Transparency in corporate affairs and access to certain registry information play an essential role in ensuring legal certainty and confidence in commercial transactions. However, when such transparency results in the indiscriminate publication of shareholders’ personal data, it may come into conflict with the fundamental right to data protection.
This is the issue addressed by the Court of Justice of the European Union (CJEU) in its judgment of 3 September 2026 (Case C-798/24), in which it examines the compatibility between national legislation providing for broad public access to shareholders’ data and the European data protection framework.
The dispute originated in Latvia, where national legislation required certain personal data of shareholders of public limited liability companies, including minority shareholders, to be published in the Commercial Register, with free online access and without the need to demonstrate any particular purpose. The information made available included identification and contact details, as well as information concerning each person’s shareholding position, such as the category, number and value of the shares held and the voting rights attached to them.
Minority shareholders challenged the constitutionality of this requirement, arguing, among other things, that it affected their privacy, created a risk of misuse of the information, and lacked sufficient justification where shareholders did not perform management, supervisory or control functions within the company.
The matter reached the CJEU following a request for a preliminary ruling from the Constitutional Court of Latvia. One of the central issues concerned the interpretation of Article 14(d) of Directive 2017/1132. The CJEU concludes that this provision refers to persons who are involved in the management, supervision or control of the company and that shareholders, merely by virtue of being shareholders, do not automatically fall within this category.
Consequently, the Directive does not require Member States to publish the personal data of all shareholders, including minority shareholders. This clarification is particularly relevant because it prevents the widespread publication of shareholders’ data from being justified merely by reference to EU company law. Where shareholders do not participate in the management, supervision or control bodies of the company, such disclosure does not derive directly from the Directive.
The CJEU also addresses the issue from the perspective of the fundamental right to data protection. The publication of personal information in publicly accessible registers constitutes the processing of personal data and may amount to a significant interference with the rights recognised by the Charter of Fundamental Rights of the European Union.
In particular, the widespread disclosure of information that makes it possible to identify shareholders, contact them and ascertain certain aspects of their shareholding position may facilitate subsequent uses of that data, including profiling. These risks are particularly significant where access to the information is universal and is not subject to specific safeguards or conditions.
The national legislation pursued legitimate objectives relating, among other things, to corporate transparency, the prevention of money laundering and the enforcement of sanctions. However, the CJEU recalls that the existence of a general-interest objective is not, in itself, sufficient to justify unlimited disclosure of personal data. The measure must comply with the requirements of necessity and proportionality arising from Article 52(1) of the Charter of Fundamental Rights of the European Union and with the principles laid down in the General Data Protection Regulation (GDPR), including the principles of lawfulness and data minimisation.
From this perspective, the CJEU considers incompatible with the GDPR legislation that requires the data of all shareholders to be published without requiring those seeking access to the information to demonstrate a legitimate interest, even where the purpose pursued is in the public interest.
In this regard, the judgment points to the possibility of using less intrusive mechanisms for fundamental rights, such as systems under which access is conditional upon demonstrating a legitimate interest. Such mechanisms would make it possible to reconcile transparency in public registers with the protection of personal data, limiting access to information to what is strictly necessary to achieve the purpose pursued.
Joan Lluís Rubio
Vilá Abogados
For more information, please contact:
23rd of September 2026