Opinion of the Advocate General — ECLI:EU:C:2025:998
Date: 2025-12-18
Language of the case: Latvian

Summary C-798/24 – 1 
Case C-798/24 [Jautiva] i 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
19 November 2024 
Referring court: 
Satversmes tiesa (Latvia) 
Date of the decision to refer: 
14 November 2024 
Applicants: 
A and Others 
Institution responsible for the measure the constitutionality of which is called 
in question: 
Latvijas Republikas Saeima 
      
Subject matter of the main proceedings 
Examination of whether point 2(b) of the first paragraph of Article 4.15 of the 
Likums ‘Par Latvijas Republikas Uzņēmumu reģistru’ (Law on the Commercial 
Register of the Republic of Latvia) (‘the contested provision’), which provides 
that particulars relating to the shareholders of public limited liability companies 
must be disclosed, is in conformity with Article 96 of the Satversme 
(Constitution), which provides for the right to respect for private life.  
Subject matter and legal basis of the request for a preliminary ruling 
On the basis of Article 267 TFEU, the referring court asks: (1) whether Directive 
2017/1132 requires the disclosure of particulars relating to every shareholder; (2) 
whether, if the previous question is answered in the affirmative, the provision 
requiring such disclosure is valid in the light of Articles 7 and 8 of the Charter of 
 
i The name of the present case is a fictitious name. It does not correspond to the real name of any party to the proceedings. 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-798/24 
 
2  
Fundamental Rights of the European Union (‘the Charter’) (right to respect for 
private life and to the protection of personal data); (3) whether certain objectives 
relating to the guarantee of a transparent business environment, the protection of 
the interests of third parties, the prevention of money laundering and terrorist 
financing and the enforcement of national, international and European Union 
sanctions may be regarded as ‘legitimate purposes’ within the meaning of 
Article 5(1)(b) of the General Data Protection Regulation (GDPR); and (4) 
whether, in the interests of the aforementioned purposes, it is possible to establish 
national legislation allowing any person to obtain the personal data of 
shareholders without needing to demonstrate a legitimate interest in obtaining 
such data. 
Questions referred for a preliminary ruling 
(1) Must the concept of persons who ‘take part in the administration, 
supervision or control of the company’, used in Article 14(d) of Directive 
2017/1132, be interpreted as referring to any shareholder in a public limited 
liability company, with the result that a Member State is obliged to disclose the 
information relating to every shareholder in a public limited company and make it 
publicly available in the register in accordance with Article 16(3) of Directive 
2017/1132? 
(2) If the first question is answered in the affirmative, is Article 14(d)(ii) of 
Directive 2017/1132, in so far as it provides for the disclosure of particulars 
relating to every shareholder in a public limited liability company, valid in the 
light of the right to respect for private and family life guaranteed by Article 7 of 
the Charter and the right to the protection of personal data guaranteed by Article 8 
thereof? 
(3) Must Article 5(1)(b) of the General Data Protection Regulation be 
interpreted as meaning that processing the personal data of shareholders in a 
public limited liability company may serve the purpose, in the first place, of 
ensuring a transparent business environment and protecting the interests of third 
parties; in the second place, of preventing money laundering and the financing of 
terrorism and proliferation; and, in the third place, of providing the information 
necessary for the enforcement of national, international and European Union 
sanctions? 
(4) Do the principles established in Article 5(1) of the General Data Protection 
Regulation allow for the establishment, in the interests of those purposes, of 
national legislation under which any person may obtain the personal data of any 
shareholder in a public limited liability company without being obliged to 
demonstrate a legitimate interest in obtaining such data? 
JAUTIVA 
 
3 
Provisions of European Union law relied on 
Charter of Fundamental Rights of the European Union: Articles 7 and 8. 
Directive (EU) 2017/1132: Articles 14(d), 16(3) and 161. 
Regulation (EU) 2016/679: Articles 5 and 6(1)(c) and (3), last sentence. 
Directive (EU) 2015/849 (‘the Prevention Directive’): Article 30(5). 
Case-law of the Court of Justice 
Judgment in Cases C-37/20 and C-601/20, Luxembourg Business Registers, of 
22 November 2022, EU:C:2022:912, paragraphs 63 to 66, 72, 74 to 76 and 87. 
Judgment in Case C-398/15, Manni, of 9 March 2017, EU:C:2017:197, 
paragraphs 51 and 57. 
Judgment in Case 32/74, Haaga, of 12 November 1974, EU:C:1974:116, 
paragraph 6. 
Judgment in Case C-439/19 Latvijas Republikas Saeima (Penalty points), of 
22 June 2021, EU:C:2021:504, paragraphs 104 and 105. 
Judgment in Case C-261/09, Mantello, of 16 November 2010, EU:C:2010:683, 
paragraph 38. 
Provisions of national law relied on 
Komerclikums (Commercial Code): points 3 and 4 of Article 8(3), Articles 12, 
235 and 268. 
Likums ‘Par Latvijas Republikas Uzņēmumu reģistru’ (Law on the Commercial 
Register of the Republic of Latvia; ‘the Law on the Commercial Register’): the 
fifth paragraph of Article 4.10, point 2 of the first paragraph of Article 4.11, and 
point 2(b) of the first paragraph of Article 4.15 (which provides that the public part 
of the file for the registration of a limited liability company must include, inter 
alia, the particulars from the register of shareholders in companies limited by 
shares relating to the members (shareholders) of that company) and point 3(a) of 
the first paragraph of Article 4.15, and the second, third and fourth paragraphs of 
Article 4.15. 
Noziedzīgi iegūtu līdzekļu legalizācijas un terorisma un proliferācijas 
finansēšanas novēršanas likums (Law on the Prevention of Money Laundering and 
the Financing of Terrorism and Proliferation; ‘the Law on Prevention’): 
Article 5.1(1). 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-798/24 
 
