Constitutional Court rules general public access to shareholders' personal data unconstitutional

Latvia's Constitutional Court has declared unconstitutional a provision that required the personal data of joint-stock company shareholders to be made public in the Commercial Register. The court found it incompatible with Article 96 of the Constitution, which guarantees the right to personal data protection. The judgment is final, cannot be appealed and takes effect on the day it is published.

Background of the dispute

In November 2024 the Constitutional Court opened a case, brought by shareholders of a joint-stock company, on Article 4.15, paragraph 2, sub-paragraph "b" of the law "On the Register of Enterprises of the Republic of Latvia". It requires that the public part of a registration file include data on the members of capital companies and inheritance trustees, as well as on shareholders of joint-stock companies. The applicants argued that this disproportionately restricted their right to personal data protection.

Because the case raised questions of EU law, the Constitutional Court turned to the Court of Justice of the European Union (CJEU). In the case "Jautiva", the CJEU concluded that the EU company law directive does not oblige states to publish data on all shareholders, including minority shareholders. The General Data Protection Regulation does not allow such data to be disclosed to anyone without access conditions. The CJEU noted that published data makes it possible to build a profile of a shareholder's wealth, and that Latvian rules lack sufficient safeguards against misuse, as the information is available online to unidentified users and for bulk download.

The Constitutional Court's conclusions

The court acknowledged that shareholder data is needed, for example, to prevent money laundering and to enforce sanctions. Persons and institutions with statutory duties in these areas already have access. Share buyers could obtain the data by submitting a reasoned request.

In the court's view, general availability without any need to justify the purpose creates a risk that the information will be used for illegitimate or malicious ends. Public safety and the rights of others could be protected by placing shareholder data in the non-public part of the registration file as restricted-access information. That would limit shareholders' rights less.

When the provisions lose force

The provisions on publishing the shareholder register section and the personal data of individuals in it lose force on the day the judgment is published. For the applicants, they have been declared invalid from 1 July 2023.