On 9 November, in case No. 2024-01-01, the Constitutional Court found that the provisions of the Law on the Enterprise Register of the Republic of Latvia, which allow anyone, without justification, to obtain shareholders' personal data, including personal identity number and address, do not comply with Article 96 of the Constitution.
The case was brought by application of 17 shareholders. They objected to the publication of their personal data. The judgment concerns shareholders who are natural persons. The Court considered both the disclosure of the information about those shareholders and the disclosure of the document containing this information, namely the extract from the register of shareholders.
During the proceedings, the Constitutional Court requested the Court of Justice of the European Union to give a preliminary ruling on the requirements of the EU law in relation to the publication of shareholders’ personal data. In the ‘Jautiva’ case, the Court of Justice of the European Union clarified that the General Data Protection Regulation does not allow for the disclosure of personal data of all shareholders, including minority shareholders, to anyone without any conditions for access.
The Constitutional Court concluded that shareholders' data is necessary, for example, for the prevention of money laundering and compliance with sanctions. Persons and institutions with statutory obligations in these fields already have access to the data. Share purchasers who need to establish whether the seller is registered in the shareholders' register could also obtain this information by submitting a reasoned request.
However, if the law does not impose obligations and liability on persons and they cannot justify a legitimate interest in obtaining information, it is not possible to ensure that publicly available information about shareholders of a joint-stock company is used only for the achievement of the legitimate aims set by the legislator.
The general availability of information without the need to justify the purpose of its release creates a risk that information may be used for illegitimate or even malicious purposes. The Court therefore concluded that the public security and the rights of other people can be achieved, for example, by including the data of the shareholders of a joint-stock company in the non-public part of the registration file and by providing access to them as restricted information. Such a measure would be less restrictive of the rights of the shareholders of a joint-stock company to the protection of their personal data.
As regards the publication of the shareholder register and the personal data of natural persons contained therein, the provisions shall cease to apply on the date of publication of the judgment. As regards the applicants, these provisions were declared invalid with effect from 1 July 2023.
The judgment of the Constitutional Court is final and not subject to appeal. It shall take effect on the date of its publication.
Related case: 2024-01-01