Corporate Transparency & Data Protection: the CJEU Limits Unrestricted Disclosure of Shareholder Data

Corporate transparency plays an essential role in ensuring legal certainty in business transactions, protecting third parties and preventing unlawful activities. However, not all information connected with a company should, for that reason alone, be made publicly available without restriction.

The Judgment of the Court of Justice of the European Union of 3 September 2026 in Case C-798/24, Jautiva, ECLI:EU:C:2026:679, addresses precisely where that boundary lies. The Court held, first, that Article 14 of Directive (EU) 2017/1132 does not require information concerning all shareholders of a public limited company, including minority shareholders, to be disclosed. Secondly, in the circumstances examined, it found EU law incompatible with a regime allowing unrestricted online access to shareholders’ personal data without any condition, such as the need to demonstrate a legitimate interest.

The judgment lies at the intersection of company law and data protection and is particularly relevant for corporate structures in which a clear distinction must be drawn between shareholder status, the exercise of management or control functions and beneficial ownership.

The dispute originated in Latvia.

Seventeen individuals who were minority shareholders in a public limited company brought proceedings before the Latvian Constitutional Court challenging whether national legislation was compatible with the rights to respect for private life and protection of personal data.

The contested legislation required certain information concerning shareholders in public limited companies to be made available to the public.

Where the shareholder was a natural person, the information could include their first and last name, personal identification number or, failing that, date of birth, certain identity document details and a contact address. The shareholder’s email address, the category, number and nominal value of the shares held, and the number of voting rights attached to those shares were also disclosed.

The information could be accessed online and downloaded in bulk, including by unidentified users.

According to the referring court, the system pursued three objectives: ensuring a transparent business environment and protecting third parties; preventing money laundering, terrorist financing and proliferation financing; and facilitating the enforcement of national, international and EU sanctions.

The Latvian Constitutional Court asked the CJEU whether such disclosure was required under Directive (EU) 2017/1132 and whether the access regime was compatible with Articles 5 and 6 of the GDPR, read in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.

No.

The first significant aspect of the judgment concerns the interpretation of Article 14(d) of Directive (EU) 2017/1132.

That provision requires disclosure of the identity of certain persons who, as a legally constituted body or as members of such a body, are authorised to bind the company in dealings with third parties and to represent it in legal proceedings, or who participate in the administration, supervision or control of the company.

The CJEU rejected the view that this category automatically includes all shareholders of a public limited company merely because they hold shares.

The Directive does not expressly include shareholders or the general meeting among the persons subject to that disclosure requirement. Moreover, a shareholder’s legal position derives from their participation in the company’s capital, whereas the persons referred to in Article 14 perform organisational functions relating to administration, representation, supervision or control.

The Court therefore concluded that Directive 2017/1132 does not require information relating to all shareholders, including minority shareholders, to be made public.

This distinction is important. The judgment does not establish that shareholders’ identities must necessarily remain confidential. Rather, it rejects the existence, under the EU provision examined, of a general obligation to disclose information concerning all shareholders solely by virtue of their status as shareholders.

The second main element of the judgment concerns the GDPR and Articles 7 and 8 of the Charter of Fundamental Rights.

The CJEU reiterated that the rights to private life and protection of personal data are not absolute. They may be subject to limitations where those limitations are provided for by law, respect the essence of the fundamental rights concerned and comply with the principle of proportionality.

In Jautiva, the disclosure of the data was provided for by law and did not undermine the essence of those rights. The Court nevertheless considered the interference to be serious.

The seriousness of that interference resulted both from the nature of the data disclosed and from the conditions governing access to it.

The information made available could facilitate the creation of a profile of a shareholder’s financial position and reveal the economic sectors and specific companies in which that person had invested. In addition, the data could be accessed by a potentially unlimited number of persons and, once made public, could subsequently be retained and disseminated.

The legal question is therefore not whether corporate transparency constitutes a legitimate objective. It is whether the specific disclosure measure is appropriate, necessary and proportionate to achieving that objective.

As regards the objective of ensuring a transparent business environment and protecting the interests of third parties, the CJEU considered that publishing data relating to all shareholders, and in particular minority shareholders, did not appear sufficiently useful for achieving that objective.

Accordingly, the national rules examined did not appear appropriate or necessary for that purpose.

The judgment therefore establishes an important requirement: corporate disclosure must maintain a functional connection with the purpose it is intended to serve.

A general reference to transparency is not sufficient to justify universal access to any information relating to a company’s ownership structure.

From a GDPR perspective, this analysis is closely linked to the principles of purpose limitation and data minimisation under Article 5.

The Court also considered the other objectives relied upon: preventing money laundering, terrorist financing and proliferation financing, as well as facilitating the enforcement of national, international and EU sanctions.

Their legitimacy as objectives of general interest was not in dispute.

What the CJEU questioned was whether it was necessary to allow any person to access the data of all shareholders without having to demonstrate any particular interest.

The Court identified less intrusive alternatives, such as limiting access to persons able to demonstrate a legitimate interest or, in the context of sanctions, restricting certain disclosure obligations to persons included on the relevant sanctions lists.

The lack of adequate safeguards against subsequent misuse of the information was also significant. The system allowed online access and bulk downloading of data even by unidentified users, increasing the risk that the information could be reused for purposes unrelated to those that originally justified the processing.

The Jautiva judgment therefore does not prevent legislators from imposing disclosure obligations. It requires the intensity of disclosure to remain proportionate to the purpose pursued and less intrusive mechanisms to be considered where they are capable of achieving the same objective.

The judgment also provides an opportunity to distinguish between three legal concepts that should not be treated as interchangeable.