4  
Starptautisko un Latvijas Republikas nacionālo sankciju likums (Law on 
International and National Sanctions of the Republic of Latvia; ‘the Law on 
Sanctions’): Article 5. 
Informācijas atklātības likums (Law on Freedom of Information): Article 11(4) 
and point 1.1 of Article 14(1). 
Succinct presentation of the facts and procedure in the main proceedings 
1 In Article 235 of the Commercial Code, Latvian law provides that the register of 
shareholders in companies must include, inter alia, particulars relating to the 
shareholders concerned (in the case of natural persons: the shareholder’s first 
name, surname and personal identification number (if the person does not have a 
personal identification number, his or her date of birth, the number and date of 
issue of a personal identification document, and the country and authority which 
issued it), and an address at which the shareholder can be reached), the 
shareholder’s e-mail address if the shareholder has asked the company to use that 
address to communicate with him or her, and the category, number and nominal 
value of, and the number of voting rights corresponding to, the shares held by 
each shareholder. 
2 For its part, the contested provision states that those particulars relating to 
shareholders must be included in the public part of the file for the registration of 
companies, the content of which is publicly accessible and is considered to be 
information within the public domain. Such personal data relating to shareholders 
are therefore available to the public. 
3 The referring court is hearing an action by which 17 natural persons are calling 
into question the compatibility of the aforementioned provision with Article 96 of 
the Constitution (respect for private life). 
The essential arguments of the parties in the main proceedings 
4 The applicants refer to the conclusions reached by the CJEU in the judgment 
given in Joined Cases C-37/20 and C-601/20, Luxembourg Business Registers, 
concerning the making available to the public of data on the beneficial owners of 
limited liability companies. According to the applicants, since the Court of Justice 
has held that similarly (or even less) extensive data concerning the beneficial 
owners must not constitute publicly accessible information, disclosure of the 
personal data of shareholders is all the more unjustified and disproportionate. The 
applicants submit that, as minority shareholders, they are neither the beneficial 
owners of a public limited liability company nor members of the management or 
executive body of one, and, in fact, have neither the right nor the option to 
exercise any control over the public limited liability company. Moreover, making 
such data available to the public entails a high risk that that information may be 
used for dishonest purposes in the future. 
JAUTIVA 
 
5 
5 According to the Latvijas Republikas Saeima (Parliament of the Latvian 
Republic, ‘Parliament’), the contested provision is in conformity with Article 96 
of the Constitution, since limiting the fundamental rights which that article entails 
serves the legitimate purposes of ensuring a transparent business environment, 
protecting the interests of third parties, preventing money laundering and the 
financing of terrorism and proliferation, and enabling the fulfilment of obligations 
laid down in legal acts imposing sanctions. In order for each of those objectives to 
be achieved, everyone must have immediate access to the aforementioned 
information without needing to demonstrate a legitimate interest in requesting it. 
According to the Parliament, the findings contained in the judgment in 
Luxembourg Business Registers cannot be extrapolated to the present case, since, 
in the former case, only one legitimate purpose had been established, namely the 
prevention of money laundering and terrorist financing. In the Latvian legal 
system and in Latvian legal practice, on the other hand, the limitation of 
fundamental rights contained in the contested provision serves several legitimate 
purposes. 
6 Intervener: The Datu valsts inspekcija (State Data Protection Agency) submits 
that, contrary to the principle of transparency enshrined in Regulation (EU) 
2016/679 (‘the GDPR’), the law containing the contested provision does not 
identify a specific aim for which the processing of such personal data is necessary. 
The volume of data processed and the question as to whether the aim of the data 
processing cannot be achieved by less extensive data processing must be assessed 
in the light of the principle of data minimisation. In the absence of a specifically 
identified aim, it is not possible to evaluate whether the extent of the personal data 
processing is proportionate (to that aim). The principles of purpose limitation and 
data minimisation cannot therefore be regarded as having been observed. 
7 Intervener: The Finanšu izlūkošanas dienests (Financial Intelligence Service) 
submits that the obligation to report any suspicious transaction to the Financial 
Intelligence Service without delay is incumbent not only on the obliged entities 
but also on other persons. It goes on to say that the identification and subsequent 
investigation of the beneficial owner and the information relating to the latter may 
form the basis of such a report. Consequently, in accordance with 
Recommendation 24 of the Financial Action Task Force, countries must ensure 
that competent authorities have quick and easy access to relevant, accurate and 
up-to-date information on beneficial owners and the control structures of legal 
persons. In order to comply with that requirement, States may assess whether it is 
also necessary to make publicly available the shareholder registers of public 
limited liability companies, which contain, in relation to each shareholder, 
information such as the person’s name and surname, the number of shares held, 
the categories of those shares and the voting rights corresponding to them. Third 
parties must be able to ascertain that information in order to fulfil their statutory 
obligation to determine whether the owner of the other contracting party, a legal 
person, has been the subject of international or national sanctions. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-798/24 
 
