The EU balancing act: Is data privacy overtaking transparency?

Finding the balance between transparency and personal data protection has been a constant challenge for governments and regulators across Europe. This has been starkly highlighted over the last three years by legal challenges regarding beneficial ownership registers and debates over press freedom. Having a deep understanding of the extent, quality and availability of information in European jurisdictions is an important element of S-RM’s work. There are two key areas in which S-RM has witnessed shifts in attitude and approach from greater transparency towards the prioritisation of privacy. In this article, Alice Norman examines recent developments in public access to beneficial ownership registers and the ongoing debate across Europe over restrictions on journalistic investigations and the right to information.

Changes in access to beneficial ownership registers

Efforts to enhance transparency around the ownership of corporate entities, land and property have gathered pace across Europe over the past decade, driven by pressure from civil society and policymakers alike. European governments have committed to establishing publicly accessible registers of beneficial ownership, a move intended to strengthen anti-money laundering and counter-terrorist financing regimes by supporting the tracing of complex corporate structures and financial flows. Yet, the implementation of these registers has been uneven, with the quality, accessibility and scope of available information varying significantly from country to country. Progress has been hampered by the logistical challenge of collecting and maintaining accurate data, as well as the technical demands of building platforms that can present such information in a user-friendly manner. For jurisdictions where financial and fiduciary services are key parts of the economy—such as the Channel Islands, Monaco, and the Isle of Man—there is further tension between the push for transparency and the imperative to remain attractive to clients. Data protection laws add another layer of complexity, requiring authorities to weigh demands for openness against legal obligations to safeguard personal information.

Since the ruling, access to existing beneficial ownership registers across much of the EU has been significantly curtailed”

In November 2022, following legal action brought by two plaintiffs against the Luxembourg Business Register, the European Court of Justice delivered a ruling that temporarily halted progress on the implementation of beneficial ownership registers across the EU. The plaintiffs argued that Luxembourg’s publicly accessible beneficial ownership register infringed on their rights to privacy and data protection. In its decision, the court declared that the provisions of the EU’s anti-money laundering directive mandating unrestricted public access to beneficial ownership information were invalid, as such measures constituted disproportionate interference with the rights to private life and personal data enshrined in the EU Charter of Fundamental Rights. The immediate consequence was the suspension of public access to Luxembourg’s beneficial ownership register, a move swiftly mirrored by at least seven other European jurisdictions. Since the ruling, access to existing beneficial ownership registers across much of the EU has been significantly curtailed, with many member states allowing access only to law enforcement agencies, tax authorities, and professionals subject to anti-money laundering obligations. In some cases, access is also granted to those able to demonstrate a legitimate interest, or is subject to the payment of a fee.

A landmark decision

The European Court of Justice’s decision in November 2022 dealt a significant blow to the EU’s transparency agenda, prompting renewed debate over how to best balance personal data protection with the importance of making beneficial ownership information available to those combating financial crime. Despite the setback, the case has sharpened focus on the critical role such information plays for investigative journalists, civil society organisations, and anti-money laundering professionals, a role which was acknowledged by the court itself. Over the past five years, access to beneficial ownership data has repeatedly proven invaluable in tracing illicit financial flows and exposing sanctions evasion, as well as uncovering corruption and safeguarding public funds. The debate now centres on how to reconcile the need for transparency with privacy and security concerns, some of which policymakers may hope has been addressed in new anti-money laundering legislation approved last year.

In May 2024, the Council of the European Union adopted a new package of anti-money laundering legislation, comprising Regulations (EU) 2024/1624 and 2024/1620, alongside Directive (EU) 2024/1640, much of which aims to harmonise the EU’s approach to combating money laundering and terrorist financing, including the establishment of a uniform framework for beneficial ownership reporting. In particular, the legislation provides a more precise definition of beneficial ownership across various corporate structures and sets out detailed procedures for collecting and verifying ownership information. Regulation (EU) 2024/1624, which comes into force in July 2027, places particular emphasis on extended customer due diligence, obliging firms to identify beneficial owners to the fullest extent possible as part of their compliance obligations. The legislation package also outlines the creation of a new Anti-Money Laundering Authority (AMLA) through Regulation (EU) 2024/1620. The Authority will be based in Frankfurt and will oversee the implementation of these rules and directly supervise high-risk financial institutions.

