in a central register. Article 3(6) defines the beneficial owner as the natural person who ultimately owns or controls the entity, and, failing such a person, the senior managing officials.

Access is governed by Article 30(5). In its original 2015 version, point (c) of the first subparagraph opened the register to “any person or organisation that can demonstrate a legitimate interest”, who were to access at least the name, month and year of birth, nationality, country of residence and the nature and extent of the beneficial interest. Article 1(15)(c) of Directive 2018/843 replaced point (c) by “any member of the general public”. The second subparagraph kept the “at least” list, and the third subparagraph of the amended paragraph 5 allowed Member States to give access to “additional information enabling the identification of the beneficial owner”, including at least the date of birth or contact details. A new paragraph 5a allowed Member States to require online registration and a fee not exceeding administrative costs. Paragraph 9, as amended, allows exemptions on a case-by-case basis in exceptional circumstances to be laid down in national law, where access would expose the beneficial owner to disproportionate risk, risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where he is a minor or otherwise legally incapable. Recital 30 of Directive 2018/843 gave the reasons for public access: scrutiny by civil society and the press, trust in the integrity of business transactions, deterrence through reputational effects, and faster availability of the information to financial institutions and authorities.

The Dutch implementation

The Netherlands implemented the registration and access rules by amending the Trade Register Act 2007 (Handelsregisterwet 2007), the Trade Register Decree 2008 and the Wwft, by an act of 24 June 2020. The UBO provisions of the Trade Register Act entered into force on 27 September 2020; entities already registered at that date had 18 months, until 27 March 2022, to make their first filing (Article 57(3) of the Trade Register Act 2007).

The core provisions, in our translation of the current text, are these: - Article 15a(1) requires the trade register to record who the UBOs are of companies and other legal entities as referred to in Article 10a(2) of the Wwft. The UBO concept itself is taken from Article 10a(1) of the Wwft through Article 1(1)(p) of the Trade Register Act. - Article 15a(2) lists what is recorded: (a) the citizen service number; (b) a foreign tax identification number; (c) “the name, the month and year of birth, the state of residence and the nationality”; (d) the day, place and country of birth and the residential address; and (e) the nature and extent of the economic interest, in classes laid down by order in council. Article 15a(3) adds copies of the verification documents and of documents showing the interest. - The classes are set by Article 35b(1) of the Trade Register Decree 2008: more than 25% up to 50%, more than 50% up to 75%, and more than 75% up to 100%. Article 35b(2) lists the supporting documents, from the shareholders’ register to an organisation chart. - Article 10b(1) of the Wwft obliges the entity to obtain and hold the same data and documents, “adequate, accurate and current”, and Article 10b(2) obliges the UBO to supply them.

When the Dutch courts ruled in 2021, Article 21(1) of the Trade Register Act, in the wording quoted by the Court of Appeal (para. 1), allowed anyone to inspect the Article 15a(2) data except points (a), (b) and (d): in other words name, month and year of birth, residence, nationality and the class of interest. Article 21(5), as it then read, provided that UBO data were arranged by natural person only on a request from the Financial Intelligence Unit or a competent authority, so that the public could search by entity but not by person. Article 28(2) reserved the full data set, including the address and the documents, to the Financial Intelligence Unit and designated competent authorities. Article 50(1) made inspection subject to a fee, set at €2.50 for UBO data. Article 23 allowed privacy restrictions by order in council, and on that basis Article 51b of the Decree allowed a UBO to have his public data shielded in limited cases. The Act also contained Article 22(5) and (6), which were not yet in force: the requester would have to identify himself, and the UBO could ask how many times his data had been provided.

Our current text of Article 21(1) no longer contains the Article 15a(2) data at all, and the rule on arrangement by natural person now appears in Article 28(5). Where this review refers to Article 21 as applied by the courts, it means the wording before the 2025 amendment described under Status below.