6  
Succinct presentation of the reasoning in the request for a preliminary ruling 
8 The Satversmes tiesa (Constitutional Court, Latvia) has doubts as to whether 
shareholders in public limited liability companies are to be regarded as persons 
taking part in the administration, supervision or control of the company within the 
meaning of Directive 2017/1132 and, therefore, whether that directive requires the 
disclosure of information on shareholders in public limited liability companies. 
9 After all, Article 14(d) of Directive 2017/1132 provides in essence that Member 
States must take the measures required to ensure compulsory disclosure by 
companies of documents and particulars relating at least to persons who either as a 
body constituted pursuant to law or as members of any such body are authorised 
to represent the company in dealings with third parties and in legal proceedings, 
and to persons who take part in the administration, supervision or control of the 
company. In accordance with Article 16(3) of that directive, Member States must 
ensure that the aforementioned particulars are subject to disclosure by making 
them publicly available in the register. In accordance with Article 13 of, and 
Annex II to, Directive 2017/1132, the aforementioned measures are to apply to the 
laws, regulations and administrative provisions of the Member States relating to, 
inter alia, Latvian public limited liability companies. 
10 It follows from recitals 4 to 8 of Directive 2017/1132 that the disclosure required 
by that directive is intended to protect the interests of third parties by restricting to 
the greatest possible extent the number of cases in which undertakings entered 
into in the name of a company are invalid. Consequently, the basic documents of a 
company must be accessible in order for third parties to be able to ascertain their 
contents and other information concerning the company, especially particulars of 
the persons who are authorised to bind the company (see also to that effect the 
judgments of the Court of Justice of 12 November 1974 in Case 32/74, Haaga, 
paragraph 6, and of 9 March 2017, in Manni, Case C-398/15, paragraph 49). 
11 The Court of Justice has interpreted the concept of ‘persons who are authorised to 
represent the company’ but has not as yet interpreted the concept of ‘persons who 
take part in the administration, supervision or control of the company’, and, in 
particular, it has not clarified whether that concept covers all shareholders in 
public limited liability companies. It follows from the wording of Article 14(d) of 
Directive 2017/1132 that those two groups of persons are different from each 
other and that Member States must disclose particulars relating to the persons 
forming part of each of those groups. 
12 It follows from recitals 27 and 37 thereof that Directive 2017/1132 does not affect 
or limit the right of Member States to regulate other aspects of company law 
which are not directly addressed in that directive. Nonetheless, it follows from the 
need for uniform application of EU law that the wording of a provision of EU law 
that contains no express reference to the law of the Member States with regard to 
the meaning of that provision must normally be given an autonomous and uniform 
interpretation throughout the European Union (see the judgment of the Court of 
JAUTIVA 
 
7 
Justice of 16 November 2010 in Case C-261/09, Mantello, paragraph 38). 
Consequently, the concept of ‘persons who take part in the administration, 
supervision or control of the company’, contained in Article 14(d) of Directive 
2017/1132, is very probably an autonomous concept of EU law which must be 
interpreted uniformly throughout the European Union. 
13 Pursuant to Article 226(1) of the Commercial Code, a share confers on the 
shareholder the right to take part in the administration of the company. 
Article 267(1) of the Commercial Code provides that shareholders must exercise 
their right to take part in the administration of the company at the general meeting 
of shareholders. Article 268 of the Commercial Code defines the powers of the 
general meeting of shareholders, which include the adoption of decisions relating 
to important matters of company business, such as the election and dismissal of 
the supervisory board, approval of the company’s annual accounts, attribution of 
the profits from the previous trading year, dissolution of the company, along with 
the continuation or reorganisation of the company’s business, reduction or 
increase of the share capital, amendment of the articles of incorporation, the 
bringing of actions against members of the management board and the supervisory 
board, and other matters. Furthermore, in accordance with Article 266 of the 
Commercial Code, the general meeting of shareholders is, like the supervisory 
board and the management board, an administrative body of the company. 
14 However, it is not the shareholders of public limited liability companies that have 
the power to assume obligations on the company’s behalf. Obligations are 
assumed on behalf of a public limited liability company by its management board. 
In accordance with Article 301(1) of the Commercial Code, the management 
board is the executive body which manages and represents the company. Pursuant 
to Article 303(3) of that code, the management board’s right of representation in 
dealings with third parties cannot be limited. The members of the management 
board and the supervisory board of a public limited liability company must be 
entered in the Commercial Register (see points 3 and 4 of Article 8(3) of the 
Commercial Code), which, pursuant to Article 12 of the Commercial Code, is 
enforceable against third parties. 
15 For its part, the supervisory body of a public limited liability company is the 
control body, which, in accordance with Article 291 of Commercial Code, 
represents the interests of the company and supervises the activities of the 
management board and the development of the company. Pursuant to 
Article 293(1) and (2), the supervisory board has the right to ask the management 
board at any time for a report on the company’s position, to be informed of all of 
the management board’s activities and to inspect the company’s records and 
documents, as well as the company’s cash position and all of its assets. The 
members of the supervisory board are elected by shareholders (see Articles 268(3) 
and 296 of the Commercial Code), and the supervisory board appoints the 
members of the management board (see point 1 of Article 292(1) and 
Article 305(1) of the Commercial Code), which, as stated, represents the 
company. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-798/24 
 
