A and Others (C-798/24)

Contents

Judgment of the Court (First Chamber)3 September 2026^note(Reference for a preliminary ruling — Protection of natural persons with regard to the processing of personal data — Regulation (EU) 2016/679 — Article 5 — Principles relating to processing of personal data — Article 6 — Lawfulness of processing — Company law — Directive (EU) 2017/1132 — Article 14 — Documents and particulars to be disclosed — Concept of persons who take part in the administration, supervision or control of a company — Making available to the public personal data relating to the shareholders of public limited liability companies — Minority shareholders)In Case C‑798/24 [Jautiva],^noteREQUEST for a preliminary ruling under Article 267 TFEU from the Satversmes tiesa (Constitutional Court, Latvia), made by decision of 14 November 2024, received at the Court on 19 November 2024, in the proceedingsTHE COURT (First Chamber),composed of F. Biltgen, President of the Chamber, T. von Danwitz (Rapporteur), Vice-President of the Court, A. Kumin, S. Gervasoni and M. Bošnjak, Judges,Advocate General: R. Norkus,Registrar: A. Calot Escobar,having regard to the written procedure,after considering the observations submitted on behalf of:– A and Others, by L. Liepa, advokāts,– the Latvian Government, by J. Davidoviča and K. Pommere, acting as Agents,– the Polish Government, by B. Majczyna, acting as Agent,– the Finnish Government, by A. Laine, acting as Agent,– the Swedish Government, by C. Meyer-Seitz, acting as Agent,– The Norwegian government, by K.E.M. Skjelland and B. Stankovic, acting as Agents,– the European Parliament, by G. Corstens, M. Migliorati and L. Ruppeka-Rupeika, acting as Agents,– the Council of the European Union, by L. Bergere, N. Coghlan and A.‑L. Meyer, acting as Agents,– the European Commission, by A. Bouchagiar, H. Kranenborg, I. Naglis and M. Noll-Ehlers, acting as Agents,after hearing the Opinion of the Advocate General at the sitting on 18 December 2025,gives the following

Judgment

1This request for a preliminary ruling concerns, first, the interpretation of Article 14(d)(ii) of Directive (EU) 2017/1132 of the European Parliament and of the Council of 14 June 2017 relating to certain aspects of company law (OJ 2017 L 169, p. 46), as amended by Directive (EU) 2019/1151 of the European Parliament and of the Council of 20 June 2019 (OJ 2019 L 186, p. 80) (‘Directive 2017/1132’), and the validity of that provision in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’), and, second, the interpretation of Article 5(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).

2The request has been made in the context of a constitutional complaint brought by natural persons who are challenging the compatibility with the Latvijas Republikas Satversme (Constitution of the Republic of Latvia) of national legislation which requires personal data relating to the shareholders of public limited liability companies to be made available to the public.

Legal context

European Union law

The Charter

3Article 7 of the Charter, headed ‘Respect for private and family life’, provides:‘Everyone has the right to respect for his or her private and family life, home and communications.’

4Article 8 of the Charter, headed ‘Protection of personal data’, provides:1. Everyone has the right to the protection of personal data concerning him or her.2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.3. Compliance with these rules shall be subject to control by an independent authority.’

5Article 52 of the Charter, headed ‘Scope and interpretation of rights and principles’, provides, in paragraph 1:‘Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the [European] Union or the need to protect the rights and freedoms of others.’

The GDPR

6Recitals 1 and 10 of the GDPR state:(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the [Charter] and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.…(10) In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. Consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union. …’

7Pursuant to Article 1(2) thereof, the GDPR protects fundamental rights and freedoms of natural persons, and in particular their right to the protection of personal data.

8As set out in Article 2(1), the GDPR applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

9Article 4 of the GDPR, headed ‘Definitions’, provides:‘For the purposes of this Regulation:(1) “personal data” means any information relating to an identified or identifiable natural person … an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;(2) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;…’

10Article 5 of the GDPR, headed ‘Principles relating to processing of personal data’, provides, in paragraph 1:‘Personal data shall be:(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (“purpose limitation”);(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);…’

11Article 6 of the GDPR, headed ‘Lawfulness of processing’, provides, in paragraphs 1 and 3:1.Processing shall be lawful only if and to the extent that at least one of the following applies:(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;…(c) processing is necessary for compliance with a legal obligation to which the controller is subject;…3.The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:(a) Union law; or(b) Member State law to which the controller is subject.The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.’

Directive 2017/1132

12Recitals 7 and 8 of Directive 2017/1132 state:(7) The coordination of national provisions concerning disclosure, the validity of obligations entered into by, and the nullity of, companies limited by shares or otherwise having limited liability, is of special importance, particularly for the purpose of protecting the interests of third parties.(8) The basic documents of a company should be disclosed in order for third parties to be able to ascertain their contents and other information concerning the company, especially particulars of the persons who are authorised to bind the company.’

