CJEU Restricts Unconditional Public Access to Shareholder Data: What Jautiva Means for Cyprus
A new judgment of the Court of Justice of the European Union places important limits on the unrestricted disclosure of shareholders’ personal data and raises significant questions for company-register access regimes across the EU, including Cyprus.
The decision
On 3 September 2026, the Court of Justice of the European Union delivered its judgment in Case C‑798/24 [Jautiva], A and Others v Latvijas Republikas Saeima, ECLI:EU:C:2026:679. The reference came from the Constitutional Court of Latvia and concerned the interaction between Directive (EU) 2017/1132, the GDPR and Articles 7 and 8 of the EU Charter of Fundamental Rights.
The facts
The proceedings arose from a challenge by 17 minority shareholders of a Latvian public limited liability company. Latvian law required extensive shareholder information to be made available online. For natural-person shareholders, the disclosed information included identity and contact details as well as the class, number and nominal value of shares and the voting rights attached to them. The information could also be downloaded in bulk, including by unidentified users.
What the Court decided
The Court held, first, that Article 14(d) of Directive (EU) 2017/1132 does not require disclosure of information relating to all shareholders, including minority shareholders, merely because they hold shares in a company. It then held that Articles 5 and 6 GDPR, read together with Articles 7 and 8 of the Charter, preclude a regime in which extensive personal data concerning shareholders is made available online without conditions such as demonstrating a legitimate interest.
The Court accepted that business transparency, anti-money laundering and counter-terrorist financing, and sanctions enforcement are legitimate public-interest objectives. However, those objectives still have to satisfy the requirements of necessity and proportionality. Unrestricted access by any person was not shown to be strictly necessary where less intrusive mechanisms were available.
Why this matters in Cyprus
The judgment does not automatically invalidate the Cyprus company-law framework. The Latvian system considered by the Court involved particularly extensive personal information, online access and bulk downloading. Nevertheless, the judgment raises an important issue for Cyprus. Sections 105 and 108 of the Companies Law, Cap. 113 regulate the register of members, while the Registrar of Companies currently provides paid electronic access to historic member information through its detailed company search.
Following Jautiva, the key question is not whether corporate transparency should disappear. It is whether access to natural-person shareholder information is designed in a way that is necessary, proportionate and accompanied by adequate safeguards. Relevant issues include the categories of data disclosed, the purpose and identity of the requester, the availability of reusable or bulk data and whether a legitimate-interest test or comparable safeguards are required.
Shareholder information and UBO information are not the same
Jautiva concerns shareholder information. It should not be confused with the separate regime governing beneficial ownership. Cyprus suspended general public access to the Register of Beneficial Owners in November 2022 following the CJEU judgment in Joined Cases C‑37/20 and C‑601/20. That suspension did not remove the obligation of companies and partnerships to identify, file and update beneficial ownership information.
The broader direction of EU law is becoming clearer: corporate transparency remains important, but public disclosure of personal data must be targeted, justified and proportionate. We will continue to monitor any response from the Cyprus Registrar of Companies and further implementation of the EU beneficial-ownership access regime.
This publication is intended as a general legal update and does not constitute legal advice.