8  
16 In the light of the foregoing, it is clear that Article 14(d)(i) of Directive 2017/1132 
does not apply to all shareholders in a public limited liability company, since not 
all shareholders bind the company in dealings with third parties. However, it is not 
clear whether the shareholders in a public limited liability company are covered 
by Article 14(d)(ii) of Directive 2017/1132, that is to say whether they are to be 
regarded as ‘persons who take part in the administration, supervision or control of 
the company’. In that regard, it is also important to bear in mind that Article 14(d) 
of Directive 2017/1132 requires companies to disclose not only particulars 
relating to the persons referred to in that provision but also particulars relating to 
the appointment and termination of office of those persons. However, a 
shareholder in a public limited liability company acquires his or her status and 
rights by being entered in the register of shareholders (see Articles 136(1) and (3) 
and 228(2) of the Commercial Code). This means that a shareholder is not elected 
(‘appointed’) as a professional to perform certain functions in a public limited 
liability company (as a member of the management board or the supervisory board 
of a public limited liability company is), but acquires his or her status by 
participating in the company’s share capital. 
17 Thus, on the one hand, pursuant to the Commercial Code, the general meeting of 
shareholders is an administrative body of the company that is empowered to adopt 
decisions on important matters relating to the operation and existence of the 
company. On the other hand, however, in practice, shareholders take part in the 
administration of the company indirectly and not all shareholders, in particular 
minority shareholders, have the same actual opportunities to exercise control over 
the decisions adopted by the company. Consequently, the general public’s interest 
in obtaining relevant and private information on every shareholder in a public 
limited liability company might not be justified. 
18 If the Court of Justice finds that shareholders in public limited liability companies 
fall within the scope of Article 14(d)(ii) of Directive 2017/1132 and that, pursuant 
to Article 16(3) of that directive, information relating to such shareholders must 
be disclosed and made publicly available in the register, the view would have to 
be taken that the obligation to disclose the personal data of the shareholders in 
question in this case derives directly from a provision of EU law. If that is so, the 
resolution of the dispute also calls for a determination as to whether 
Article 14(d)(ii) of Directive 2017/1132 is valid in the light the right to respect for 
private and family life guaranteed by Article 7 of the Charter and the right to the 
protection of personal data guaranteed in Article 8 of the Charter. That assessment 
falls within the jurisdiction of the Court of Justice. 
19 In the light of the foregoing, the resolution of this dispute calls for a determination 
as to whether all shareholders in public limited liability companies fall within the 
scope Article 14(d)(ii) of Directive 2017/1132 and, if so, whether that provision is 
valid in the light of Articles 7 and 8 of the Charter. 
JAUTIVA 
 