District Court of The Hague, 18 March 2021

Facts and claims

Stichting Privacy First, an Amsterdam foundation whose object is the protection of privacy, sued the State (the Ministries of Finance, Justice and Security, and Economic Affairs and Climate Policy) in interim relief proceedings by a summons of 5 January 2021; the hearing took place on 25 February 2021. It attacked two elements of the regime: the duty to register UBO data under Article 15a and the right of anyone to inspect part of them under Article 21 read with Article 15a(2). For each element it sought, principally, an order disapplying or suspending the provisions; in the alternative, provisional disapplication combined with a reference to the Court of Justice on the compatibility of the two directives with the Charter, the principles of subsidiarity and proportionality in Article 5 TEU and the GDPR; and, further in the alternative, a reference alone (District Court, 18 March 2021, para. 3.1).

Its case (para. 3.2) was that the directives infringed Article 8 ECHR, Articles 7, 8, 16 and 52 of the Charter, Article 5 TEU and the GDPR. It relied on the opinion of the European Data Protection Supervisor (EDPS), which had found the proposal deficient on five fundamental points and called public access a “blanket measure”, and on critical advice from the Dutch data protection authority. The foundation argued that the fight against money laundering was a legitimate aim, but that no pressing social need had been shown; that shielding was available only in exceptional cases and shielded data stayed in the register; that leaks, hacks and human error could expose them; and that investigators already had all the access they needed. On urgency (para. 3.2.4) it pointed to the filling of the register, to the planned interconnection of the national registers on 10 March 2021, to a leak in the Belgian register and the reported breach of the Luxembourg register by Le Monde, and to commercial services that allowed searches by the name of a UBO.

Reasoning

The judge first rejected the State’s argument that the foundation had waited too long (para. 4.2). The contested provisions had entered into force only on 27 September 2020, the foundation had invited the State to talks on 2 December 2020 with a proposed summons attached, and it had then sued within a reasonable time.

On the principal and first alternative claims the answer was jurisdictional (para. 4.3). Granting them would put the State in breach of its obligation under Article 30 of the fifth Directive to maintain a national public UBO register:

With the State, the interim relief judge is of the opinion that, as long as AMLD5 remains fully in force, the State cannot be placed in a position in which it acts in evident breach of that directive.

The validity of a directive is for the Court of Justice, which had not yet ruled, and the contested Dutch provisions were “a direct translation” of mandatory provisions of the directives. Testing them for “manifest non-binding force” would indirectly require a ruling on the directives themselves; in the judge’s phrase, Privacy First was getting ahead of the music. The judge distinguished the 2015 interim judgment that had disapplied the Dutch data retention act: there the Court of Justice had already declared the underlying Data Retention Directive 2006/24/EC invalid. The 2020 SyRI judgment did not help either, because that legislation did not implement a directive.

The request for a reference was treated differently. The judge did not accept the State’s argument that a reference required manifest invalidity first (para. 4.4): a reference is one of the tools for deciding that question, and doubt about the validity of the directives is enough. On public access the judge found that doubt (para. 4.5), giving “great weight” to the EDPS opinion of 18 March 2017 (OJ 2017 C 85/04), which had criticised the significant and unnecessary risks to privacy and argued that access should go only to entities responsible for enforcing the law:

It cannot be ruled out in advance that the CJEU, partly on the basis of this opinion of the EDPS, will conclude that the (partly) public character of the UBO register does not, in the light of the objective of the UBO register, comply with the principle of proportionality that the European legislature must respect.

Even so, the judge declined to refer (para. 4.6). The tribunal d’arrondissement of Luxembourg had already put essentially the same questions to the Court of Justice; a second reference would not change how they were answered, so the foundation lacked a sufficient interest. Staying the interim proceedings until the answer came was incompatible with their nature, given the length of preliminary reference proceedings.