13As set out in Article 1 of that directive, headed ‘Subject matter’:‘This Directive lays down measures concerning the following:– the coordination of safeguards which, for the protection of the interests of members and others, are required by Member States of companies within the meaning of the second paragraph of Article 54 of the Treaty, in respect of the formation of public limited liability companies and the maintenance and alteration of their capital, with a view to making such safeguards equivalent,– the coordination of safeguards which, for the protection of the interests of members and third parties, are required by Member States of companies within the meaning of the second paragraph of Article 54 of the Treaty, in respect of disclosure, the validity of obligations entered into by, and the nullity of, companies limited by shares or otherwise having limited liability, with a view to making such safeguards equivalent,…’

14Article 4 of that directive, headed ‘Compulsory information to be provided in the statutes or instruments of incorporation or separate documents’, provides:‘The following information at least shall appear in either the statutes or the instrument of incorporation or a separate document published in accordance with the procedure laid down in the laws of each Member State in accordance with Article 16:…(i) the identity of the natural or legal persons or companies or firms by which or in whose name the statutes or the instrument of incorporation, or where the company was not formed at the same time, the drafts of those documents, have been signed;…’

15Article 13 of that directive, headed ‘Scope’, provides:‘The coordination measures prescribed by this Section and by Section 1A shall apply to the laws, regulations and administrative provisions of the Member States relating to the types of companies listed in Annex II and, where specified, to the types of companies listed in Annexes I and IIA.’

16Annex II to Directive 2017/1132, which lists the types of companies referred to, inter alia, in Article 13 of that directive, refers, for Latvia, to ‘akciju sabiedrība, sabiedrība ar ierobežotu atbildību, komanditsabiedrība’, that is to say, to public limited liability companies, private limited liability companies and partnerships limited by shares.

17Article 14 of that directive, headed ‘Documents and particulars to be disclosed by companies’, provides:‘Member States shall take the measures required to ensure compulsory disclosure by companies of at least the following documents and particulars:(a) the instrument of constitution, and the statutes if they are contained in a separate instrument;…(d) the appointment, termination of office and particulars of the persons who either as a body constituted pursuant to law or as members of any such body:(i) are authorised to represent the company in dealings with third parties and in legal proceedings; it shall be apparent from the disclosure whether the persons authorised to represent the company may do so alone or are required to act jointly;(ii) take part in the administration, supervision or control of the company;…’

18Article 16(3) of that directive provides:‘Member States shall ensure that the disclosure of the documents and information referred to in Article 14 is effected by making them publicly available in the [central, commercial or companies register]. …’

19Article 64(3) and Article 95(2) of that directive concern the obligations of the administrative or management body of the company towards the general meeting in relation to financial assistance granted by a company for the acquisition of its own shares by a third party, and in relation to mergers by acquisition, respectively.

Directive (EU) 2015/849

20Articles 11 and 13 of Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ 2015 L 141, p. 73), as amended by Directive (EU) 2024/1640 of the European Parliament and of the Council of 31 May 2024 (OJ L, 2024/1640) (‘Directive 2015/849’), specify the customer due diligence to be carried out by obliged entities.

21Article 30(5) of Directive 2015/849 provides:‘Member States shall ensure that the information on the beneficial ownership is accessible in all cases to:…(c) any person or organisation that can demonstrate a legitimate interest.The persons or organisations referred to in point (c) of the first subparagraph shall be permitted to access at least the name, the month and year of birth and the country of residence and nationality of the beneficial owner as well as the nature and extent of the beneficial interest held.’

Latvian law

The Constitution of the Republic of Latvia

22Article 96 of the Constitution of the Republic of Latvia enshrines, inter alia, the right to respect for private life. According to the case-law of the Satversmes tiesa (Constitutional Court, Latvia), the scope of that article extends to the protection of personal data.

Commercial Code

23Article 8 of the Komerclikums (Commercial Code), headed ‘Content of entries in the commercial register’, provides, in points 3 and 4 of paragraph 3:(3)The information concerning a capital company to be entered in the commercial register is listed below:…3) the surname, first name, personal identification number (in the absence of a personal identification number, the date of birth, the number and date of issue of the identity document, the country and the authority which issued that document) and the position held by the members of the management board of the capital company and the members of the supervisory board (where the capital company has such a board);4) the power of the members of the management board to bind the company individually or jointly;…’

24Article 12 of that code, headed ‘Publication in the commercial register’, is worded as follows:(1) Entries in the commercial register may be relied on as against third parties once they have been published. ……’

25Article 235 of that code, headed ‘Information to be entered in the register of shareholders’, provides:(1)Each entry in the register of shareholders shall indicate the company name, registration number, legal address and, where applicable, information about whether that company is subject to liquidation or insolvency proceedings, as well as the title of the document, “Entry in the register of shareholders”, and shall contain the following information:1) the reference number and date of the entry;2) the reference number of the registration, using consecutive numbering from the first entry in the register of shareholders;3) the reference numbers relating to the shares;4) data relating to shareholders:a) for a natural person, the surname, first name, personal identification number (in the absence of a personal identification number, the date of birth, the number and date of issue of the identity document, the country and the authority which issued that document) and the address at which the person can be contacted;b) for legal persons and partnerships, the name, registration number and legal address;5) the shareholder’s email address, if the shareholder has requested that it be used by the company to communicate with him, her or it;6) the class, number and nominal value of the shares of each shareholder, and the number of votes attaching to them;7) the status relating to the payment of shares;8) the joint representative of the shareholders appointed in accordance with the procedure laid down in Article 157 of this code, indicating the information referred to in points 4 and 5 of paragraph 1 of this Article;9) information on shares acquired by the company itself, providing reasons for their acquisition.…’

26As set out in Article 268 of that code, headed ‘Powers of the general meeting of shareholders’:(1)Only the general meeting of shareholders shall have the right to take decisions concerning:1) the annual accounts of the company;2) the use of profits from the previous financial year;3) the election and dismissal of members of the supervisory board, auditors and liquidators;4) the bringing of an action against the members of the management board, the supervisory board and the auditor, or the waiver of such an action, and the appointment of a representative of the company to pursue actions against the members of the supervisory board;…6) amendments to the company’s articles of association;7) the increase or reduction of share capital;8) the issue and conversion of the company’s securities and the central securities depository in which the company’s dematerialised shares are registered;9) the determination of the remuneration of members of the supervisory board and of the auditor;10) the cessation, continuation, suspension or renewal of the company’s activities or the reorganisation of the company;11) the general principles, types and criteria for determining the remuneration of members of the management and supervisory boards;12) the allocation of company shares to employees and members of the management and supervisory boards.(2) The general meeting of shareholders shall take decisions on other matters only if provided for by law.’

