Right to Privacy vs. Corporate Transparency: The Controversy Over Beneficial Ownership Registration

The registration of beneficial owners and the obligations it entails have been the subject of heated debate and controversy in the Czech legal environment since their introduction. One of the main points of criticism has been the public accessibility of the register, which makes the personal data of beneficial owners available to anyone. Recently, the Czech legal community has been stirred by decisions of the highest courts: the Supreme Administrative Court and, subsequently, the Supreme Court. Referring to a CJEU ruling[1], both courts found that the current legal framework for the beneficial ownership register amounts to an impermissible interference with the right to private life and the right to personal data protection.

Briefly about the registration of beneficial owners

The Beneficial Ownership Register (“Register”) is one of the key tools of the European Union and, by extension, of its Member States in the fight against money laundering and terrorist financing. The Czech Act on the Registration of Beneficial Owners (“Act”),[2] which implements the EU AML Directive[3], entered into force on 1 June 2021 and introduced obligations into the Czech legal system not only for registrants but also for other entities.

Section 9 of the Act requires registering entities (typically legal persons) to ensure that the information recorded in the Register about their beneficial owners, i.e. the individuals who ultimately own or control them, is accurate and up-to-date. Under Section 14 of the Act, the Ministry of Justice must then make certain data publicly available on its website. This includes the beneficial owner’s name, country of residence, year and month of birth, nationality, and their position within the registering entity.

Failure to comply with the obligation to enter and maintain up-to-date data in the Register may lead to the administrative authority imposing a fine on the registering entity.[4] Equally important, however, are the private law sanctions: if the beneficial owner of a company is not entered in the Register, or if an intermediary corporation does not have a duly registered beneficial owner, that person may not exercise voting rights in the decision-making of the company’s supreme bodies. In addition, they are not entitled to receive any share of profits, other equity, or liquidation proceeds[5]. 

Violation of the rights to private life and personal data protection

As early as 2022, the Court of Justice of the European Union (CJEU) declared[6] invalid a provision of the AML Directive that granted the general public unrestricted access to data from the beneficial ownership register, finding it incompatible with the Charter of Fundamental Rights of the European Union. The CJEU specifically held that such broad accessibility of registered data violated beneficial owners’ right to private life (Article 7) and the right to the protection of personal data (Article 8).

Although the CJEU acknowledged that the objective of the regulation – namely, combating money laundering and terrorist financing – is legitimate, it concluded that making information on beneficial owners accessible to the general public is not necessary to achieve that aim. According to the Court, any interference with fundamental rights that is not strictly necessary is impermissible. As a result, the provision of the AML Directive[7] interfering with the rights to private life and personal data protection should be declared invalid. In response to this judgment, the EU subsequently adopted a new directive which, among other things, amended Article 30(5) of the AML Directive to require that any person seeking access to data from the beneficial ownership register must demonstrate a legitimate interest.[8]

No response from the legislator yet 

Although some time has passed since the CJEU’s ruling, the Czech legislator has not yet taken any steps to address it. As a result, Czech law continues to mirror the very situation that the CJEU found to be incompatible with the fundamental rights of beneficial owners.

Reaction of the Czech Supreme Courts

Even though the law itself has not yet been amended, Czech courts are already taking the CJEU’s decision into account in their rulings. In March of this year, the Supreme Administrative Court[9] dealt with the case of a company fined for failing to enter data in the Register. The court annulled the fine and referred the case back to the Ministry of Justice, as the defendant, for further proceedings.

The Supreme Administrative Court upheld the company’s argument that the Czech legislator’s inaction had placed it in an impossible position: either violate the Act and risk a fine or comply with the law at the expense of infringing the fundamental rights of its beneficial owners. According to the Court, while the company’s failure to comply with the registration obligation did interfere with the legitimate interests of state authorities engaged in combating money laundering, such interests cannot, by themselves, justify an impermissible interference with the constitutionally protected rights of the company’s beneficial owners.

The Supreme Administrative Court found the company’s reasoning justified and held that, under the circumstances, its conduct – although technically in breach of the law – could not be regarded as antisocial and therefore could not justify the imposition of a fine. The Court has taken a similar approach in another, comparable case.[10]

The Supreme Court[11] adopted the same position as the Supreme Administrative Court, expressly referring to the CJEU’s judgment in its decision of 25 August 2025. It stated that “in a situation where, under Section 14(1)(a) of the Act, data on beneficial owners entered in the register are accessible to anyone, Articles 7 and 8 of the Charter of Fundamental Rights of the EU preclude the application of those provisions of national law that require the registering authority to comply with Section 9(1) of the Act.” At the same time, the Court has clarified that only once the Czech legislator adopts new rules in line with European standards can the failure to register beneficial owners be treated as an irregularity and enforced through sanctions or irregularity proceedings.

It is important to stress, however, that this does not relieve the registering entity of its duty to enter beneficial owner information in the Register. What the courts have excluded for now is only the use of sanctions to enforce compliance with this obligation.

Do these conclusions also apply to private law sanctions?

It can be inferred that these conclusions may also extend to private law sanctions provided for under the Act. The open question, however, is how companies themselves will approach situations involving profit distribution or the suspension of voting rights. In practice, it is likely that companies will continue to insist on compliance with the statutory obligation to record beneficial owners in the Register before allowing profit payouts or the exercise of voting rights. A definitive answer on the application of private-law sanctions will therefore probably come only through judicial decisions, where an affected person or beneficial owner challenges a general meeting resolution as invalid.

In conclusion, the authors note that an AML Package has now been adopted at the European level. It consists primarily of (i) Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for money laundering or terrorist financing, and (ii) Directive (EU) 2024/1640 of the European Parliament and of the Council of 31 May 2024 on the mechanisms to be put in place by Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Directive (EU) 2019/1937, and amending and repealing Directive (EU) 2015/849. Among other things, this Directive requires Member States to ensure that data in the Register is accessible only to competent authorities and to persons who can demonstrate a legitimate interest. Member States must implement this Directive into national law by 27 July 2027 at the latest.