In its preliminary ruling in Case C-798/24, Jautiva, the European Court of Justice (the “ECJ”) upheld that EU law does not, in itself, require public disclosure of information on all shareholders of a public limited liability company under Directive (EU) 2017/1132 relating to certain aspects of company law (the “Directive”), while unrestricted access to such data constitutes a serious interference with the rights guaranteed by Articles 7 and 8 of the EU Charter of Fundamental Rights (the “Charter”).
Background: the facts of the main proceedings
Minority shareholders of a Latvian public limited liability company challenged the publication in the national companies register of their personal data - name, personal identification number, contact address and, where provided, email address, together with the class, number and nominal value of their shares and the attached voting rights. The claimants argued that the Latvian legislature had never examined or justified the need for such public disclosure. Relying on the WM and Sovim SA v Luxembourg Business Registers judgment of the ECJ, they added that the disclosure was, in any event, unjustified and disproportionate, since they hold no management or controlling role in the company and are not its beneficial owners. The Latvian Constitutional Court referred questions to the ECJ on Article 14(d) of the Directive and EU data protection law.
No duty under EU law to disclose all (including minority) shareholders
By its first question, the referring court asked, in essence, whether Article 14(d) of the Directive must be interpreted as requiring the disclosure of information relating to all shareholders of the companies concerned, including minority shareholders. Answering in the negative, the ECJ relied, first, on the wording and context of the Directive: Article 14(d) makes no reference to shareholders, but refers only to persons who are authorised to represent the company or who take part in its administration, supervision or control. A shareholder’s status derives solely from ownership of shares. Indeed, several provisions of the Directive, such as Articles 64(3) and 95(2), distinguish the administrative and management bodies - which may bind the company vis-à-vis third parties - from the general meeting of shareholders.
The Court then examined whether such disclosure serves the objectives of the disclosure requirements: the protection of third parties’ interest and legal certainty. Since minority shareholders can neither represent the company nor take part in its management or supervision, disclosing their data serves no useful purpose in light of those objectives. Article 14(d) of the Directive therefore does not require the disclosure of information concerning all shareholders, including minority shareholders.
Unconditional public access to shareholder data precluded by the GDPR and the Charter
The ECJ then assessed the regime under the GDPR, read in light of Articles 7 (respect for private life) and 8 (protection of personal data) of the Charter. Those rights are not absolute: under Article 52(1) of the Charter, limitations may be imposed, provided that they are laid down by law, respect the essence of the rights and observe the principle of proportionality. The legislation must also contain clear and precise rules and minimum safeguards, so that data subjects are effectively protected against the risk of misuse. In the case at hand, the information made public could enable a profile of a shareholder’s financial situation and investments to be built up - all the more so as the data was available online to a potentially unlimited number of persons, including unidentified users, and could subsequently be retained and disseminated. The ECJ therefore regarded the disclosure as a serious interference with the rights protected by Articles 7 and 8 of the Charter.
The Court then assessed proportionality against the objectives of general interest relied on in justification of the Latvian regime:
the objective of general interest consisting in ensuring a transparent business environment to protect third parties’ interest – which, the Court reiterated, is not served by the disclosure of data on all shareholders, in particular minority shareholders;
the objective of general interest consisting in preventing money laundering and terrorist and proliferation financing – although increased transparency may contribute to this objective, combating money laundering is primarily a matter for public authorities and obliged entities such as credit or financial institutions, which are subject to specific due diligence obligations; and
the objective of general interest consisting in facilitating the implementation of sanctions – for which disclosure could be limited to persons included on sanctions lists or to persons demonstrating a legitimate interest.
Given the seriousness of the interference, the absence of safeguards against misuse and the availability of less restrictive measures, the Latvian regime was found to be neither necessary nor proportionate in relation to the objectives of general interest, where access to such data is not subject to any conditions, such as demonstrating a legitimate interest.
A Luxembourg lens: shareholder privacy built into the framework
For a Luxembourg public limited liability company (société anonyme), shareholders can take comfort in a framework that structurally protects their privacy.
The identity of shareholders holding registered shares is recorded solely in an internal register kept at the company’s registered office – it is not subject to public disclosure through the Luxembourg Trade and Companies Register (Registre de Commerce et des Sociétés, the "RCS"). Furthermore, as a matter of law, under Article 6 of the Luxembourg law of 19 December 2002 on the RCS, the registration requirements for a société anonyme cover the company name, legal form, registered office, corporate object, share capital, directors, auditors and similar corporate data, but do not include any obligation to disclose the identity of shareholders. While anyone may freely obtain an extract from the RCS, the information contained therein is limited to the corporate particulars mentioned above – one will search in vain for any shareholder name, shareholding or voting right in such extract.
Luxembourg law thus already embodies the very principles upheld by the ECJ in Jautiva: a shareholder of a Luxembourg société anonyme is not exposed to any public disclosure of personal data merely by virtue of share ownership.
To a parliamentary question addressed to the Minister of Justice in September 2026 concerning the Jautiva ruling, the Minister confirmed that an in-depth analysis of its implications for Luxembourg law is under way. The question addressed to the Minister specifically targeted the framework applicable to SARLs, given that the identity, address and shareholding of their shareholders are disclosed through the RCS, noting that current legislation already allows a professional address to be registered in lieu of a private address. The Minister noted that the ruling does not cover SARLs and SARL-S, and that it remains uncertain whether, or to what extent, the Court's reasoning could be transposed to these corporate forms, which follow a different logic from that of the société anonyme. At this stage, the Government does not consider that the ruling directly calls into question the publicity regime applicable to SARL and SARL-S shareholders, while noting that Luxembourg has already acted upon the WM and Sovim SA v Luxembourg Business Registers judgment with regard to access to information held in the Register of Beneficial Owners, by making such access conditional upon the demonstration of a legitimate interest. The Ministry of Justice confirmed that it intends to keep the data made public limited to what is necessary and will continue to monitor closely the Court's case law on this topic.
Jautiva is a fictitious name assigned by ECJ.
Share on
