On June 23, 2020, the "Implementation Act on Registration of Ultimate Beneficial Owners of Companies and Other Legal Entities" was adopted. Based on this new law, the Commercial Register of the Chamber of Commerce will contain information on all ultimate beneficial owners (UBOs) of companies and other legal entities incorporated in the Netherlands. The UBO's 25-50%, 50-75% or more than 75% interest must be indicated. In any event, the name, month and year of birth and nationality of the UBO will be publicly available for inspection by anyone, with all the associated privacy risks. The law gives very limited options for shielding information. This is only possible for persons secured by the police, for minors and for those under guardianship. The result will be that the interests of virtually all UBOs will become public knowledge. The law will take effect in the near future. After that, legal entities will have 18 months to register their UBOs. The impact of this new legislation will be profound. It is a law that aims to prevent money laundering but achieves blacklisting.
This change in the law stems from the European Fifth Anti-Money Laundering Directive, which requires member states to register personal data of UBOs and make it publicly available. The purpose of this is to combat money laundering and terrorist financing. Making UBOs' personal data publicly available, including the UBO's interest in the company, contributes to that goal, according to the European legislator. Disclosure would act as a deterrent to persons seeking to launder money or finance terrorism.
The question is whether the means misses the mark. Making the personal data of all UBOs available to anyone is a blanket measure of a preventive nature. 99.9% of UBOs have nothing to do with money laundering or terrorist financing. It is an invasion of privacy that is disproportionate in Privacy First's view. An important principle in privacy law is that data collected for one purpose should not be used for another. It should be sufficient if the information on UBOs is available to those government agencies engaged in anti-money laundering and counter-terrorism activities. It is going too far to make that information completely public. The European Data Protection Supervisor already ruled that this privacy violation is not proportionate. But that judgment did not lead to an adjustment of the European directive.
During the Dutch parliamentary debate on this law, fundamental criticism came from various quarters. The business community stirred because they feared increased burdens and saw privacy risks. Family businesses whose UBOs have so far remained out of the public eye have a lot of privacy to lose. There was also much attention for the position of parties that attach great importance to the protection of data subjects, such as denominations and social organizations. Unfortunately, this did not lead to regulatory changes.
Privacy First with its lawyer Otto Volgenant (Boekx Advocaten) will start a lawsuit against the UBO-register for violation of European privacy law. The Dutch law and also the above-mentioned European directive are in violation of the European Charter of Fundamental Rights and the AVG. It is up to the courts to do a thorough review of this. Privacy First has successfully challenged the validity of legislation before, for example in proceedings on the Telecommunications Data Retention Act. Privacy First conducts its strategic privacy litigation mostly with a coalition of stakeholders. Privacy First is currently identifying which parties can contribute to the case against the UBO register.
