Corporate transparency cannot result in the generalised and unconditional disclosure of the personal data of all shareholders, including minority shareholders. In its judgment of 3 September 2026 in Case C-798/24, the Court of Justice of the European Union clarified the limits within which Member States may impose disclosure requirements concerning a company’s shareholder structure, in light of both EU company law and the principles laid down by the GDPR.
The dispute concerned national legislation requiring a broad range of information relating to shareholders of public limited companies to be made available to the public, including identification and contact details, the class, number and nominal value of the shares held, and the number of voting rights attached to those shares. Under the national legislation, such disclosure requirements were intended to pursue several objectives of general interest, including ensuring a transparent business environment, protecting the interests of third parties, preventing money laundering and terrorist financing, and facilitating the implementation of national, EU and international sanctions.
The Court first ruled that Directive (EU) 2017/1132 on certain aspects of company law does not require the disclosure of information concerning all shareholders. The disclosure obligations laid down by that Directive principally concern persons who are empowered to represent the company vis-à-vis third parties or who participate in its administration, supervision or control. A shareholder occupies a different legal position: shareholder status derives from ownership of an interest in the company’s share capital and not from the conferral of managerial or representative functions. The Court further observed that EU company law does not impose a general disclosure obligation whenever the composition of a company’s shareholding changes. Accordingly, the objective of protecting third parties pursued by EU company law does not require the indiscriminate public disclosure of the identity of all shareholders, and particularly minority shareholders.
The second aspect addressed by the judgment directly concerns the GDPR.
The Court referred to the principles of lawfulness, purpose limitation and data minimisation laid down in Article 5 GDPR, as well as to the conditions for lawful processing set out in Article 6. Where the publication of personal data is required by law, the processing may be based on compliance with a legal obligation. However, this does not relieve the legislature of the obligation to comply with the requirements of necessity and proportionality. The legislative measure must therefore genuinely pursue an objective in the public interest, and the interference with the rights of the data subjects must be appropriate, necessary and proportionate to the objective pursued.
In that context, the Court attached particular importance to the nature and extent of the data made public. Information concerning a shareholder’s identity, the number and value of shares held and the corresponding voting rights may reveal significant aspects of that person’s financial and economic circumstances, as well as the companies in which he or she has chosen to invest. The seriousness of the interference is further increased by the fact that, once such information is made publicly available without any conditions, it may be accessed, retained, reproduced and disseminated by an indefinite number of persons, including for purposes wholly unrelated to those originally pursued by the legislature.
According to the Court, merely invoking the need to ensure economic transparency is not sufficient to justify such extensive exposure of personal data.
The Court reached a similar conclusion with regard to the objectives of preventing money laundering and terrorist financing. The generalised publication of the personal data of all shareholders is not necessary for the achievement of those objectives, particularly given that EU legal frameworks assign specific monitoring and due diligence responsibilities to competent public authorities and obliged entities, including credit and financial institutions.
The central element of the judgment is therefore the principle of proportionality. Even where a restriction on the right to the protection of personal data is laid down by law and pursues an objective of general interest, it must still be assessed whether less intrusive measures are available that are capable of achieving the same objective effectively.
Among the possible alternatives, the Court referred to a more selective access model. Publication could, for example, be limited to persons included on specific sanctions lists, while access to information concerning other shareholders could be made conditional upon the person requesting access demonstrating a legitimate interest.
The judgment is significant well beyond the circumstances of the specific case because it reaffirms a principle applicable to a wide range of statutory disclosure systems and publicly accessible registers: the fact that national legislation provides for public access to personal data is not, in itself, sufficient to ensure that the processing complies with the GDPR. The legislature itself remains subject to the principles of data minimisation, necessity and proportionality and must assess whether unrestricted public access is genuinely indispensable for achieving the objective pursued.
For companies, multinational groups and entities responsible for managing corporate registers or statutory disclosure systems, the decision therefore provides an important reminder of the need to distinguish between transparency that is genuinely necessary and the generalised disclosure of personal information. The protection of third-party interests and compliance requirements cannot automatically justify making the financial position and shareholding interests of every shareholder fully accessible to the general public.