9 
20 The Satversmes tiesa (Constitutional Court) seeks to ascertain whether disclosure 
of the particulars of shareholders in public limited liability companies is consistent 
with the principles established in Article 5(1) of the GDPR. 
21 The Satversmes tiesa (Constitutional Court) has held that the scope of the right to 
respect for private life, enshrined in Article 96 of the Constitution, encompasses 
the right of a person to the protection of his or her data. In the present case, it falls 
to the Satversmes tiesa (Constitutional Court), by giving specific expression to the 
right to respect for private life enshrined in Article 96 of the Constitution, to 
ensure that that right is consistent with the right to respect for private and family 
life guaranteed by Article 7 of the Charter and the right to the protection of 
personal data guaranteed by Article 8 of the Charter, which constitute general 
principles of EU law. In that regard, the Satversmes tiesa (Constitutional Court) 
must take into account in particular the principles relating to the processing of 
personal data which are contained in Articles 5 and 6 of the GDPR, and the 
observance of which falls within the scope of the rights guaranteed by Article 96 
of the Constitution. The requirements imposed by those provisions of EU law 
correspond to the right to respect for private life enshrined in Article 96 of the 
Constitution. Consequently, the conclusions of the Court of Justice relating to the 
interpretation of the GDPR are necessary to enable the Satversmes tiesa 
(Constitutional Court) to resolve the case before it. 
22 In this case, it falls to be determined whether the processing of the personal data 
of shareholders in public limited liability companies may be regarded as lawful in 
the light of the principles set out in Article 5(1) of the GDPR, in particular the 
principle of ‘data minimisation’, which is a reflection of the principle of 
proportionality. It follows from the case-law of the Court of Justice that the 
principle of ‘data minimisation’ does not preclude the disclosure of personal data 
to the public where this is necessary for compliance with a legal obligation to 
which the controller is subject, within the meaning of Article 6(1)(c) of that 
regulation. Nonetheless, in accordance with Article 52(1) of the Charter, 
limitations on the fundamental rights to respect for private life and to the 
protection of personal data must be provided for by law, respect the essence of the 
fundamental rights and observe the principle of proportionality (see the judgment 
of the Court of Justice in Case C-439/19, Latvijas Republikas Saeima (Penalty 
points), paragraphs 104 and 105). 
23 According to the settled case-law of the Court of Justice, measures which 
constitute an interference with the rights guaranteed in Articles 7 and 8 of the 
Charter may be regarded as proportionate only if they comply with the 
requirements of appropriateness and necessity, as well as with the requirement 
that such measures be proportionate to the objective pursued. More specifically, 
derogations from and limitations on the protection of personal data should apply 
only in so far as is strictly necessary, it being understood that where there is a 
choice between several measures appropriate to meeting the legitimate objectives 
pursued, recourse must be had to the least onerous. In addition, an objective of 
general interest may not be pursued without having regard to the fact that it must 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-798/24 
 
10  
be reconciled with the fundamental rights affected by the measure, by properly 
balancing the objective of general interest against the rights at issue, in order to 
ensure that the disadvantages caused by that measure are not disproportionate to 
the aims pursued. Thus, the question whether a limitation on the rights guaranteed 
in Articles 7 and 8 of the Charter may be justified must be assessed by measuring 
the seriousness of the interference which such a limitation entails and by verifying 
that the importance of the objective of general interest pursued by that limitation 
is proportionate to that seriousness. Furthermore, in order to satisfy the 
proportionality requirement, the legislation in question entailing the interference 
must also lay down clear and precise rules governing the scope and application of 
the measures provided for and imposing minimum safeguards, so that the data 
subjects have sufficient guarantees to protect effectively their personal data 
against the risk of abuse. It must, in particular, indicate in what circumstances and 
under which conditions a measure providing for the processing of such data may 
be adopted, thereby ensuring that the interference is limited to what is strictly 
necessary. The need for such safeguards is all the greater where personal data are 
made accessible to the general public, and thus to a potentially unlimited number 
of persons, and are liable to reveal sensitive data on the data subjects (see the 
judgment of the Court of Justice of 22 November 2022 in Joined Cases C-37/20 
and C-601/20, Luxembourg Business Registers, paragraphs 63 to 66). 
24  In accordance with that case-law, it is necessary to ascertain, first, whether the 
general public’s access to information on shareholders in public limited liability 
companies is appropriate for attaining the objective of general interest pursued, 
secondly, whether the interference with the rights guaranteed in Articles 7 and 8 
of the Charter which results from such access is limited to what is strictly 
necessary, in the sense that the objective could not reasonably be achieved in an 
equally effective manner by other means less prejudicial to those fundamental 
rights of the data subjects, and, thirdly, whether that interference is not 
disproportionate to that objective, which implies, in particular, a balancing of the 
importance of the objective and the seriousness of the interference. 
25 According to the Parliament, information relating to shareholders in public limited 
liability companies is made public in particular in order to ensure a transparent 
business environment and to protect the interests of third parties. 
26 In the judgment given in Luxembourg Business Registers, the Court of Justice 
distinguished the situation examined in that case from that examined in Case 
C-398/15, Manni, by stating that the compulsory disclosure provided for in 
Directive 68/151 (now Directive 2017/1132), on the one hand, and access by the 
general public to information on beneficial ownership as provided for in the 
amended Prevention Directive, on the other, differ both in their respective 
purposes and in their scope in terms of the personal data covered (see the 
judgment in Luxembourg Business Registers, paragraph 87). 
27 However, processing the personal data of shareholders in public limited liability 
companies serves the purpose not only of ensuring a transparent business 
JAUTIVA 
 