On the registration duty there was no doubt at all (para. 4.7). The foundation had not substantiated that the register and the duty to file infringed fundamental rights or the principles of proportionality and subsidiarity; there was no reason to doubt the register’s effectiveness against money laundering, even assuming the data could not be public; and the claim that the shielded additional data would leak through breaches or the planned interconnection was insufficiently substantiated.

Outcome

All claims were dismissed. The foundation was ordered to pay the State’s costs of €1,683 (€1,016 lawyer’s fees and €667 court fee) within 14 days, with statutory interest on late payment, and the costs order was declared provisionally enforceable (paras 4.8 and 5.1–5.4).

The Hague Court of Appeal, 16 November 2021

The appeal

Privacy First appealed by an expedited summons of 14 April 2021, raising four grounds and amending its claims: it now asked for the provisional suspension to last at least until the Court of Justice had answered the Luxembourg questions in Case C‑601/20 (Court of Appeal, 16 November 2021, para. 3.1). The State lodged a conditional cross-appeal. The court described the legal framework in detail (para. 1), including the explanatory memorandum to the implementing act: a UBO can ask the KVK to shield his data, the KVK’s decision is an administrative decision open to objection and appeal, and the data should not be public while that procedure runs.

No disapplication without the Court of Justice

The court disposed of the principal claims in a few lines (para. 3.2). The directives were still valid; the Luxembourg answer was expected around mid-2022.

The Dutch court cannot, without the CJEU having established the invalidity of those EU directives on the contested points, disapply the national legislation implementing them, as Privacy First seeks with its principal claims. Those claims therefore cannot be granted.

The Zuckerfabrik and Atlanta test

The first ground was read as a complaint that the first judge had overlooked the national court’s power, recognised in the Zuckerfabrik judgment of 21 February 1991 (Cases C‑143/88 and C‑92/89), to suspend the implementation of EU measures pending a ruling on their validity (para. 3.3). The court summarised the case law as cited (para. 3.4): Zuckerfabrik allows a national court to suspend a national administrative measure based on a regulation, provided among other things that it has serious doubts about the regulation’s validity and, where the question is not yet before the Court of Justice, refers it; Atlanta (9 November 1995, Case C‑465/93) extends this to suspending the regulation itself and specifies the conditions. The Court of Appeal accepted that, on the same conditions, national legislation implementing a directive may also be suspended.

One of those conditions decided the case (para. 3.5): urgency, meaning that the applicant faces serious and irreparable damage. Under paragraph 41 of Atlanta, urgency exists only if the damage can occur before the Court of Justice has ruled on validity. The State contested exactly that (para. 3.6).

Why the damage was not serious

The court first noted (para. 3.7) that on appeal Privacy First, though it was for the foundation to do so, had not even alleged that the UBOs it represented in this collective action, between 1 and 2 million people in the Netherlands, faced serious damage. It spoke only of “irreversible” and “irreparable” damage. In the first instance it had raised three kinds of harm (para. 3.8): (i) burglary and kidnapping, the so-called Quote 500 effect; (ii) bullying of children of family businesses who are or will become UBOs; and (iii) the loss of a normal, undisturbed life, for example because others ask the UBO for money.

The court then fixed the time frame (para. 3.9). Only damage to UBOs under the Dutch legislation counted, and only damage arising between the moment the Dutch rules applied to them and the expected Court of Justice ruling in mid-2022. For entities formed after 27 September 2020 that period starts at formation; for existing entities it starts with the filing deadline of 27 March 2022. The judgment gives the window for new entities as 27 September 2020 to 27 March 2022, and for existing entities as running “only” from 22 March 2022 to mid-2022, which appears to be a slip for 27 March 2022.

