On March 18, 2021, the interim relief judge of the District Court of The Hague ruled in the summary proceedings of Privacy First against the Dutch state regarding the UBO register. The District Court of The Hague rejected Privacy First's claims to decommission the UBO-register and ask preliminary questions to the Court of Justice of the European Union (CJEU) but questioned the legality of the public nature of the UBO-register.
On Jan. 5, 2021, Privacy First, a foundation dedicated to the preservation and promotion of privacy, filed summary proceedings against the Dutch state in connection with the so-called "UBO register. Since September 2020, Dutch companies and other legal entities must register information about their ultimate beneficial owners (UBOs - Ultimate Beneficial Owners) in the Dutch UBO register managed by the Chamber of Commerce. Every entity always has at least one UBO. This is the person who ultimately owns or controls a company, foundation or association.
Setting up the UBO register is one of the obligations for European member states included in the (amended) Fourth European Anti-Money Laundering Directive. That directive aims to prevent the use of the European Union's financial system for money laundering and terrorist financing.
The register will include the UBO's name, birth month and year, state of residence, nationality and the nature and extent of the interest held in the entity in question. This information, subject to registration and payment of a fee of EUR 2.50, is also publicly accessible. Another part of the data to be provided for registration in the register (including BSN and address) are not publicly accessible. In a limited number of cases the publicly accessible data can be shielded upon (request). In the Netherlands, the data of a minor or incapacitated person are protected by default. In other cases, UBO information can only be shielded if the UBO in question is protected by the Openbaar Ministerie or the National Coordinator for Counterterrorism and Security. In the event of shielding, the UBO register will continue to state the nature and extent of the economic interest of the (shielded) UBO.
With the data from the UBO register, it is possible to link natural persons to financial data. This involves privacy-sensitive information, and the fact that this data can be accessed by anyone may pose significant risks to UBOs. UBOs fear that the UBO register will lead to security risks in the form of threats, extortion, blackmail or kidnappings, for example.
Privacy First believes that the registry violates UBOs' fundamental right to privacy and that a publicly accessible UBO registry is disproportionate to the goal to be achieved (preventing money laundering and terrorist financing).
Privacy First's claims focus on two elements: (i) the mandatory provision of (sensitive) personal data for registration in the UBO register and (ii) the disclosure of (some of the information) in that register.
Privacy First has requested the District Court of The Hague to set aside the Dutch legislation that provides for the obligation to provide UBO data and regulates access for anyone to the UBO register. In addition, Privacy First asks the court, if necessary, to refer preliminary questions to the CJEU regarding the compatibility of the European directive, on which the Dutch legislation is based, with various European fundamental rights regarding respect for private life and protection of personal data.
Judgment on the claim to render the Dutch legislation inoperative
With regard to the claim that the Dutch legislation should be rendered inoperative, the court considered that a judgment on the lawfulness of a European directive is reserved for the CJEU and that the CJEU has not yet ruled on the lawfulness or otherwise of the anti-money laundering directive on which the Dutch legislation is based. If the court were to invalidate the Dutch legislation on which the UBO register is based, the Dutch state would be in violation of its obligation to establish a public UBO register. The court therefore sees no scope for invalidating the Dutch legislation requiring the establishment of the UBO register and its public accessibility. Privacy First has announced that it will further study the judgment on this point to decide whether to appeal.
Although the State argues that there is no ground for asking preliminary questions because it has not been shown that Dutch legislation is indisputably non-binding, the court considers that asking preliminary questions to the CJEU is precisely one of the instruments that can be used in assessing whether national legislation is indisputably non-binding. So the court could ask preliminary questions if it has doubts about the legal validity of anti-money laundering directive.
The court then confirms that it indeed has doubts about the public nature of the UBO register. In doing so, the court refers to the opinion of the European Data Protection Supervisor of March 18, 2017. In it, the EDPS is critical of the proportionality of the public nature of the register versus the significant and unnecessary privacy risks. According to the court, partly in view of this opinion, it cannot be ruled out in advance that the CJEU will ultimately conclude that the public nature of the UBO register is not in line with the principle of proportionality to be respected by the European legislator. The court therefore sees room here to ask preliminary questions of the CJEU. However, the court will not do so because in November 2020, Tribunal d'arrondissement in Luxembourg has already submitted preliminary questions to the CJEU on the public accessibility of the UBO register and its compatibility with the fundamental right to privacy. In January 2020, Tribunal d'arrondissement also already referred questions to the CJEU on the scope of the possibility to shield the public data.
Finally, the court also decided not to ask preliminary questions to the CJEU about the establishment of the UBO-register. According to the court, Privacy First has not sufficiently substantiated that the UBO-register and related registration obligation infringes on the fundamental rights of UBOs, or that the principles of proportionality and subsidiarity to be respected are not met in that respect.
Privacy First had still argued that there is a significant chance that the protected data in the UBO-register could end up on the streets due to, for example, data breaches. The court found this argument (despite a data leak earlier this year at the Belgian UBO register) insufficiently substantiated and thus implausible.
The court rejected Privacy First's claim, but also expressed doubts about the legality of the public nature of the UBO register. So the discussion about the UBO register is certainly not over partly in view of a possible appeal by Privacy First and the preliminary questions before the CJEU.
It is unknown when we can expect a conclusion from the CJEU's A-G or a ruling from the CJEU in the two aforementioned cases. In the meantime, existing companies must register UBOs in the UBO register by March 27, 2022, and companies and other legal entities incorporated on or after September 27, 2020 must register their UBO information within one week of incorporation.
More articles by Loyens & Loeff
