CJEU C-798/24 Jautiva : Public Disclosure of Data and Proportionality

Background of the Dispute and Preliminary Question (C-798/24)

Case Jautiva (C-798/24) stems from a reference for a preliminary ruling submitted by the Constitutional Court of Latvia (Satversmes tiesa). Seventeen minority shareholders of an unlisted public limited liability company challenged Latvian commercial register legislation requiring that detailed personal data on each shareholder—including full name, personal identification number, correspondence address, and the number and value of shares held—be published online with unrestricted public access.

The referring court asked the Court of Justice about the relationship between Directive (EU) 2017/1132 on company law and the requirements of the GDPR (specifically Articles 5 and 6), interpreted in light of Articles 7 (respect for private life) and 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union: does EU law require or permit full and unconditional online publication of shareholder data?

Ruling of the Court: No EU Mandate and Disproportionate Interference

In its judgment of 3 September 2026 (ECLI:EU:C:2026:679), the CJEU delivered a decisive two-part ruling: first, Directive 2017/1132 does not require Member States to make public information relating to all shareholders of capital companies; second, EU law precludes making such personal data accessible online without restriction or condition.

The Court held that while the objectives pursued by the national legislature—economic transparency, legal certainty of commercial transactions, and the prevention of fraud and money laundering—constitute legitimate general-interest objectives (Article 6.1.c and 6.1.e GDPR), the statutory measure must satisfy the strict test of necessity and proportionality imposed by Article 6(3) GDPR and Article 52(1) of the Charter.

• Data minimisation (Art. 5.1.c): Public disclosure of precise identifying information (such as personal identification numbers and residential addresses) exceeds what is necessary to verify the legal existence and solvency of the company.
• Distinction between managers and passive shareholders: Enhanced transparency is justified for individuals who participate in the administration, management, or supervision of the company, but becomes disproportionate when applied indiscriminately to ordinary minority shareholders with no managerial power.
• Risks of mass internet dissemination: Unfiltered online availability exposes individuals to automated search engine indexing, commercial profiling, mass web scraping, and identity theft risks, without any oversight of the consultation purposes.

Less Intrusive Alternatives, Practical Scope, and Limits of the Judgment

The Court emphasized that less intrusive mechanisms achieve the same objectives: subjecting access to proof of a legitimate interest by the requesting party, implementing prior identification procedures for online users, or restricting consultation to an administrative office upon reasoned request.

This decision directly follows the WM and Sovim jurisprudence (CJEU, 22 Nov. 2022, C-37/20 and C-601/20) concerning the register of beneficial owners, reiterating that commercial transparency cannot be conflated with universal, anonymous public transparency on the internet.

Strict limits of the ruling: The Court does not prohibit companies from maintaining an internal register of shareholders, nor does it affect lawful reporting to tax, judicial, or regulatory authorities. The judgment exclusively invalidates unrestricted, universal online publication of minority shareholders' personal data.

Verified Official Sources

See Also in the Legal Framework