Insights

Finding the right balance between adequately protecting a private individual’s right to privacy while also addressing the public’s interest in having certain information made available has been the subject of significant debate with proponents of freedom of information arguing that the public has an interest in having access to certain information.

In this respect, it is important to note that the European Convention on Human Rights, the EU Charter of Fundamental Human Rights (“EUCHR”) and Malta’s Constitution enshrine the notion of a right to private life while also creating room for such a right to be limited in circumstances.

Constitution of Malta

“Whereas  every  person  in  Malta  is  entitled  to  the fundamental rights and freedoms of the individual, that is to say, the right to… respect for his private and family life”.

Those rights are “subject  to  such  limitations  of  that  protection  as  are contained in those provisions being limitations designed to ensure that  the  enjoyment  of  the  said  rights  and  freedoms  by  any individual does not prejudice the rights and freedoms of others or the public interest”.

EUCHR

Article  7 – Respect  for  private  and  family  life

 Everyone  has  the  right  to  respect  for  his  or  her  private  and  family  life,  home  and  communications.

 Article  8 – Protection  of  personal  data

1. Everyone has  the  right  to  the  protection  of  personal  data  concerning  him  or 
2. Such data  must  be  processed  fairly  for  specified  purposes  and  on  the  basis  of  the  consent  of  the person  concerned  or  some  other  legitimate  basis  laid  down  by    Everyone  has  the  right  of  access  to data  which  has  been  collected  concerning  him  or  her,  and  the  right  to  have  it  rectified.
3.  Compliance with  these  rules  shall  be  subject  to  control  by  an  independent  authority.

It is indeed critical that these rights are balanced against public interest and it is the search for this balance that has sparked significant debate.

The interpretation of this right has been the subject of a number of decisions of both the European Court of Human Rights (“ECHR”) as well as the European Court of Justice (“ECJ”).

Finding this balance has not always been easy and while the ECHR has held that “the notion of private life is a broad concept” (Bărbulescu v. Romania (Application no. 61496/08)), the ECHR has also expressly stated that where there is a  conflict between two rights or the manner in which these rights are applied then the “the State is called upon to guarantee both rights and if the protection of one leads to an interference with the other, to choose adequate means to make this interference proportionate to the aim pursued” (Fernández Martínez v. Spain ((Application no. 56030/07)).

Judgements by the ECJ also identify that there needs to be a balance of rights. Of particular relevance was the case Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. This case centred around a complaint which was lodged by a Spanish citizen against a Spanish newspaper, Google Inc and Google Spain complaining that a notice regarding his repossessed home infringed his privacy rights since the proceedings had been fully resolved for a number of years and therefore the information was irrelevant. He requested that Google be ordered to remove the personal data relating to him.

In its ruling, the ECJ held that “Article 7 of the [EU Charter of Fundamental Human Rights] guarantees the right to respect for private life, whilst Article 8 of the Charter expressly proclaims the right to the protection of personal data” and that “a fair balance should be sought in particular between that interest [being the legitimate interest of internet users potentially interested in having access to that information] and the data subject’s fundamental rights under Articles 7 and 8 of the Charter” (Case C‑131/12).

Of particular interest is that in this case, the ECJ went as far as to state “in the light of his fundamental rights under Articles 7 and 8 of the Charter.. it should be held… that those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject’s name”. Therefore, the ECJ makes it clear that the interest of the general public much largely be balanced again an individual’s right to private life and it should only be in particular reasons that the “the interference with his fundamental rights is justified by the preponderant interest of the general public”.

More recently, the ECJ has been called upon again to find a balance between Articles 7 and 8 of the EUCHR and Directive (EU) 2018/843 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and amending Directives 2009/138/EC and 2013/36/EU (the “AMLD”).

In WM (C‑37/20) and Sovim SA (C‑601/20) v Luxembourg Business Registers (Joined Cases C‑37/20 and C‑601/20), a dispute arose in relation to whether Article 30(5)(c) of the AMLD (which provides that “Member States shall ensure that the information on the beneficial ownership is accessible in all cases to any member of the general public”) is in fact valid when having regard to the provisions of Article 7 and 8 of the EUCHR.

In issuing its decision, the ECJ noted that:

1. the AMLD aims to create an environment which is hostile to criminals and that enhancing the overall transparency of the economic and financial environment of the European Union could be a powerful deterrent; and
2. the objective of the general public’s access to information on beneficial ownership ‘allows greater scrutiny of information by civil society, including by the press or civil society organisations, and contributes to preserving trust in the integrity of business transactions and of the financial system’ (Recital 30 AMLD).

By means of this recital and recital 31 of the AMLD, the EU legislature has sought to create an objective of general interest which would allow an interference in the rights under Articles 7 and 8 of the EUCHR. The basis of this is that the ECJ has held that there are certain purposes which “undoubtedly constitute objectives of general interest of the European Union that are capable of justifying even serious interferences with the fundamental rights enshrined in Articles 7 and 8” (C‑817/19, Ligue des droits humains v Conseil des ministers).