11 
environment but also of protecting the interests of third parties. In that regard, it is 
significant that the disclosure provided for in Directive 2017/1132 is intended to 
enable all third parties to be informed without having to establish a right or an 
interest requiring to be protected (see the judgment in Manni, paragraph 51). The 
Court of Justice has also held that such disclosure does not result in 
disproportionate interference with the fundamental rights of the persons 
concerned, and particularly their right to respect for private life and their right to 
protection of personal data as guaranteed by Articles 7 and 8 of the Charter (see 
paragraph 57 of that judgment). The processing of personal data provided for in 
this case differs from that examined in Luxembourg Business Registers as regards 
both the volume of data to be disclosed and the purposes for which the particulars 
in question are to be disclosed. Consequently, the present case may have to be 
examined in a broader context and is more difficult to distinguish from Manni, 
unlike the distinction drawn in Luxembourg Business Registers. 
28 In the light of the foregoing, the view might be taken in the present case that 
processing the personal data of shareholders in public limited liability companies 
serves the purpose of protecting the interests of third parties and that, in order to 
attain that legitimate objective, such data may permissibly be made public by 
being made accessible to any person without there being any need for that person 
to demonstrate a legitimate interest in obtaining such data. 
29 Consequently, the Satversmes tiesa (Constitutional Court) wishes to ascertain 
whether Article 5(1)(b) of the GDPR must be interpreted as meaning that 
processing the personal data of shareholders in a public limited liability company 
may serve the purpose of protecting the interests of third parties, and whether the 
principles set out in Article 5(1) of the GDPR allow a Member State, in the 
interests of that purpose, to establish legislation under which any person may 
obtain the personal data of any shareholder in a public limited liability company 
without being obliged to demonstrate a legitimate interest in obtaining such data. 
30 As the Parliament has noted, the disclosure of information relating to shareholders 
in a public limited liability company is also intended to prevent money laundering 
and the financing of terrorism and proliferation. 
31 The Prevention Directive requires the ‘obliged entities’ referred to in Article 2(1) 
thereof to adopt the customer due diligence measures provided for in Article 13, 
which include identifying the beneficial owners and taking reasonable measures to 
verify their identity, including by adopting reasonable measures to understanding 
the ownership and control structure of the customer (legal person). That 
information may lead to the conclusion that, in accordance with Article 18(3) of, 
and point 1(f) of Annex III to, the Prevention Directive, a risk-increasing factor 
can be attributed to the customer: the ownership or membership structure of the 
customer, a legal person, is unusual or complex for the customer’s business. 
32 The Prevention Directive was transposed in Latvia by the Law on Prevention, 
Article 3(1) of which establishes which entities are obliged entities. The Law on 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-798/24 
 
12  
Prevention imposes on such entities an obligation to carry out an examination of 
the customer before entering into a business relationship and in the other cases 
provided for by law. Without prejudice to the provisions of the Law on the 
Commercial Register which provide for the disclosure of the personal data of 
shareholders in public limited liability companies, those entities, as well as their 
supervisory and control bodies, have a right under Article 5.1(1) of the Law on 
Prevention, in order to fulfil the obligations laid down in that Law, to request and 
obtain online from the records kept in the Commercial Register information and 
particulars on the members and beneficial owners of such companies. Thus, 
obliged entities under the Law on Prevention may access information on 
shareholders in public limited liability companies for the purposes of fulfilling the 
obligations incumbent on them under that law. 
33 It is clear that the obligation to clarify the membership structure of the customer, a 
legal person, and the way in which the control exercised by the customer’s 
beneficial owner over the customer manifests itself, is primarily incumbent on the 
obliged entities under the Law on Prevention. Nonetheless, persons other than 
obliged entities under the Law on Prevention may also have a legitimate interest 
in carrying out an examination of the customer on their own initiative. 
Furthermore, pursuant to point 2 of Article 31.4(1) of the Law on Prevention, 
obliged entities under that Law have an obligation to report any suspicious 
transaction to the Financial Intelligence Service without delay. Pursuant to 
Article 3.1 of the Law on Prevention, the obligation to report any suspicious 
transaction is also incumbent on persons other than the obliged entities under the 
Law on Prevention and on State institutions, as well as on downstream public 
entities and their institutions. 
34 In the light of the foregoing, the legislature intends to make information on 
shareholders in public limited liability companies available to the general public, 
so that persons can contribute as far as possible to the prevention of money 
laundering and the financing of terrorism and proliferation. 
35 Consequently, the Satversmes tiesa (Constitutional Court) wishes to ascertain 
whether Article 5(1)(b) of the GDPR must be interpreted as meaning that 
processing the personal data of shareholders in a public limited liability company 
may serve the purpose of preventing money laundering and the financing of 
terrorism and proliferation, and whether the principles set out in Article 5(1) of the 
GDPR allow for the establishment, for that purpose, of national legislation under 
which any person may obtain the personal data of any shareholder in a public 
limited liability company without being obliged to demonstrate a legitimate 
interest in obtaining such data. 
36 Finally, as the Parliament has noted, disclosing information on the shareholders in 
a public limited liability company also serves the purpose of providing the 
information necessary to enforce national, international and EU sanctions. 
JAUTIVA 
 