The Law on the Companies Register

27Article 4.¹⁰ of the likums ‘Par Latvijas Republikas Uzņēmumu reģistru’ (Law on the Companies Register of the Republic of Latvia; ‘Law on the Companies Register’), headed ‘Right of access to information in the Companies Register’, provides, in the fifth paragraph thereof, as follows:‘The companies register shall provide the information and documents contained in the public part of the registration file (first paragraph of Article 4.¹⁵) free of charge by way of online data transmission (including bulk downloading).’

28Article 4.¹¹ of that law, headed ‘Information to be published on the website of the companies register’, provides, in point 2 of the first paragraph thereof:‘The companies register shall ensure that an unidentified user has public access to the following most recent (up-to-date) information on its website concerning legal persons and legal facts recorded in the registers maintained by the companies register:…2) other information entered in the register.’

29Article 4.¹⁵ of that law, headed ‘Public and non-public parts of the registration file’, provides:‘The public part of the registration file shall include:…2) other information entered in the register.…b) information from the entry in the register of shareholders (members) of a capital company concerning the shareholders (members) of that company ……3) the following documents forming part of the registration file:(a) in the commercial register – … the entry in the register of shareholders (members), …The documents and information that form part of the registration file and are not referred to in the first paragraph of this Article shall be included in the non-public part of the registration file.Where an entry in the register or registered information has been given the status of restricted information or its availability to the public has been restricted by legislation, it shall be included in the non-public part of the registration file.The information and documents included in the non-public part of the registration file (paragraphs 2 and 3 of this Article) are restricted information and may be obtained by law enforcement authorities for the performance of tasks specified in laws and regulations, as well as, without restrictions, by the Finanšu izlūkošanas dienests [(Financial Intelligence Unit)] and supervisory and control authorities in the field of the prevention of money laundering and terrorism and proliferation financing, while other authorities must submit a reasoned request. Individuals shall request access to the information and documents contained in the non-public part of the registration file in accordance with the procedure for requesting restricted information provided for in the Informācijas atklātības likums [(Law on Freedom of Information)].’

The Law on the Prevention of Money Laundering

30Article 5.¹ of the Noziedzīgi iegūtu līdzekļu legalizācijas un terorisma un proliferācijas finansēšanas novēršanas likums (Law on the prevention of money laundering and the financing of terrorism and proliferation; ‘the Law on the Prevention of Money Laundering’), headed ‘Accessibility of the information necessary for compliance with the requirements of the Law, derived from the information systems of the Republic of Latvia’, states, in paragraph 1 thereof:‘In order to comply with their obligations under this Law, obliged entities and supervisory and control authorities shall be entitled to request and obtain online records and information concerning members and beneficial owners contained in the registers maintained by the register of companies of the Republic of Latvia, to retain and otherwise process such information for the purpose of assessing data relating to the customer and its business partners and the need to report a suspicious transaction to the Financial Intelligence Unit or to refrain from carrying out such a transaction, as well as to determine whether insolvency proceedings against legal persons or legal protection proceedings have been initiated in respect of the customer.’

The Law on International and National Sanctions

31Article 5 of the Starptautisko un Latvijas Republikas nacionālo sankciju likums (Law on International and National Sanctions of the Republic of Latvia; ‘the Law on International and National Sanctions’), headed ‘Financial restrictions’, provides:‘Where national sanctions impose financial restrictions on a sanctioned person, all persons shall, within the scope of their competence, be required, immediately and without prior notice, to:1) freeze all funds and economic resources that are, directly or indirectly, wholly or in part, owned, possessed, held or controlled by the sanctioned person, including by third parties acting on that person’s behalf or under that person’s direction;2) refrain from making funds or economic resources available, directly or indirectly, to or for the benefit of the sanctioned person, including to third parties acting on that person’s behalf or under that person’s direction;3) refrain from providing financial services as covered by national sanctions to or for the benefit of the sanctioned person, including to third parties acting on that person’s behalf or under that person’s direction.’

The dispute in the main proceedings and the questions referred for a preliminary ruling

32Seventeen natural persons have brought an action before the Satversmes tiesa (Constitutional Court), which is the referring court, challenging the compatibility with Article 96 of the Constitution of the Republic of Latvia – which guarantees the right to respect for private life and the protection of personal data – of national legislation, specifically point 2(b) of the first subparagraph of Article 4.¹⁵ of the Law on the Companies Register, read in conjunction with the fifth subparagraph of Article 4.¹⁰ of that law and Article 235(1) of the Commercial Code.

33Under that legislation, certain information relating to the shareholders of public limited liability companies is to be made available to the public. If such a shareholder is a natural person, that information is to include the surname, first name, personal identification number or, in the absence of such a number, the date of birth, the number and date of issue of an identity document, the country and issuing authority, and the address at which the shareholder can be contacted. In addition, and regardless of whether the shareholder is a natural person, that information is also to include the shareholder’s email address, where the shareholder has requested that it be used by the company in which it holds shares to communicate with them, the class, number and nominal value of their shares, as well as the number of votes attaching to them. The same information is to be available online and may be downloaded in bulk, including by any unidentified user, as provided for in point 2 of the first subparagraph of 4.¹¹ of the Law on the Companies Register.

