On 3 September 2026, the Court of Justice of the EU (CJEU) ruled in Case C-798/24, Jautiva. The question was simple. Can shareholders’ personal data in public companies be open to everyone, with no conditions? The ruling balances business transparency against privacy and data protection.
How the case arose
The case began with constitutional complaints from 17 minority shareholders in Latvia. They challenged a law under which shareholder information was published online for anyone to see. For natural persons, this covered identity and contact details. In addition, the law disclosed share class, number and nominal value, plus voting rights. Access did not depend on showing a legitimate interest.
The Latvian legislature named several objectives. One was protecting third parties through greater business transparency. It also cited the prevention of money laundering and terrorist and proliferation financing. Another aim was to implement restrictive measures. For this reason, Latvia’s Constitutional Court asked the CJEU to interpret EU company and data protection law.
What the Court decided on the company law directive
First, the Court looked at Article 14(d) of Directive (EU) 2017/1132. It requires disclosure of persons authorised to represent a company. It also covers persons who take part in its administration, supervision or control. The Court held that the second category does not cover every shareholder. Holding shares is not enough. In particular, a minority shareholding does not make a shareholder a company representative. Nor does it mean taking part in administration, supervision or control. Consequently, Article 14(d) does not require disclosure of all shareholders of public companies.
However, this does not stop national law from going further. Still, any additional disclosure must meet the EU rules on processing personal data.
The GDPR and Charter assessment
For this reason, the Court tested the Latvian regime under Articles 5 and 6 GDPR. It also weighed Articles 7 and 8 of the Charter on privacy and data protection. The Court accepted that the stated objectives can serve the general interest. Yet it had to decide whether the interference was necessary and proportionate.
The Court noted how broad the regime was. Data was open to the public at large, not to defined categories of people. No legitimate interest had to be shown. As a result, an indeterminate number of people could access the data. Meanwhile, the shareholders themselves had little control over later use.
Why the AML/CFT aims did not justify open access
The AML and CFT aims did not show that unconditional public access was necessary. To reach this view, the Court considered EU rules on access to beneficial ownership data. As for restrictive measures, the Latvian regime was not limited to shareholders subject to them. It covered all shareholders. Therefore, the Court found that such legislation did not appear necessary or proportionate.
Is a legitimate interest required
The lack of conditions on access also mattered. It mentioned the possibility of asking applicants to show a legitimate interest. Nevertheless, it did not make this a requirement for all access. Instead, the absence of any condition was part of the proportionality assessment. So the operative part speaks of access without conditions, such as showing a legitimate interest.
The Court’s conclusion
In the end, Article 14(d) of Directive 2017/1132 does not require disclosure of all shareholders, including minority ones. Further, GDPR Articles 5 and 6, read with Charter Articles 7 and 8, preclude certain national laws. These are laws that make the specified personal data of all such shareholders public. This applies where access has no conditions, such as showing a legitimate interest.