Court case C-09-604682-KG ZA 20-1232 – Court Ruling (Netherlands, 2021)

= Article 30 Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for money laundering or terrorist financing (AMLD4) obliged Member States to include information about the ultimate beneficial owners (hereinafter: 'UBOs') of companies and other legal entities in a central (trade) register, a company register or a public register. Information about UBOs should in all cases be accessible to the competent authorities, the Financial Intelligence Unit (FIU) and the obliged entities in the context of their customer due diligence. In addition, all persons or organizations that could demonstrate a legitimate interest had access to the name, month and year of birth, nationality and state of residence of the UBO, as well as to the nature and scope of the economic interest held by the UBO. On July 9, 2018 Directive (EU) 2018/843 of the European Parliament and of the Council of May 30, 2018 amending AMLD4 entered into force (AMLD5). The amended article 30 paragraph 5 stipulates that information about UBOs must be publicly accessible. In all cases, competent authorities, the FIU, the obliged entities in the context of their customer due diligence and every member of the public must be able to consult the UBO information. This includes at least the name, month and year of birth, state of residence, nationality and the nature and size of the economic interest held by the UBO. AMLD5 also states that protection of publicly accessible UBO information can be requested, this on the understanding that this exception cannot be invoked against the competent authorities, the FIU, credit institutions, financial institutions and obliged entities that are public officials. It has been added that a request for foreclosure should be decided on a case-by-case basis, based on a detailed assessment of the exceptional nature of the circumstances. AMLD4 and AMLD5 have been implemented in the Netherlands by amending the Trade Register Act 2007, the Trade Register Decree 2008 and the Money Laundering and Terrorist Financing Prevention Act (Wwft). Privacy First requested: #with regard to the obligation to supply data about the UBO to the Trade Register: #*to render inoperative or at least to declare inapplicable or at least to suspend the obligation to supply data about the UBO to the Trade Register, as laid down in Article 15a of the Trade Register Act, or alternatively, #*to grant the primary claim provisionally by interim judgment, to submit preliminary questions to the Court of Justice of the European Union (CJEU) about the compatibility of the European directives on which this obligation rests with a) the Charter of Fundamental Rights of the European Union ( hereinafter: 'the Charter'), b) the principles of subsidiarity and proportionality as set out in the Treaty on European Union and c) the General Data Protection Regulation ( GDPR ) and, after answering these questions, award the primary claim in a final judgment; or, more in the alternative, #*submit preliminary questions to the CJEU on the compatibility of the European directives on which this obligation rests with a) the Charter, b) the principles of subsidiarity and proportionality as set out in the Treaty on European Union and c) the GDPR , and after answering who ask to assign the primary claim #with regard to the right of everyone to view data about the UBO in the Trade Register: #*the right of any person to inspect data about the UBO in the Trade Register, as laid down in Article 21 of the Trade Register Act in conjunction with Article 15a paragraph 2 of the Trade Register Act, ineffective or at least to declare it inapplicable or at least to suspend it; or, alternatively: #*to grant the primary claim provisionally by means of an interlocutory judgment and to submit preliminary questions to the CJEU on the compatibility of the European directives on which this obligation rests with a) the Charter, b) the principles of subsidiarity and proportionality as set out in the Treaty on European Union and c) the GDPR , and after answering those questions, assign the primary claim by final judgment; or, more in the alternative: #*submit preliminary questions to the CJEU on the compatibility of the European directives on which this obligation rests with a) the Charter, b) the principles of subsidiarity and proportionality as set out in the Treaty on European Union and c) the GDPR , and after answering who ask to assign the primary claim, Privacy First argued that with AMLD4 and AMLD5, the EU legislator is infringing the fundamental rights of UBOs, guaranteed under European law, to protect their privacy and personal data. According to Privacy First, the EDPS questions the fairly general objectives of AMLD5 and has reservations about the proportionality of the intended wide public access to UBO data. More specifically, Privacy First pointed out that the EDPS takes the view that only competent authorities should have access to this data. According to the EDPS, there is a 'blanket measure', which does not meet the requirements of proportionality. In the context of the development of the Dutch implementation legislation, according to Privacy First, the Dutch Data Protection Authority has also given very critical advice and this advice has also been ignored. According to Privacy First, the Dutch implementation legislation must be made inoperative insofar as it concerns the obligation to register privacy-sensitive data of UBOs in the UBO register and the (partly) public accessibility of this data. To this end, Privacy First argued that this legislation is unmistakably ineffective due to conflict with the provisions of treaties and decisions of international organizations that are binding on everyone. Although it is the competence of the CJEU to test the relevant European directives against any binding provisions of treaties and this assessment has not yet taken place here, according to Privacy First, based on case law of the CJEU and the fact that at EU level no data protection impact assessment