13 
37 In accordance with Articles 25 and 41 of the Charter of the United Nations, the 
United Nations Security Council may take decisions on the imposition of 
measures (sanctions) which are binding on Member States of the United Nations. 
Likewise, pursuant to Articles 2(4) and 215(2) of the Treaty on the Functioning of 
the European Union, the Council of the European Union may adopt restrictive 
measures against natural or legal persons and groups or non-State entities. 
Furthermore, the Council of the European Union implements resolutions adopted 
by the United Nations Security Council and may also impose measures more 
restrictive than those provided for in those resolutions (see points 2 and 3 of the 
Guidelines on implementation and evaluation of restrictive measures (sanctions) 
in the framework of the EU Common Foreign and Security Policy). 
38 In the exercise of that competence, the Council of the European Union adopts 
regulations which often also include financial restrictive measures consisting of: 
(1) the freezing of funds and economic resources of designated persons and 
entities; and (2) a prohibition on making funds and economic resources available 
to such persons and entities (see point 30 of the EU Best Practices for the effective 
implementation of restrictive measures). The effects of such measures are also 
reflected in Article 5 of the Law on Sanctions. 
39 The Parliament submits that disclosure of the personal data of shareholders in 
public limited liability companies is necessary to enable any person to fulfil the 
obligation incumbent upon him or her to verify that the owners of the other 
contracting party, a legal person, are not the subject of international or EU 
sanctions. The Financial Intelligence Service agrees with that statement and draws 
attention to the obligation laid down in EU law to freeze funds and economic 
resources and the prohibition on making them available. 
40 In accordance with the EU Best Practices for the effective implementation of 
restrictive measures, such freezing covers all funds and economic resources 
belonging to or owned by designated persons and entities, and also to those held 
or controlled by such persons and entities. The funds and economic resources of a 
non-designated entity which has legal personality separate from the person or 
entity designated are not affected by such measures, unless they are controlled or 
held by the designated person or entity (see the EU Best Practices for the effective 
implementation of restrictive measures, points 34 and 35). The criterion to be 
taken into account when assessing whether a legal person or entity is owned by 
another person or entity is the possession of 50% or more of the capital of the 
legal person or entity or a decisive influence over it. If this criterion is satisfied, it 
is considered that the legal person or entity is owned by another person or entity. 
When assessing ownership, the aggregated ownership of the entity should also be 
taken into account. For example, if one designated person owns 30% of the entity 
and another designated person owns 25% of the entity, the entity should, in 
principle, be considered as owned by the designated persons (see the EU Best 
Practices for the effective implementation of restrictive measures, point 63). In 
this regard, a circumstance that may qualify as an indication that a designated 
person or entity has control over a non-designated entity is a majority 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-798/24 
 
14  
shareholding in the undertaking in question, in other words, the fact that a 
designated person is the majority shareholder in an undertaking. If the ownership 
or control is established in accordance with the above criteria, the making 
available of funds or economic resources to non-listed legal persons or entities 
which are owned or controlled by a listed person or entity will in principle be 
considered as making them indirectly available to the listed person or entity (see 
the EU Best Practices for the effective implementation of restrictive measures, 
points 67 and 68). 
41 Regulations imposing freezing measures apply, inter alia, to EU citizens, EU legal 
entities and other economic operators, including financial and credit institutions, 
doing business in whole or in part in the EU. For its part, anti-money laundering 
legislation imposes certain requirements on certain businesses and professions to 
verify the identity of customers and to refrain from anonymous transactions in 
certain circumstances. In some instances, the regulations imposing financial 
restrictive measures may create additional obligations on economic operators to 
‘know their customers’ (see the EU Best Practices for the effective 
implementation of restrictive measures, points 39 and 40, and Council Regulation 
(EU) 2017/1509 of 30 August 2017 concerning restrictive measures against the 
Democratic People’s Republic of Korea, Article 34(1) and (2)). 
42 On the one hand, therefore, the financial restrictive measures imposed by EU 
regulations apply to any person in the European Union and prohibit funds or 
economic resources from being made available to non-designated legal persons or 
entities owned or controlled by a designated person or entity. Consequently, in 
order to fulfil that obligation not to make funds or economic resources indirectly 
available, any person to whom those regulations apply must ensure that the public 
limited liability company in question is not owned or controlled by a designated 
person. This includes, in particular, the need to identify the shareholders in the 
public limited liability company concerned. On the other hand, however, such 
regulations provide for customer due diligence measures only in relation to certain 
groups of persons, and not in relation to any person. 
The Satversmes tiesa (Constitutional Court) therefore seeks clarification as to 
whether Article 5(1)(b) of the GDPR must be interpreted as meaning that 
processing the personal data of shareholders in a public limited liability company 
may serve the purpose of providing the information necessary to fulfil the 
obligations contained in EU regulations laying down financial restrictive 
measures, and whether the principles set out in Article 5(1) of the GDPR allow for 
the establishment, for that purpose, of national legislation under which any person 
may obtain the personal data of any shareholder in a public limited liability 
company without being obliged to demonstrate a legitimate interest in obtaining 
such data. 
43 In the opinion of the Satversmes tiesa (Constitutional Court), disclosure of the 
personal data of the shareholders in a public limited liability company might be 
JAUTIVA 
 