Against that window the court weighed the safeguards (para. 3.10). The State was right that the Dutch legislature had implemented all the optional privacy safeguards in the directives. The additional data (citizen service number, foreign tax number, day, place and country of birth, and address) were reserved to the Financial Intelligence Unit and designated authorities under Article 28(2) of the Act. The public saw only the basic data under Article 21. The address in particular was not public. That was a threshold, though not usually for those planning fraud, kidnapping, blackmail or violence, who could often find an address elsewhere. For that situation, however, Article 51b(2) of the Decree allowed even the basic data to be shielded where the UBO was a person whose safety the police protected under the Police Act, and under Article 51b(3) a request led to immediate shielding until it was finally decided:

A UBO who fears becoming the victim of criminal or disruptive conduct as referred to above can therefore, in a simple way, prevent his data from becoming or remaining public, at least for the time it takes to deal with objection and appeal.

The chance of category (i) damage, and of systematic or serious bullying under category (ii), in the relevant period was therefore small. The risk of a leak, hack or human error specifically in the Dutch register within that period was so small that it could be disregarded, and the same was true of the risk the foundation saw in the interconnection with the EU register, which, as the foundation itself had said, was postponed indefinitely.

Categories (ii) and (iii), apart from serious bullying, concerned annoying behaviour rather than serious damage (para. 3.11). Against that, the cost-covering fee, the rule that the public could not search by the name of a UBO, and the confidentiality of the address were a real barrier; once Article 22(5) and (6) entered into force, users would also have to register before seeing the online data. Nor was serious damage shown by the claim that people would delay forming new entities until 27 March 2022 to escape registration for as long as possible (para. 3.12).

Taking into account what is considered in paras 3.7 to 3.12, it cannot be regarded as sufficiently plausible that serious damage as a result of the disclosure of the UBO data threatens the UBOs whose interests Privacy First represents. It is even less plausible that serious damage threatens as a result of the mere registration of those data.

The foundation’s own interest, concerning the data of its own UBOs, fared no better (para. 3.14). The State’s defence succeeded and the first ground failed (para. 3.15).

No reference either

The requests for a reference, followed by the principal relief once the answer came, were evidently meant as a sequel to the suspension: they arose only if suspension was granted (para. 3.16). Granted on their own, they would give relief only after mid-2022, and the foundation therefore lacked the urgent interest required by Article 254 of the Code of Civil Procedure. The court, not being the court of last instance and sitting only in interim proceedings, was not obliged to refer (para. 3.17). A party has no right of its own to a reference, and the court saw no reason to make one, given that the foundation had no urgent interest in a reference without suspension and that questions on public access were already pending in Luxembourg. The second and third grounds failed, the fourth was a catch-all ground that needed no separate treatment, and the conditional cross-appeal did not arise (para. 3.18).

Outcome

The court affirmed the judgment of 18 March 2021 and ordered Privacy First to pay the State’s costs of the appeal, set at €4,114 (€772 court fee and €3,342 lawyer’s fees), within 14 days of the judgment, failing which statutory interest under Article 6:119 of the Civil Code runs; the costs order was declared provisionally enforceable (para. 3.19 and the operative part). The metadata of the judgment on rechtspraak.nl record it as affirming the first-instance judgment and list no later instance.

Court of Justice, 22 November 2022: WM and Sovim

The two Luxembourg cases

The Luxembourg Law of 13 January 2019 established a Register of Beneficial Ownership (RBO) held by Luxembourg Business Registers (LBR). Article 3 of that law listed what was recorded, including the full address and identification number; Article 12 opened the identity data, place of birth, country of residence and the nature and extent of the interest to “any person”; Article 15 allowed a request to restrict access in exceptional circumstances, with provisional restriction while the request and any appeal were pending (WM and Sovim, paras 15 to 19).

In Case C‑37/20, the real estate company YO asked LBR to restrict access to the information on WM, its beneficial owner, on the ground that public access would seriously, actually and immediately expose him and his family to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation (para. 20). LBR refused on 20 November 2019. WM sued on 5 December 2019, explaining that his work as executive officer and beneficial owner of YO and several other companies took him frequently to politically unstable, high-crime countries, with a significant risk of kidnapping or violence (para. 21). The Luxembourg court referred three questions on the meaning of “exceptional circumstances”, “risk” and “disproportionate” risk in Article 30(9) (para. 24).

