On 3 September 2026, the Court of Justice of the European Union (“CJEU” or the “Court”) delivered its judgment in Case C-798/24, Jautiva, concerning the public disclosure of personal data relating to shareholders of public limited liability companies.
The proceedings arose from constitutional complaints brought by 17 minority shareholders in Latvia challenging legislation under which shareholder information was made available online to the general public. In the case of natural persons, the information disclosed included identity and contact details, together with the class, number and nominal value of the shares held and the number of voting rights attaching to those shares. Access was not conditional upon the demonstration of a legitimate interest.
The Latvian legislature relied on several objectives in support of that regime, including the protection of third parties through greater business transparency, the prevention of money laundering and terrorist and proliferation financing, and the implementation of national, international and EU restrictive measures. The Constitutional Court of Latvia referred the matter to the CJEU for an interpretation of the relevant provisions of EU company law and data protection law.
The Court first considered Article 14(d) of Directive (EU) 2017/1132, which requires disclosure of particulars concerning persons authorised to represent a company and persons who take part in its administration, supervision or control.
The Court held that the latter category cannot be interpreted as encompassing every shareholder solely by virtue of the holding of shares. In particular, a minority shareholding does not, as such, mean that the shareholder is authorised to represent the company or participates in its administration, supervision or control. Article 14(d) therefore does not require the disclosure of information relating to all shareholders of public limited liability companies, including minority shareholders.
That finding did not prevent national legislation from providing for disclosure beyond that required by Directive 2017/1132. Any such additional disclosure, however, remained subject to the requirements governing the processing of personal data under EU law.
The Court therefore examined the Latvian regime under Articles 5 and 6 GDPR, read in light of the rights to respect for private life and protection of personal data guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.
The Court accepted that the objectives relied upon by the Latvian legislature were capable of constituting objectives of general interest recognised by the European Union. The issue was whether the disclosure regime complied with the requirements of necessity and proportionality applicable to an interference with the rights protected by Articles 7 and 8 of the Charter.
In assessing that interference, the Court took account of the breadth of the disclosure regime. The information was made available to the public generally, rather than to defined categories of persons, and access was not dependent upon the existence of a legitimate interest. The data could consequently be accessed by an indeterminate number of persons, while the individuals concerned had reduced ability to control their subsequent use.
The objectives relating to AML/CFT did not establish the necessity of making the personal data of all shareholders unconditionally available to the general public. In reaching that conclusion, the Court considered the EU framework governing access to beneficial ownership information. It also observed, in relation to restrictive measures, that the Latvian regime was not confined to shareholders subject to such measures but extended generally to all shareholders covered by the legislation. The Court concluded that legislation of that kind did not appear to be necessary or proportionate in relation to those objectives.
The absence of conditions governing access was also relevant to that assessment. The Court referred to the possibility of requiring persons seeking access to demonstrate a legitimate interest. Its ruling does not establish legitimate interest as an invariably applicable requirement for every form of access to shareholder information; rather, the absence of any such condition formed part of the assessment of the proportionality of a regime permitting general public access. The operative part of the judgment accordingly refers to access not being subject to “any conditions, such as demonstrating a legitimate interest.”
The Court ultimately held that Article 14(d) of Directive 2017/1132 does not require disclosure of information relating to all shareholders, including minority shareholders. It further held that Articles 5 and 6 GDPR, read in light of Articles 7 and 8 of the Charter, preclude national legislation requiring the specified personal data of all such shareholders to be made available to the public where access is not subject to any conditions, such as demonstrating a legitimate interest.
MK Compliance Limited is a specialist AML and sanctions compliance consultancy. Our team brings together qualified lawyers with backgrounds exclusively dedicated to AML, sanctions, and financial crime prevention. We advise a diverse range of clients across regulated and non-regulated sectors, spanning multiple industries in Cyprus and across the EU. Our services range from compliance programme design and legal opinions to due diligence, screening, and ongoing regulatory support.
Please visit our website to explore the full range of our services or contact us at info@compliancemk.com for more information.