34The applicants in the main proceedings are minority shareholders of a public limited liability company. They are arguing that the Latvian legislature neither examined nor justified the need to disclose the information concerned to the public, it being noted that, once disclosed, it is no longer possible to place any restrictions on its subsequent use and there is a high risk of it being used for dishonest purposes. They contend that, in any event, in the light of the judgment of 22 November 2022, Luxembourg Business Registers (C‑37/20 and C‑601/20, EU:C:2022:912; ‘the judgment in Luxembourg Business Registers’), the disclosure of that information is unjustified and disproportionate, in view of the fact that the applicants in the main proceedings are neither the beneficial owners of the company concerned nor members of its management bodies, and that they have neither the right nor the option to exercise control over that company.

35In that regard, the referring court is seeking clarification, first, as to whether the disclosure of the personal data at issue before that court is required under Directive 2017/1132 and, in particular, Article 14(d)(ii) thereof, which refers to documents and particulars concerning persons who take part in the administration, supervision or control of the company. If so, the referring court considers that it would be necessary to assess the validity of such a disclosure requirement in the light of Articles 7 and 8 of the Charter.

36Second, that court is uncertain whether a Member State may, without infringing the provisions of the GDPR, in particular Article 5(1) thereof, and those of the Charter, provide in its national law for such a disclosure requirement in order to achieve objectives such as those put forward by the Latvijas Republikas Saeima (Latvian Parliament), namely, first, to ensure a transparent business environment and protect the interests of third parties, second, to prevent money laundering and the financing of terrorism and the proliferation of weapons of mass destruction, and, third, to provide the information necessary for the implementation of national, international and EU sanctions. In that context, the referring court notes that access to the data at issue is not subject to any condition such as, inter alia, demonstrating a legitimate interest.

37In those circumstances, the Satversmes tiesa (Constitutional Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:(1) Must the concept of persons who “take part in the administration, supervision or control of the company”, used in Article 14(d) of Directive 2017/1132, be interpreted as referring to any shareholder in a public limited liability company, with the result that a Member State is obliged to disclose the information relating to every shareholder in a public limited company and make it publicly available in the register in accordance with Article 16(3) of Directive 2017/1132?(2) If the first question is answered in the affirmative, is Article 14(d)(ii) of Directive 2017/1132, in so far as it provides for the disclosure of particulars relating to every shareholder in a public limited liability company, valid in the light of the right to respect for private and family life guaranteed by Article 7 of the Charter and the right to the protection of personal data guaranteed by Article 8 thereof?(3) Must Article 5(1)(b) of the [GDPR] be interpreted as meaning that processing the personal data of shareholders in a public limited liability company may serve the purpose, in the first place, of ensuring a transparent business environment and protecting the interests of third parties; in the second place, of preventing money laundering and [terrorist and proliferation financing]; and, in the third place, of providing the information necessary for the enforcement of national, international and [EU] sanctions?(4) Do the principles established in Article 5(1) of the [GDPR] allow for the establishment, in the interests of those purposes, of national legislation under which any person may obtain the personal data of any shareholder in a public limited liability company without being obliged to demonstrate a legitimate interest in obtaining such data?’

Consideration of the questions referred

The first question

38By its first question, the referring court asks, in essence, whether Article 14(d) of Directive 2017/1132 must be interpreted as requiring the disclosure of information relating to all the shareholders of the companies covered by that provision, including the minority shareholders of such companies.

39Under that provision, which applies to the types of company referred to in Article 13 of Directive 2017/1132, namely those listed in Annex II to that directive, Member States are to take the measures required to ensure compulsory disclosure by those companies of at least the documents and particulars relating to the appointment, termination of office and particulars of the persons who either as a body constituted pursuant to law or as members of any such body, are authorised to represent the company in dealings with third parties and in legal proceedings, or who take part in the administration, supervision or control of the company.

40In that regard, it should be borne in mind that, in accordance with settled case-law, the terms of a provision of EU law which makes no express reference to the law of the Member States for the purpose of determining its meaning and scope must normally be given an independent and uniform interpretation throughout the European Union, having regard not only to the wording of that provision but also to its context and the objectives pursued by the rules of which it is part (see, to that effect, judgments of 18 January 1984, Ekro, 327/82, EU:C:1984:11, paragraph 11, and of 18 December 2025, Slagelse Almennyttige Boligselskab, Afdeling Schackenborgvænge, C‑417/23, EU:C:2025:1017, paragraph 76).

41As regards the wording of Article 14(d) of Directive 2017/1132, it should be noted that that provision does not expressly refer either to shareholders or to the general meeting of shareholders. In addition, that provision refers to the ‘appointment’, ‘termination of office’ and ‘particulars’ of the persons who either as a body constituted pursuant to law or as members of such a body, are authorised to represent the company in dealings with third parties and in legal proceedings and/or take part in the administration, supervision or control of the company. As the Latvian and Polish Governments, the European Parliament, the Council of the European Union and the European Commission have pointed out in their written observations, the shareholders of a company are neither appointed nor removed from office. Their status derives solely from their participation in the company’s share capital, that is to say, from their ownership of shares issued by that company, and is distinct, in that respect, from that of the persons appointed to sit on the company’s administrative and management bodies and to represent it in its dealings with third parties.