15 
suitable, necessary and appropriate for achieving the aforementioned legitimate 
objectives. 
44 Nonetheless, when personal data are made available to the public online, it is not 
possible to ensure that those data are processed fairly and will not be further 
processed in a manner that is incompatible with the aforementioned purposes, as 
required by Article 5(1)(a) and (b) of the GDPR. After all, when personal data are 
made available to the public without a requirement to justify the need for such 
information, it is not possible to control what people will do with those personal 
data. Although the Court of Justice has held that the GDPR does not prohibit the 
disclosure of personal data, the Satversmes tiesa (Constitutional Court) has doubts 
as to whether, in the present case, disclosure of the personal data of shareholders 
in public limited liability companies is based on a proper balancing of the 
objectives of general interest pursued against the fundamental rights at issue, and 
whether there are adequate safeguards against the risk of misuse of such personal 
data. 
45 Furthermore, in the judgment of 22 November 2022 in Joined Cases C-37/20 and 
C-601/20, Luxembourg Business Registers, the Court of Justice held that the 
interference with the rights guaranteed in Articles 7 and 8 of the Charter, which 
results from the general public’s access to information on beneficial ownership, is 
not limited to what is strictly necessary (paragraphs 74 to 76 of that judgment). In 
order to comply with that judgment, the first paragraph of Article 74 of Directive 
2024/1640 amended point (c) of the first subparagraph of paragraph 5 of 
Article 30 of the Prevention Directive, and provided that information on beneficial 
ownership is to be available only to those persons and organisations that can 
demonstrate a legitimate interest (in addition to competent authorities and obliged 
entities exercising customer due diligence). What is more, pursuant to 
Article 78(1) of Directive 2024/1640, Member States must comply with the 
requirements of Article 74 of that directive by 10 July 2025. 
46 In the present case, it is submitted that the conclusions reached in that judgment 
can be extrapolated to the disclosure of information relating to all of the 
shareholders in a public limited liability company. 
47 However, there is a difference between the volume of information and the 
purposes of its disclosure which the Court of Justice found to be lawful in the 
judgment in Luxembourg Business Registers, and the volume of information and 
the purposes of its disclosure which the Satversmes tiesa (Constitutional Court) 
must assess in the present case. Article 3(6) of the Prevention Directive defines 
the concept of ‘beneficial owner’. In transposing the Prevention Directive, the 
Latvian legislature provided, in point 5(a) of Article 1(1) of the Law on 
Prevention, that a beneficial owner is the natural person who, by direct or indirect 
participation, owns more than 25% of the shares in the capital or of the voting 
shares of a legal person or who directly or indirectly controls that person. The 
beneficial owner of a public limited liability company may be either the 
shareholder him or herself or any other natural person who exercises effective 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-798/24 
 
16  
control over the company or in whose interest a commercial relationship is 
established or a transaction is performed. Such effective control may also be 
exercised indirectly, for example, through use of the shareholders’ influence on 
the company, including through family ties or formal or informal arrangements. 
For their part, the shareholders, as ‘legal’ owners of the company, participate in its 
management and their right to do so is corroborated by their ownership of the 
shares in it (see Article 226(1) of the Commercial Code). Thus, the role of the 
shareholder and that of the beneficial owner in a public limited liability company, 
and their impact on that company, are different. 
48 In the judgment in Luxembourg Business Registers, the Court of Justice held in 
particular that the fact that it may be difficult to provide a detailed definition of 
the circumstances and conditions under which the public may access information 
on beneficial ownership is no reason for the EU legislature to provide for the 
general public to access that information (see paragraph 72 of that judgment). 
49 The Commercial Register, as data controller and sender of information, is not in a 
position to verify whether a person requesting information does indeed have an 
interest in obtaining the information requested. In those circumstances, the 
requirement to indicate a legitimate interest must be regarded as a formal obstacle 
to obtaining the information. Under the procedure in force in Latvia for requesting 
restricted information, such information must be requested in writing and the 
person requesting it must justify his or her request and indicate the purpose for 
which the information will be used. When the restricted information is disclosed, 
the recipient of that information undertakes to use it only for the purposes for 
which it was requested (see Article 11(4) of the Law on Freedom of Information). 
It may take several days for that information to be communicated. If the request 
for information meets the requirements of the law and the information is requested 
only in electronic format and does not require further processing, the information 
will be provided within 10 days (see point 1.1 of Article 14(1) of the Law on 
Freedom of Information). The Satversmes tiesa (Constitutional Court) therefore 
asks whether the aforementioned procedure for requesting restricted information 
may be regarded as another means by which the aforementioned objectives could 
reasonably be achieved in an equally effective manner. 
50 Consequently, the Satversmes tiesa (Constitutional Court) seeks clarification as to 
whether the principles set out in Article 5(1) of the GDPR preclude national 
legislation under which any person may obtain the personal data of any 
shareholder in a public limited liability company without being obliged to 
demonstrate a legitimate interest in obtaining such data.