New constraints on freedom of information and investigative journalism

The delicate balance between transparency and privacy has become increasingly difficult to achieve in recent years, particularly in relation to access to information and journalistic freedom. Across Europe, this tension has manifested in both legislative debates and judicial decisions, with the pendulum swinging towards greater restrictions on information flows—often in the name of data protection and individual privacy.

The introduction of the European Media Freedom Act (EMFA), which entered into force in May 2024 and will be fully applicable from August 2025, has brought these issues to the fore at the European level. The EMFA seeks to bolster media pluralism and editorial independence, while ensuring the protection of journalistic sources. The legislation introduces safeguards for the protection of journalistic sources, enhances transparency in media ownership, and aims to shield editorial decision-making from both political and commercial interference. Under the Act, member states are required to ensure that journalists and media outlets can operate free from undue pressure, with explicit prohibitions against compelling journalists to disclose their sources, detaining them, or deploying surveillance software on their devices—except in narrowly defined circumstances justified by overriding public interest.

The scope for state surveillance of journalists was a particularly contentious issue”

During its drafting, the Act came under criticism from journalists and press freedom advocates across the EU who argued that the Act’s protections had been significantly diluted in response to pressure from several national governments. The scope for state surveillance of journalists was a particularly contentious issue, with countries including France, Italy, and Greece reportedly pushing for language that would allow the use of spyware against journalists on broadly defined “national security” grounds. Critics voiced concerns that such provisions could be exploited to target journalists and their confidential sources, especially in cases involving government leaks or sensitive investigations.

Critics voiced concerns that such provisions could be exploited to target journalists and their confidential sources, especially in cases involving government leaks or sensitive investigations.”

The introduction of the Act is timely. Recent investigations by S-RM in jurisdictions including France, Italy and Hungary, for example, have highlighted the need to fully understand the nuances of the media landscape in each country in order to properly analyse the information received. S-RM’s contacts in these specific jurisdictions have underlined the challenges in the media sector, including the concentration of media ownership in the hands of a few well-connected members of the business and political elite, leading to a reduction in the variety of reporting and the subtle suppression of articles and investigations that could clash with the interests of the ultimate owners.

Legge Cartabia in Italy

The Legge Cartabia, named after former Justice Minister Marta Cartabia, is a set of judicial reforms introduced at various points since September 2021, designed to tackle chronic inefficiencies in Italy’s legal system and reduce the country’s backlog of court cases. Central to the reforms is a tightening of controls over the flow of information related to criminal proceedings. Under the new laws, authority to disclose details about ongoing cases is granted solely in the chief prosecutor, and even then, only under two specific conditions: when disclosure is deemed strictly necessary for the continuation of investigations, or when there are compelling reasons of public interest.

Communication regarding legal proceedings is now largely restricted to official statements, with press conferences permitted only in exceptional cases. The intention, according to lawmakers, is to reinforce the presumption of innocence principle by curbing the premature release of information that could lead to individuals under investigation being publicly portrayed as guilty before any formal determination of liability. Critics, however, warn that the measures risk stifling media scrutiny and limiting the public’s right to be informed about matters of significant societal concern.

The law marks a significant change in the way information on legal proceedings is disclosed to the public in Italy. Previously, multiple law enforcement agencies could independently share legal information with journalists and the wider public, whereas now they require authorisation from the chief prosecutor, who serves as the sole point of contact for the media and can decide alone, without any oversight mechanism, what information to share and when. While the law does not explicitly restrict journalistic activity, it complicates reporting by limiting access to sources. Before its enactment, journalists could gather information from a range of sources, including lawyers, police officers, public prosecutors, witnesses, and defendants. Now, all information related to an investigation or legal proceeding must come solely from the chief prosecutor, who has the authority to filter it at the source.

The developments covered above highlight the importance both of conducting due diligence and of carrying out investigations in the right way. The value of networks across sectors and jurisdictions in Europe cannot be overstated, especially when combined with a deep understanding of the public record resources and limitations in each country. Despite the restrictions in place in many EU countries, it is still possible in most cases to trace ownership structures back to their beneficial owner, to gather intelligence on the integrity and reputation of a particular company, and to gain insight into the context and potential outcomes of ongoing legal proceedings.

Written by Alice Norman, Senior Associate, with contributions by Federico Ingretolli, Analyst