42As regards the context of that provision, it should be noted that several provisions of Directive 2017/1132, such as Article 64(3) and Article 95(2) of that directive, reflect the terminological distinction drawn by the EU legislature between, on the one hand, the administrative and management bodies, and, on the other, the general meeting of shareholders. Thus, although that general meeting has certain decision-making powers, those powers are not of the same nature as those exercised by the company’s administrative and management bodies, with the result that neither the acts of the general meeting nor, through it, those of its members, can be regarded as constituting ‘taking part’ within the meaning of Article 14(d)(ii) of that directive.

43Furthermore, while Article 14(a) of Directive 2017/1132, which is to be read in conjunction with Article 4(i) of that directive, requires disclosure of the instrument of constitution and the statutes of a public limited liability company, those documents being required to state the identity of their signatories, including, where applicable, the company’s initial shareholders, no provision of that directive expressly requires disclosure of any subsequent change in the composition of the shareholders of such a company.

44As regards the objectives pursued by Directive 2017/1132, it follows from recitals 7 and 8 and from Article 1 of that directive that the purpose of the disclosure provided for by that directive is to protect in particular the interests of third parties in relation to companies limited by shares and limited liability companies, since the only safeguards they offer to third parties are their assets. To that end, the basic documents of a company should be disclosed in order for third parties to be able to ascertain their contents and other information concerning the company, especially particulars of the persons who are authorised to bind the company (see, to that effect, judgment of 4 October 2024, Agentsia po vpisvaniyata, C‑200/23, EU:C:2024:827, paragraph 77).

45Furthermore, the purpose of that directive is to guarantee legal certainty in relation to dealings between companies and third parties in view of the intensification of trade between Member States following the creation of the internal market. With that in mind, it is important that any person wishing to establish and develop trading relations with companies situated in other Member States should be able easily to obtain essential information relating to the constitution of trading companies and to the powers of persons authorised to represent them, which requires that all the relevant information should be expressly included in the register referred to in Article 16(3) of that directive (see, to that effect, judgment of 4 October 2024, Agentsia po vpisvaniyata, C‑200/23, EU:C:2024:827, paragraph 78 and the case-law cited).

46However, in the present case, the disclosure of data relating to all the shareholders of public limited liability companies and, in particular, to their minority shareholders does not appear to serve any useful purpose in the light of the objective of protecting the interests of third parties and legal certainty, and cannot therefore be justified by that objective. Since minority shareholders are not, in principle, authorised to represent a public limited liability company, to bind it vis-à-vis third parties, or to perform management and supervisory functions, unlike members of the administrative and management bodies of such a company, the data relating to all those shareholders appear to be irrelevant to those third parties.

47Consequently, the answer to the first question is that Article 14(d) of Directive 2017/1132 must be interpreted as not requiring the disclosure of information relating to all the shareholders of the companies covered by that provision, including the minority shareholders of such companies.

The second question

48In view of the answer given to the first question, it is not necessary to answer the second question.

The third and fourth questions

49By the third and fourth questions, which it is appropriate to deal with together, the referring court asks, in essence, whether Articles 5 and 6 of the GDPR, read in the light of Articles 7 and 8 of the Charter, must be interpreted as precluding national legislation which requires personal data relating to all shareholders, including minority shareholders, of public limited liability companies relating to the identity and contact details of each shareholder, the class, number and nominal value of the shares held by that shareholder, and the number of votes attaching to those shares, to be made available to the public in order to ensure a transparent business environment so as to protect the interests of third parties, prevent money laundering and the financing of terrorism and the proliferation of weapons of mass destruction, and provide the information necessary for the implementation of national, international and EU sanctions, where access to such data is not subject to any conditions, such as demonstrating a legitimate interest.

50As a preliminary point, it should be borne in mind that, in accordance with the objective pursued by the GDPR, as set out in Article 1 and recitals 1 and 10 of that regulation, consisting in, inter alia, ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal data, as enshrined in Article 8(1) of the Charter and Article 16(1) TFEU, any processing of personal data must, inter alia, comply with the principles relating to the processing of personal data as set out in Article 5 of the GDPR and satisfy the lawfulness conditions listed in Article 6 of that regulation (see, to that effect, judgments of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraphs 21 and 22, and of 3 April 2025, Ministerstvo zdravotnictví (Data concerning the representative of a legal person), C‑710/23, EU:C:2025:231, paragraphs 29 and 33).

51In that regard, it should be noted that Article 5(1)(a) of the GDPR provides that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

52In addition, under Article 5(1)(b) of the GDPR, which sets out the principle of purpose limitation of the processing of personal data, such data must be, first, collected for specified, explicit and legitimate purposes and, second, not further processed in a manner that is incompatible with those purposes. In accordance with the case-law of the Court, that principle requires, first of all, that the purposes of the processing be identified at the latest at the time of the collection of the personal data, next, that the purposes of that processing be clearly stated and, lastly, that the purposes of that processing guarantee, inter alia, the lawfulness of the processing of those data, within the meaning of Article 6(1) of the GDPR (see, to that effect, judgment of 20 October 2022, Digi, C‑77/21, EU:C:2022:805, paragraph 27 and the case-law cited).

53Lastly, under Article 5(1)(c) of the GDPR, which enshrines the principle of data minimisation, those data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. That principle gives expression to the principle of proportionality (see, to that effect, judgment of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 24 and the case-law cited).

54As regards the conditions for lawful processing, the first subparagraph of Article 6(1) of the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful. Thus, in order to be capable of being regarded as such, processing must fall within one of the cases provided for in that provision (see, to that effect, judgment of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 25 and the case-law cited).