In Case C‑601/20, Sovim SA’s request for restriction was refused on 6 February 2020 and it sued on 24 February 2020 (paras 25 and 26). It asked principally that Article 12 and/or Article 15 of the Luxembourg law be declared inapplicable, arguing that public access infringed Articles 7 and 8 of the Charter and several principles of the GDPR, and that it had not been shown how unrestricted public access served the aims of the directive (paras 27 to 30). The Luxembourg court referred, by a decision of 13 October 2020 received at the Court of Justice on 13 November 2020, three questions: (1) the validity of Article 1(15)(c) of Directive 2018/843 in the light of Articles 7 and 8 of the Charter; (2) the meaning and validity of the exemption in Article 30(9); and (3) six questions on Articles 5(1)(a), (b), (c) and (f), 25(2) and 44 to 50 of the GDPR (para. 33). The two Dutch courts referred to this reference as the Luxembourg questions of 13 November 2020, which is the date of receipt.

The Advocate General’s opinion

Advocate General Pitruzzella, in his opinion of 20 January 2022, would have upheld public access in principle. He regarded the interference as not particularly serious, since the data were limited and not especially sensitive and the potential harm moderate (point 104). He considered the removal of the legitimate-interest condition strictly necessary, relying on the Commission’s impact assessment that the criterion had caused excessive restrictions and slow cross-border access (points 172 to 177). But he would have declared invalid the words “at least” in the second subparagraph of Article 30(5) and the whole third subparagraph, because they left the scope of disclosed data to the Member States (points 114 to 118 and 230). He would also have read Article 30(5a) as obliging Member States to know the identity of those who consult the register (points 207 and 208), and Article 30(9) as obliging them to grant exemptions where access would expose the beneficial owner to a disproportionate risk to any of his Charter rights (points 191 and 192). The Court went further than its Advocate General.

Interference, and its seriousness

The Court dealt first with the first question in Case C‑601/20 (para. 34). Making data on identified beneficial owners available to the general public affects private life under Article 7 of the Charter, even if the data concern professional activity, and is processing of personal data under Article 8 (para. 38). Making personal data available to third parties is an interference whatever the later use, and whether or not the data are sensitive or anyone is inconvenienced (para. 39). Public access is therefore an interference with both rights (para. 40).

On seriousness the Court differed sharply from the Advocate General. The data on identity and on the nature and extent of the interest can enable a profile to be drawn up of a person’s wealth and of the sectors, countries and undertakings in which he has invested (para. 41). Public access makes them available to a potentially unlimited number of persons, including those who, for reasons unrelated to the aim of the measure, want to find out about a beneficial owner’s material and financial situation, all the more so where, as in Luxembourg, the register is online (para. 42). Once public, data can be retained and disseminated, and defending oneself against abuse becomes “increasingly difficult, or even illusory” (para. 43).

Accordingly, the general public’s access to information on beneficial ownership, provided for in point (c) of the first subparagraph of Article 30(5) of Directive 2015/849 as amended, constitutes a serious interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter

Legality, essence and objective

The limitation was provided for by law: an EU legislative act defines the data, requires them to be adequate, accurate and current, lists some of them and sets the conditions for exemption (paras 47 to 49). The essence of the rights was respected, because only information adequately related to the directive’s purposes may be held and disclosed, and the GDPR applies to all processing under the directive through Article 41(1) (paras 50 to 54).

The objective was legitimate. Read with recitals 4, 30 and 31, public access seeks to prevent money laundering and terrorist financing by creating, through transparency, an environment less likely to be used for those purposes (paras 55 to 58), an objective capable of justifying even serious interferences (para. 59). The Council’s separate reliance on the principle of transparency in Articles 1 and 10 TEU and Article 15 TFEU failed: that principle concerns public institutions and public funds, and has no such link where private beneficial owners are concerned, so it cannot as such justify the interference (paras 60 to 62).