However, in this case the ECJ also noted “that derogations from and limitations on the protection of personal data should apply only in so far as is strictly necessary. In addition, an objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure, by properly balancing the objective of general interest against the rights at issue”.

In examining whether there had been a proper balancing exercise, the ECJ noted that the Council and Commission had in fact conducted an impact assessment prior to proposing amendments to the AMLD in order to determine the most appropriate legislative solution (the “Impact Assessment”). In this regard, it was noted that access to beneficial ownership information could be restricted to those persons who can demonstrate a legitimate interest. In fact, in terms of the General Data Protection Regulation (“GDPR”), processing of personal data in furtherance of legitimate interests pursued by the controller is permitted “except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.

The difficulty with this is that providing a definition of this somewhat elusive concept is difficult. The Impact Assessment specifically noted that “this concept [legitimate interest] aims at addressing potential data protection and privacy concerns and has to be defined and assessed at national level. However, this criterion related to the legitimate interest left to national discretion may lead to excessive limitations of the access to the register as well as to a lack of a level playing field”. Therefore the risks here were that diverse definitions may lead to a non-uniform application of the AMLD. The other option considered was to grant full access to the public. The Impact Assessment noted that “full public access needs to be carefully assessed regarding its compatibility with the Charter” given that there are “legal risks in terms of compatibility with the Charter of Fundamental Rights”.

While it is clear that the EU legislature identified that balance needed to be struck, the decision to then grant full access by members of the public tipped the balance firmly to the transparency side despite the weight of the other elements discussed above. Recital 30 of the AMLD notes that “[p]ublic access to beneficial ownership information allows greater scrutiny of information by civil society, including by the press or civil society organisations, and contributes to preserving trust in the integrity of business transactions and of the financial system” and therefore, it is clear that this was the impetus behind allowing access to the general public.

As the ECJ notes in its judgement “both the press and civil society organisations that are connected with the prevention and combating of money laundering and terrorist financing have a legitimate interest in accessing information on beneficial ownership. This has also clearly been the case in relation to investigations conducted by the Fourth Estate which have come to light in recent years. However, it is hard to quantify how, and to what extent, mass access by the public can help reduce money laundering  and ensure that the objective of general interest outlined above is met. In its own Impact Assessment, it was noted that “giving full public access rights to the information held in the registers will ensure more consistency in the EU framework as regards the access to beneficial ownership information and more efficiency in the traceability of the beneficial owner” with respect to limited liability companies but appeared to stop short of actually identifying how access by the public would achieve these general interest objectives.

Having regard to (i) the above considerations and (ii) that combatting money laundering and terrorist financing is largely an obligation of public authorities, competent authorities and obliged entities the ECJ concluded that “providing for the general public’s access to information on beneficial ownership, amounts to a considerably more serious interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter, without that increased interference being capable of being offset by any benefits which might result from the latter regime as compared against the former regime, in terms of combating money laundering and terrorist financing” and on that basis held that the amendment to the AMLD to allow access to the general public is invalid.

The main issue here is the decision to move from the original wording which provided that “Member States shall ensure that the information on the beneficial ownership is accessible in all cases to: any person or organisation that can demonstrate a legitimate interest” to full blown access by the general public. While one recognises the risks that come with attempting to define a ‘legitimate interest’ since a definition may be unduly restrictive or broad, it is entirely possible to identify categories of persons who have a legitimate interest. In fact, the AMLD teeters close to the point of doing so when identifying members of the press or civil society organisations in its Recital. This, in and of itself, gives insight to the frame of mind of the EU legislature. Unfortunately, failure to do so essentially forced the ECJ’s hand since it is critical that fundamental rights are protected and that a general interest objective needs to be clearly identified.

One could also argue that the wording of the AMLD would even appear to violate the provisions of GDPR given that it may result in mass processing of personal data by individuals who might not necessarily be in a position to demonstrate a legitimate interest which overrides the interests of the data subjects (being the beneficial owners) in question. This is quite apart from the risks of cross-border data transfers to countries which do not afford the same level of protection granted pursuant to GDPR.

These concepts clearly identify how important it is for the legislator to identify (so as not to define) different examples of a legitimate interest or alternatively persons who are deemed to have a legitimate interest in order to ensure that the aims of the EUCHR, our Constitution and the AMLD align and work together. Unfortunately, the current wording of Article 30(5)(c) is quite categoric in favour of transparency over privacy on this particular subject matter and the decision of the ECJ though apparently equally categoric and potentially draconian, is not surprising.  Following this decision, the task of the legislators now is to find an appropriate middle in order to ensure that the aims of the AMLD are met while at the same time the rights under Articles 7 and 8 are respected.

This article was first published in The Times of Malta in two parts: first part on 5th December and second part 6th December.