55Under point (a) of the first subparagraph of Article 6(1) of the GDPR, the processing of personal data is lawful if and to the extent that the data subject has given consent for one or more specific purposes. In the absence of such consent, or where that consent is not freely given, specific, informed and unambiguous, within the meaning of Article 4(11) of the GDPR, such processing is nevertheless justified where it meets one of the requirements of necessity mentioned in points (b) to (f) of the first subparagraph of Article 6(1) of the GDPR. In that context, the justifications provided for in that latter provision, in so far as they allow the processing of personal data carried out in the absence of the data subject’s consent to be made lawful, must be interpreted restrictively (judgment of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 26 and 27 and the case-law cited).

56Furthermore, according to the case-law of the Court, where it can be found that the processing of personal data is necessary in respect of one of the justifications provided for in points (b) to (f) of the first subparagraph of Article 6(1) of the GDPR, it is not necessary to determine whether that processing also falls within the scope of another of those justifications (judgment of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 28 and the case-law cited).

57In the present case, it is common ground that the information at issue in the main proceedings relates to identified or identifiable natural persons and that it must therefore be classified as personal data, within the meaning of Article 4(1) of the GDPR. It is also common ground that that information is subject to processing, within the meaning of Article 4(2) of the GDPR, in so far as it is made available to the public, and that that processing, which is carried out by automated means, comes within the material scope of the GDPR, pursuant to Article 2(1) thereof.

58Furthermore, as the Advocate General observed, in essence, in point 43 of his Opinion, the processing of the data at issue in the main proceedings is required by national legislation and must therefore be examined in the light of point (c) of the first subparagraph of Article 6(1) of the GDPR, according to which processing is lawful if and to the extent that it is ‘necessary for compliance with a legal obligation to which the controller is subject’.

59Article 6(3) of the GDPR states, inter alia, that, in such circumstances, the processing must be based on EU law or on Member State law to which the controller is subject, and that the purpose of the processing is to be determined in that legal basis, which must meet an objective of public interest and be proportionate to the legitimate aim pursued. Since those requirements constitute an expression of the requirements arising from Article 52(1) of the Charter, they must be interpreted in the light of the latter provision (see, to that effect, judgments of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20, EU:C:2022:601, paragraph 69, and of 4 October 2024, Agentsia po vpisvaniyata, C‑200/23, EU:C:2024:827, paragraph 104).

60In that regard, it should be noted that the fundamental rights to respect for private life and to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter, are not absolute rights, but must be considered in relation to their function in society and be weighed against other fundamental rights. Limitations may therefore be imposed, so long as, in accordance with Article 52(1) of the Charter, they are provided for by law, respect the essence of the fundamental rights and observe the principle of proportionality (judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 105; of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20, EU:C:2022:601, paragraph 70; and of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 85 and the case-law cited).

61In that context, it should be recalled that, in accordance with settled case-law, the proportionality of the measures which result in interference with the rights guaranteed in Articles 7 and 8 of the Charter requires compliance not only with the requirements of appropriateness and of necessity but also with that of the proportionate nature of those measures in relation to the objective pursued (the judgment in Luxembourg Business Registers, paragraph 63 and the case-law cited).

62More specifically, derogations from and limitations on the protection of personal data should apply only in so far as is strictly necessary, it being understood that where there is a choice between several measures appropriate to meeting the legitimate objectives pursued, recourse must be had to the least onerous. In addition, an objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure chosen, by properly balancing the objective of general interest against the rights at issue, in order to ensure that the disadvantages caused by that measure are not disproportionate to the aims pursued. Thus, the possibility of justifying a limitation of the rights guaranteed in Articles 7 and 8 of the Charter must be assessed by measuring the seriousness of the interference entailed by such a limitation and by verifying that the importance of the public interest objective pursued by that limitation is proportionate to that seriousness (the judgment in Luxembourg Business Registers, paragraph 64 and the case-law cited).

63Furthermore, in order to satisfy the proportionality requirement, the legislation in question entailing the interference must also lay down clear and precise rules governing the scope and application of the measures provided for and imposing minimum safeguards, so that data subjects have sufficient guarantees effectively to protect their personal data against the risk of abuse. It must, in particular, indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted, thereby ensuring that the interference is limited to what is strictly necessary (see, to that effect, the judgment in Luxembourg Business Registers, paragraph 65 and the case-law cited).

64In the present case, it is for the referring court to ascertain, in the first place, whether the national legislation at issue in the main proceedings complies with the principle of purpose limitation, set out in Article 5(1)(b) of the GDPR, in the light of the case-law referred to in paragraph 52 above, and whether the purposes of the processing are determined in the relevant legal basis, within the meaning of Article 6(3) of the GDPR. As the Advocate General observed in point 45 of his Opinion, in that regard, it is important that the purpose(s) in question may be ascertained with sufficient certainty from the wording of the legislation concerned or from its legislative context.

65In the second place, it must be ascertained whether that legal basis satisfies the other requirements arising from Article 6(3) of the GDPR and Article 52(1) of the Charter, in the light of the settled case-law referred to in paragraphs 59 to 63 of the present judgment and taking into consideration the seriousness of the interference with the rights guaranteed by Articles 7 and 8 of the Charter resulting from that legal basis.

66While it is ultimately for the referring court to ascertain whether those other requirements are satisfied, it is for the Court of Justice, when giving a preliminary ruling on a reference, to provide the referring court with all the points of interpretation of EU law which may be of assistance in adjudicating on the case pending before it and, where appropriate, to give clarification intended to guide the referring court in its examination (see, to that effect, judgments of 27 June 2017, Congregación de Escuelas Pías Provincia Betania, C‑74/16, EU:C:2017:496, paragraph 36 and the case-law cited, and of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 51).