Appropriate, but not strictly necessary

The Court set out the three-step test (paras 63 to 66): appropriateness, strict necessity in the sense that the objective could not reasonably be achieved as effectively by less prejudicial means, and proportionality in the narrow sense, which requires clear and precise rules and minimum safeguards, all the more so where data are available to an unlimited number of persons.

Public access was appropriate, because transparency contributes to an environment less likely to be used for money laundering (para. 67). It was not strictly necessary. The Council and the Commission relied on the impact assessment, which had found that the lack of a uniform definition of “legitimate interest” caused practical difficulties (para. 68). Asked at the hearing whether it had considered a uniform definition, the Commission said it had, but had decided against it because the criterion would remain difficult to apply and could lead to arbitrary decisions (paras 70 and 71). The Court’s answer was short:

the fact that it may be difficult to provide a detailed definition of the circumstances and conditions under which the public may access information on beneficial ownership is no reason for the EU legislature to provide for the general public to access that information

Recital 30 did not establish necessity either (paras 73 to 75). The press and civil society organisations connected with the prevention of money laundering and terrorist financing have a legitimate interest in access; so do persons who may enter into transactions with the entity, and financial institutions and authorities, in so far as they lack access already under points (a) and (b). That access “can contribute” or “would also help” was not enough. The interference was therefore not limited to what is strictly necessary (para. 76).

Not proportionate

The Commission’s reliance on recital 34 (a limited, clearly and exhaustively defined data set) failed because the words “at least” in the second subparagraph of Article 30(5), and the option of additional information in the third subparagraph, allow data to be made public that are not sufficiently defined and identifiable; the rules therefore lacked the required clarity and precision (paras 78, 81 and 82). In the balancing, combating money laundering is “as a priority a matter for the public authorities” and for credit and financial institutions subject to specific obligations, which is why they have access in all cases under points (a) and (b) (paras 83 and 84). Then the decisive comparison:

in comparison with a regime such as that laid down in the version of Article 30(5) of Directive 2015/849 prior to the entry into force of Directive 2018/843 … the regime introduced by Directive 2018/843, providing for the general public’s access to information on beneficial ownership, amounts to a considerably more serious interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter, without that increased interference being capable of being offset by any benefits which might result from the latter regime as compared against the former regime

The optional safeguards in Article 30(5a) (online registration) and Article 30(9) (exemptions) could not, in themselves, demonstrate a proper balance or sufficient safeguards against abuse (para. 86). Nor did the Manni judgment on company disclosure under the First Company Law Directive help the Commission, because that disclosure differs in purpose and in the personal data covered (para. 87).

Answer and costs

Article 1(15)(c) of Directive 2018/843 is invalid in so far as it amended point (c) of the first subparagraph of Article 30(5) of Directive 2015/849 so as to require that beneficial ownership information on companies and other legal entities be accessible in all cases to any member of the general public (para. 88 and the operative part). The second question in Case C‑601/20 and all questions in Case C‑37/20 presupposed that public access was valid, and the GDPR questions did not need an answer either (paras 89 to 91). The meaning of “exceptional circumstances” and “disproportionate risk” in Article 30(9), which WM’s case turned on, was therefore left unanswered. Costs were for the national court (para. 92).

How the judgments fit together

The three judgments do not contradict each other; they answer different questions. The Dutch courts never decided whether public access was compatible with the Charter. The District Court went further than the Court of Appeal by accepting that there was reasonable doubt, relying on the EDPS opinion (para. 4.6), and that doubt proved justified. Both Dutch courts held that a national court may not disapply legislation that faithfully implements a directive whose validity the Court of Justice has not denied. The Court of Appeal accepted in principle that Zuckerfabrik and Atlanta allow a temporary suspension of such legislation, but applied the urgency condition strictly: the damage must be serious, and must occur before the Court of Justice can rule. With the Dutch safeguards (no public address, no search by person, a fee, immediate shielding on request for persons under police protection), the window was too short and the risk too small.