has taken place, sufficiently plausible for the time being that the CJEU will rule that these guidelines cannot be maintained. According to Privacy First, these regulations are in conflict with a) Article 8 ECHR, b) Articles 7, 8, 16 and 52 of the Charter, c) Article 5 of the Treaty on European Union and d) various provisions of the GDPR, The conditions for a legitimate infringement of the fundamental rights of protection of privacy and personal data have not been met. Although combating money laundering and terrorist financing is a legitimate goal, according to Privacy First, it has not been sufficiently demonstrated that there is an imperative social necessity for the infringement of the fundamental rights of UBOs that is currently being made to achieve that goal. As a result, this infringement is not proportional in the opinion of Privacy First. Privacy First pointed out that it concerns the recording of and access to privacy-sensitive data of the UBOs of a large number of entities. As a result, there is a real fear among UBOs of burglaries and kidnappings. According to Privacy First, the possibility of shielding UBO data from public consultation does not offer sufficient guarantees. Blocking can only be invoked in exceptional situations and the data is nevertheless included in the UBO register despite the blocking. There is a significant risk that this protected data will still end up on the street as a result of data leaks, hacks and human errors. According to Privacy First, there is also a risk of identity fraud. According to Privacy First, money laundering and terrorist financing can also be effectively combated without a publicly accessible UBO register. Investigation services have access to all information they need (including UBO data) on the basis of anti-money laundering guidelines. In the opinion of Privacy First, the question is whether the objectives of the anti-money laundering guidelines are served by the establishment of a publicly accessible UBO register. The necessity of such a register has never been stated by the European legislator and in any case not substantiated or demonstrated. The court rejected Privacy First claim. The court agreed with the State that an allocation of both the primary and the alternative claim will result in the State no longer complying with its obligation under Article 30 of AMLD5 to establish a national public UBO register. As long as AMLD5 is in full force, the State cannot be put in a position where it manifestly contravenes that directive. The judgment on the legality of a European directive is reserved for the CJEU. It is not in dispute that the CJEU has not yet ruled on the legality of the public UBO register prescribed by AMLD4 and AMLD5. In that state of affairs, there is no room for the preliminary relief judge for interim relief proceedings to test the legality of the parts of the Dutch implementation legislation that have been questioned by Privacy First, which, after all, are a direct translation of mandatory provisions from AMLD4 and AMLD5. According to the court, putting questions to the CJEU for a preliminary ruling is precisely one of the instruments that can be used by the court to answer the question whether national legislation is unmistakably ineffective. After all, the fact that the CJEU declares a European directive underlying national legislation ineffective is a factor of great importance in answering that question. In this case, the preliminary relief judge may ask questions for a preliminary ruling if there are doubts about the legal validity of (parts of) the AMLD4 and AMLD5 underlying Dutch UBO legislation. It must therefore be assessed whether there is cause for such doubts with regard to the obligation arising from these guidelines to set up a (partly) public UBO register. The preliminary relief judge answers this question in the affirmative with regard to the (partly) public nature of the UBO register as prescribed by AMLD5. The court stated that it cannot be ruled out in advance that, partly on the basis of this advice from the EDPS, the CJEU will come to the conclusion that the (partly) public character of the UBO register is not compliant with the principle of proportionality to be respected by the European legislator. This means that, in principle, the Dutch courts can submit preliminary questions to the CJEU in this regard. However, the preliminary relief judge will not ask questions about this. The reason for this is that the Tribunal d'arrondissement in Luxembourg already asked questions on this point to the CJEU on 13 November 2020. These questions largely correspond with the questions that Privacy First formulated in its summons with regard to the (partly) public nature of the UBO register. Privacy First has not made it clear that, and if so, how it serves its interests if the preliminary relief judge essentially submits the same questions to the CJEU. After all, the CJEU will not answer these questions in any other way. This means that Privacy First lacks sufficient interest in its claim to refer questions for a preliminary ruling, insofar as these relate to the (partly) public nature of the UBO register. According to the court, Privacy First has insufficiently substantiated that the creation of a UBO register and the associated registration obligation violates the fundamental rights of UBOs guaranteed under European law or that the principles of proportionality and subsidiarity. Contrary to what Privacy First seems to argue, for the moment there is insufficient reason to doubt the effectiveness of the UBO register in preventing money laundering and terrorist financing through the financial system (even if it must be assumed that the information contained therein is not (partially) may be publicly accessible). Nor does the inadequately substantiated and thus implausible assertion by Privacy First give rise to doubt that there is a considerable chance that the currently protected additional data will be discarded due to data leaks and / or the imminent linking of European UBO registers.