67In that regard, as is apparent from the settled case-law of the Court, the communication of personal data to a third party, including the making available of such data, constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, whatever the subsequent use of the information communicated. In that regard, it does not matter whether the information in question relating to private life is sensitive or whether the persons concerned have been inconvenienced in any way on account of that interference (see, to that effect, judgment of 21 June 2022, Ligue des droits humains, C‑817/19, EU:C:2022:491, paragraph 96, and the judgment in Luxembourg Business Registers, paragraph 39).

68In the present case, although the national legislation at issue in the main proceedings specifically lists the personal data which must be made available to the public, with the result that the resulting interference is provided for by law, it is still necessary, first, to measure the seriousness of that interference and, second, to examine whether the importance of the objectives of general interest purportedly pursued is proportionate to that seriousness (see, to that effect, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20, EU:C:2022:601, paragraph 98).

69Thus, first, as regards the seriousness of that interference, account must be taken, inter alia, of the nature of the personal data at issue, in particular of any sensitivity of those data, and of the nature of, and specific methods for, the processing of the data at issue, in particular of the number of persons having access to those data and the methods of accessing them (judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20, EU:C:2022:601, paragraph 99 and the case-law cited).

70In the present case, it should be noted that, in so far as the data made available to the public relate in particular to the identity of each shareholder, his or her contact details, the class, number and nominal value of the shares held by each shareholder and the number of votes attaching to those shares, that data is capable of enabling a profile to be drawn up concerning, inter alia, the state of the wealth of the person concerned and the economic sectors and specific undertakings in which he or she has invested (see, to that effect, the judgment in Luxembourg Business Registers, paragraph 41).

71In addition, it is inherent in making those data available in such a manner that those data are then accessible to a potentially unlimited number of persons, with the result that their processing is liable to enable those data to be freely accessed also by persons who, for reasons unrelated to the objective pursued by making those data available, seek to find out about, inter alia, the material and financial situation of such a shareholder. That possibility is all the easier when that data can be consulted on the internet (see, to that effect, the judgment in Luxembourg Business Registers, paragraph 42 and the case-law cited).

72Furthermore, the potential consequences for the data subjects resulting from possible abuse of their data are exacerbated by the fact that, once those data have been made available to the public, they can not only be freely consulted, but also retained and disseminated and that, in the event of such successive processing, it becomes increasingly difficult, or even illusory, for those data subjects to defend themselves effectively against abuse (see, to that effect, the judgment in Luxembourg Business Registers, paragraph 43).

73Therefore, while it does not undermine the essence of the rights guaranteed by Articles 7 and 8 of the Charter, the making available to the public of the data at issue in the main proceedings nevertheless constitutes, in any event, a serious interference with those rights (see, to that effect, the judgment in Luxembourg Business Registers, paragraphs 44 and 54).

74Second, as the Advocate General observed in points 50 to 52 of his Opinion, it should be held that the objectives put forward by the Latvian Parliament before the referring court in order to justify the measure provided for by the national legislation at issue in the main proceedings and recalled in paragraph 49 of the present judgment may be classified as objectives of general interest recognised by the European Union. It is necessary, however, to examine whether national legislation such as that at issue in the main proceedings complies not only with the requirements of appropriateness and of necessity, but also with that of the proportionate nature of the measure in relation to the objectives pursued, within the meaning of paragraph 61 of the present judgment.

75As regards the objective of general interest consisting in ensuring a transparent business environment in order to protect the interests of third parties, it should be noted that that objective appears to correspond, in essence, to the objective pursued by the coordination of national provisions provided for in Article 14(d) of Directive 2017/1132, read in the light of recitals 7 and 8 thereof.

76However, as is apparent from paragraph 46 above, the disclosure of data relating to all the shareholders of a public limited liability company and, in particular, to its minority shareholders does not appear to serve any useful purpose in the light of that objective. Consequently, national legislation such as that at issue in the main proceedings does not appear to be either appropriate or necessary to attain that objective and cannot, therefore, justify the serious interference with the rights guaranteed by Articles 7 and 8 of the Charter, referred to in paragraph 73 of the present judgment.

77As regards the objective of general interest consisting in preventing money laundering and the financing of terrorism and proliferation of weapons of mass destruction, it must be held that the public’s access to the data concerned is capable of contributing to the attainment of that objective, owing to the fact that the public nature of that access and the increased transparency resulting therefrom contribute to the creation of an environment less likely to be used for such purposes (see, to that effect, the judgment in Luxembourg Business Registers, paragraph 67).

78However, such access cannot be regarded as strictly necessary where that objective can reasonably be achieved just as effectively by other means less restrictive of the rights guaranteed by Articles 7 and 8 of the Charter (see, to that effect, judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 87).

79Combating money laundering and the financing of terrorism and the proliferation of weapons of mass destruction is as a priority a matter for the public authorities and for entities such as credit or financial institutions which, by reason of their activities, are subject to specific obligations in that regard (the judgment in Luxembourg Business Registers, paragraph 83), such as those arising, inter alia, from Articles 11 and 13 of Directive 2015/849.

80In that context, it must be observed that Article 30(5) of Directive 2015/849, the wording of which is derived from Article 74(1) of Directive 2024/1640, provides that Member States are to ensure that the information on beneficial ownership, within the meaning of that provision, is accessible in all cases, inter alia, ‘to any person or organisation that can demonstrate a legitimate interest’, and not to the public as a whole.