The Court of Justice’s reasoning sits uneasily with part of that assessment. The Court of Appeal treated categories (ii) and (iii), approaches for money and similar intrusions, as nuisance rather than serious harm (para. 3.11). The Court of Justice treated the possibility that persons with no anti-money-laundering purpose could learn about a beneficial owner’s wealth as the core of a “serious interference” (paras 41 and 42), and held that the existence of optional safeguards such as registration and exemptions did not cure it (para. 86). The two standards are not the same: “serious and irreparable damage” within a few months in interim relief is a test of the applicant’s individual harm, while “serious interference” under the Charter is a test of the measure itself. But the comparison shows how much the outcome depended on the procedural route. A claimant in the Netherlands who wanted public access stopped needed either a Court of Justice ruling or a showing of concrete serious harm; Privacy First had neither in 2021.

The Court of Justice also departed from its Advocate General on the very point the Dutch courts saw as the safeguard. The Advocate General thought the exemption system of Article 30(9) was integral to the balance and could save public access if read as an obligation (points 223 and 228). The Court held that optional exemptions could not show that balance (para. 86). And while both the Advocate General and the Court objected to “at least” and to the open-ended additional information, the Netherlands had not used that latitude: the public data in the Dutch register were limited to the minimum list.

Several questions remain open on these sources. The Court did not interpret Article 30(9), so the threshold for “disproportionate risk” and the evidence a beneficial owner must produce were not decided; the Advocate General’s view (burden on the beneficial owner, specific, real and current evidence, points 269 to 271) is the only guidance in the materials. The judgment does not say which categories of persons have a legitimate interest; paragraph 74 names the press and civil society organisations connected with combating money laundering, potential counterparties, and financial institutions and authorities, but gives no general definition. And the registration duty itself was not before the Court: the Advocate General noted that the first question in Case C‑601/20 did not challenge the communication or storage of the data, only the removal of the legitimate-interest condition (point 77), and both Dutch courts rejected the complaint against registration (District Court, para. 4.7, as unsubstantiated; Court of Appeal, para. 3.13, because serious damage from mere registration was even less plausible).

What it means in practice

Registration continues. The judgment of the Court of Justice concerns access, not registration. Dutch entities must still file their UBO data and documents under Article 15a(2) and (3) of the Trade Register Act 2007, keep the same information themselves under Article 10b(1) of the Wwft, and update it as circumstances change. Failure to file can lead to an order subject to a penalty or an administrative fine imposed by the Minister of Finance (Article 47a, Article 47b(1)), and the Minister may demand information (Article 47c(1)). The classes in Article 35b of the Decree mean the register shows a band, not an exact percentage.

Who sees the data now. Under our current text of Article 22a(1), the name, month and year of birth, state of residence, nationality and class of interest may be inspected by Wwft institutions for customer due diligence and by institutions under the Sanctions Act 1977 for their obligations on financial transactions. Others may inspect them only under Article 22a(2): categories of persons designated by order in council, with a demonstrable legitimate interest that “relates to the prevention or combating of money laundering, associated predicate offences or terrorist financing”. That wording echoes paragraph 74 of the Court of Justice’s judgment. Our translation of the Trade Register Decree 2008 does not contain a designation of those categories. Authorities see the full data set and documents under Article 28(2), with the designations in Article 51a and Article 51aa of the Decree; notaries and bailiffs are among the bodies listed in Article 51aa. The entity and the person who must file can always see the entity’s own data (Article 22a(6), Article 22(8)).

What a UBO is told. If a legitimate-interest request is granted, the KVK must inform the UBO and tell him what purpose the request serves (Article 22a(3)). This mirrors recital 38 of Directive 2018/843 and the Advocate General’s view that the register should know who consults it (point 207). In our current text, Article 22(6) also lets a UBO ask how many times his data have been provided, except to the Financial Intelligence Unit and authorities; paragraphs (5) and (7) of Article 22 are still marked as not yet in force.