Shareholder

A shareholder holds one or more shares representing part of the share capital of a company.

The shareholder’s legal position derives from that participation in the capital and from the economic and voting rights attached to the shares.

Merely holding shares does not necessarily imply participation in the company’s management, representation or supervision.

Director

A director forms part of the company’s management body and exercises the powers attributed to that body by company law and the articles of association.

Because directors participate in the organisational structure of the company, their legal position follows a different logic from that of a person who merely holds an equity interest.

That distinction is central to the CJEU’s interpretation of Article 14 of Directive 2017/1132.

Beneficial owner

Beneficial ownership belongs to a different regulatory framework, principally associated with anti-money laundering and counter-terrorist financing rules.

Its purpose is to identify the natural person who ultimately owns or controls a legal entity or legal arrangement in accordance with the applicable statutory criteria.

A shareholder and a beneficial owner are therefore not necessarily the same person.

A corporate ownership chain may exist in which the direct shareholder is itself a legal entity, while the beneficial owner must be traced to a natural person at the end of the ownership or control structure.

Conversely, not every minority shareholder will necessarily qualify as a beneficial owner.

The judgment does not, in itself, amend Spanish law or declare any specific provision of Spanish legislation incompatible with EU law.

The case arose from a preliminary reference made by the Latvian Constitutional Court. The CJEU interprets EU law, while it is for the national court to decide the underlying dispute in accordance with that interpretation. Nevertheless, the Court’s interpretation is binding on national courts when they apply the same provisions of EU law to equivalent legal issues.

Spanish law also illustrates the distinction between information relating to shareholders and information relating to beneficial owners.

For public limited companies, Article 116 of the Spanish Companies Act provides that registered shares must be recorded in a register maintained by the company itself. Successive transfers and certain information concerning holders are entered in that register. The provision grants shareholders the right to inspect the register, but does not create, through that mechanism, a generally accessible public register of shareholders open without restriction to any third party.

The beneficial ownership regime follows a different logic.

Royal Decree 609/2023 established the Spanish Central Register of Beneficial Ownership and provides for different levels of access. Competent authorities are subject to a specific access regime; obliged entities under Law 10/2010 may obtain the information necessary to comply with their customer due diligence obligations; and other persons or organisations must, as a general rule, demonstrate a legitimate interest.

For those other applicants, the information made available is also limited to specific categories of beneficial ownership data, including the beneficial owner’s first and last name, month and year of birth, country of residence and nationality, together with the nature of the beneficial ownership.

This framework illustrates why it would be legally inaccurate to translate Jautiva into broad propositions such as “shareholder data is private” or “shareholder information can no longer be disclosed”.

The relevant question is which data is subject to disclosure, in relation to which category of person, on what legal basis, for what purpose and under what access regime.

The principles established in Jautiva are particularly relevant for international groups, cross-border investments and holding structures.

The incorporation or reorganisation of a corporate structure requires consideration not only of corporate and tax matters, but also of the identification and disclosure rules applicable to shareholders, directors and beneficial owners in each jurisdiction.

Levels of public access to this information are not necessarily identical across jurisdictions.

Transactions such as share acquisitions, group reorganisations, joint ventures, investment processes and due diligence exercises may therefore require separate analysis of:

• the formal ownership of the share capital;
• voting and other governance rights attached to the shares;
• management and representation powers;
• direct and indirect control mechanisms;
• identification of the beneficial owner;
• disclosure obligations towards registers and public authorities; and
• third-party access to that information.

The Jautiva judgment reinforces precisely the need to keep these legal dimensions distinct.

The judgment does not impose a general obligation to review corporate registers, nor does it create a new direct obligation applicable to every company in the European Union.

Its practical significance lies in the standard it establishes for assessing the proportionality of access to personal information connected with corporate structures.

Companies may therefore wish to review:

1. what personal data concerning shareholders, members, directors and beneficial owners is collected;

2. the legal basis relied upon for each processing activity;

3. which information must be disclosed to public registers or authorities;

4. which information may be made available to third parties;

5. who may access that information and subject to which conditions; and

6. whether adequate safeguards are in place to prevent access, downloading or reuse that is incompatible with the purpose for which the information was originally processed.

For groups operating across several jurisdictions, this assessment should be carried out separately under the applicable company law, registration rules, data protection legislation and anti-money laundering framework in each relevant jurisdiction.

The CJEU judgment of 3 September 2026 in Case C-798/24, Jautiva, provides an important clarification in the field of corporate transparency: EU law does not require information relating to every shareholder of a public limited company to be made public merely because that person is a shareholder.

At the same time, the Court makes clear that a national regime allowing unrestricted and unconditional online access to the personal data of all shareholders must satisfy a strict necessity and proportionality test.

The significance of the judgment does not lie in treating privacy and transparency as mutually exclusive values. Rather, it requires every disclosure obligation to rest on a precise legal basis and to remain proportionate to the objective pursued.

For companies, investors and international corporate groups, Jautiva also highlights the importance of correctly distinguishing between equity ownership, the exercise of corporate functions, control and beneficial ownership. These are separate legal categories and may give rise to different disclosure, reporting and access obligations.

This distinction is particularly important in complex corporate structures, investment transactions, business reorganisations and groups operating across several jurisdictions, where corporate disclosure requirements, beneficial ownership identification, data protection obligations and anti-money laundering rules must be considered together.

At ILIA ETL GLOBAL, we advise companies, corporate groups and investors from an integrated corporate and international perspective, supporting the structuring of transactions, compliance with corporate transparency and beneficial ownership requirements, and the assessment of legal risks associated with corporate information.