81In that regard, it should also be noted that, in accordance with the case-law of the Court, legislation under which, for the purpose of pursuing the objective referred to in paragraph 77 of the present judgment, access to personal data is granted to members of the public who can demonstrate a legitimate interest is, in principle, capable of limiting the interference with the rights guaranteed in Articles 7 and 8 of the Charter to what is strictly necessary (see, to that effect, judgment of 21 May 2026, Across Fiduciaria and Others, C‑684/24 and C‑685/24, EU:C:2026:410, paragraph 106).

82However, in the present case, as regards minority shareholders who do not have the status of beneficial owners of the company in which they hold part of the share capital, it does not therefore appear, a fortiori, to be strictly necessary for personal data such as those at issue in the main proceedings to be accessible to any person, without that person being required to demonstrate a legitimate interest.

83In such circumstances, although the referring court indicates that the national companies register, which is the data controller, might not be in a position to determine whether each person requesting information does in fact have a legitimate interest in accessing the personal data concerned, it should be borne in mind that any practical difficulties associated with verifying the existence of a legitimate interest are not such as to demonstrate that an interference with the fundamental rights guaranteed by the Charter is strictly necessary (see, by analogy, judgments of 26 September 2000, Commission v Austria, C‑205/98, EU:C:2000:493, paragraph 78 and the case-law cited, and of 27 November 2008, Papillon, C‑418/07, EU:C:2008:659, paragraph 54 and the case-law cited).

84As regards the need to strike a fair balance between, on the one hand, the objective of general interest pursued and, on the other, the fundamental rights at issue, it should be added that, while combating money laundering and the financing of terrorism and the proliferation of weapons of mass destruction might, in general, be capable of justifying interference, even serious interference, with those rights (see, to that effect, the judgment in Luxembourg Business Registers, paragraphs 58 and 59), that objective cannot, in the present case, take precedence over those rights, having regard to the nature and seriousness of the interference identified in paragraph 73 of the present judgment.

85In that context, it should be noted, moreover, that national legislation such as that at issue in the main proceedings is not accompanied by sufficient safeguards to protect data subjects effectively against the risk of abuse, within the meaning of the case-law referred to in paragraph 63 of the present judgment. Indeed, their personal data are accessible on the internet and may be downloaded in bulk, including by any unidentified user, which increases such risks.

86Consequently, national legislation such as that at issue in the main proceedings does not appear to be either necessary or proportionate in relation to the objective concerned, within the meaning of paragraph 61 of the present judgment.

87Lastly, as regards the objective of general interest consisting in providing the information necessary for the implementation of national, international and EU sanctions, national legislation such as that at issue in the main proceedings is also capable of contributing to the attainment of that objective. Indeed, it must be stated that the increased transparency resulting from that legislation is such as to facilitate the implementation of those sanctions.

88Nevertheless, as the Advocate General observed, in essence, in points 60 and 61 of his Opinion, public access to the data at issue in the main proceedings does not appear to be strictly necessary for that purpose, since means less prejudicial to the rights guaranteed by Articles 7 and 8 of the Charter appear to be available.

89As the Commission stated in its written observations, such less prejudicial means might include restricting the disclosure requirement solely to data relating to persons included on sanctions lists and in allowing access to data relating to shareholders not included on those lists only to persons who are able to demonstrate a legitimate interest in that regard.

90Furthermore, for the same reasons as those referred to in paragraphs 84 and 85 above, respectively, the objective of general interest pursued cannot, in the present case, take precedence over the fundamental rights at issue and national legislation such as that at issue in the main proceedings does not contain sufficient safeguards to protect data subjects effectively against the risk of abuse.

91Thus, such legislation does not appear to be either necessary or proportionate in relation to the objective concerned, within the meaning of paragraph 61 of the present judgment.

92Consequently, in the light of the foregoing considerations, the answer to the third and fourth questions is that Articles 5 and 6 of the GDPR, read in the light of Articles 7 and 8 of the Charter, must be interpreted as precluding national legislation which requires personal data relating to all the shareholders, including minority shareholders, of public limited liability companies relating to the identity and contact details of each shareholder, the class, number and nominal value of the shares held by that shareholder, and the number of votes attaching to those shares, to be made available to the public in order to ensure a transparent business environment so as to protect the interests of third parties, prevent money laundering and the financing of terrorism and the proliferation of weapons of mass destruction, and provide the information necessary for the implementation of national, international and EU sanctions, where access to such data is not subject to any conditions, such as demonstrating a legitimate interest.

Costs

93Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

Operative part

On those grounds, the Court (First Chamber) hereby rules:

1.Article 14(d) of Directive (EU) 2017/1132 of the European Parliament and of the Council of 14 June 2017, on certain aspects of company law, as amended by Directive (EU) 2019/1151 of the European Parliament and of the Council of 20 June 2019,must be interpreted as not requiring the disclosure of information relating to all the shareholders of the companies covered by that provision, including the minority shareholders of such companies.

2.Articles 5 and 6 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union,must be interpreted as precluding national legislation which requires personal data relating to all the shareholders, including minority shareholders, of public limited liability companies relating to the identity and contact details of each shareholder, the class, number and nominal value of the shares held by that shareholder, and the number of votes attaching to those shares, to be made available to the public in order to ensure a transparent business environment so as to protect the interests of third parties, prevent money laundering and the financing of terrorism and the proliferation of weapons of mass destruction, and provide the information necessary for the implementation of national, international and EU sanctions, where access to such data is not subject to any conditions, such as demonstrating a legitimate interest.