Shielding still matters. Article 51b of the Decree still allows the basic data to be shielded, but only on the grounds in Article 51b(2) (police protection or minority and legal incapacity) and never against the Financial Intelligence Unit, the designated authorities, banks, financial undertakings and notaries. Shielding protects against other Wwft institutions and legitimate-interest requesters. As before, the data are shielded immediately on request (Article 51b(3)); a grant on the police-protection ground lasts five years and is extended by five years at a time if the condition is still met (Article 51b(4)). Since the KVK must decide by an administrative decision open to objection and appeal (Court of Appeal, para. 1), a refusal can be challenged.

Banks and other institutions. Institutions using the register for customer due diligence must still identify the UBO and verify his identity themselves under Article 3(2)(b) of the Wwft and may not rely exclusively on the register (Article 3(15)). They must report discrepancies to the KVK (Article 10c(1) of the Wwft); authorities have a parallel duty under Article 38a(1) of the Trade Register Act. A mismatch between what a client tells the bank and what the register shows is therefore a common cause of questions, delays and, in the end, refusals; see our review of banks refusing or ending relationships under the Wwft.

No reliance on the UBO entry against third parties. The rules on the effect of registration against third parties do not apply to UBO data and documents (Article 25(4)(d)). The UBO entry is a compliance record, not a source of rights against counterparties.

Documents to keep. For each UBO: the identity document used for verification; the documents showing the nature and extent of the interest listed in Article 35b(2), such as the shareholders’ register, articles of association, deed of incorporation or organisation chart; and any KVK decision on shielding with the reasons given. UBO data and copies remain available for inspection for up to ten years after the entity is removed from the register (Article 51c of the Decree).

Litigation lessons. A challenge to Dutch legislation that implements an EU measure must, in practice, be routed to the Court of Justice. In interim relief, a claimant asking for suspension under Zuckerfabrik and Atlanta must plead and prove serious, not merely irreversible, damage to the persons it represents, within the window before the Court of Justice rules, and must deal with the safeguards national law already provides (Court of Appeal, paras 3.7 to 3.13). Speculative risks of leaks or hacks were not enough in either Dutch instance.

Status

The Dutch proceedings ended with the Court of Appeal’s judgment; its metadata on rechtspraak.nl list the first-instance judgment and no later instance. The Court of Justice’s judgment of 22 November 2022 answered the Sovim reference and left the dispute to the Luxembourg court; the sources we used do not show how the two Luxembourg cases ended.

The Dutch reaction is visible in our translations. According to our notes on the Trade Register Act 2007, the KVK suspended public access to UBO data after the judgment of 22 November 2022, and the amending act published as Stb. 2025, 189 restricted access by law with effect from 16 July 2025. The current text reflects that: Article 21(1) no longer opens the UBO data to anyone; Article 22a limits access to Wwft and Sanctions Act institutions and to persons with a legitimate interest connected with preventing or combating money laundering, associated predicate offences or terrorist financing, with notice to the UBO; and Article 28(2) lists the authorities with full access. Article 22a(5)(e) and Article 28(2)(e) already refer to Directive (EU) 2024/1640, the directive that, in its title, amends and repeals Directive 2015/849. The list of public bodies with access in Article 51aa of the Decree was last amended in the version of 24 October 2026 that we translate. Readers relying on Article 21 as the Dutch courts applied it in 2021 should note that it no longer reflects the law.

Provisions discussed

• Trade Register Act 2007: Art. 15a, Art. 21, Art. 22, Art. 23, Art. 28, Art. 50
• Trade Register Decree 2008: Art. 51b

Related reviews

How to cite

Case law review by BCA EU, for information. Quotations from the judgments are our translations; only the original texts published by the courts are authoritative. Judgments checked on the official sources on 30 October 2026. This page is not legal or tax advice.