A requirement at the incorporation of a Dutch BV company (a private limited liability company) is that as of 27 September 2020 the UBO of the Dutch BV must be registered in the UBO registry.
UBOs (Ultimate Beneficial Owners) are the people who own or control an organization. These are, for example, people with more than 25% of the shares in a BV or people who have more than 25% direct or indirect ownership interest in a general partnership or partnership. An organization can have 1 or more UBOs.
Public UBO data concerns: first and last name, month and year of birth, nationality, country of residence, the type of the participation and the extent of the participation that a UBO has in an organization.
A UBO registration provides for a more transparent image, which can be helpful for obtaining a bank account and for a more solid image to the Regulator.
However, the Dutch Foundation Privacy First (“Privacy First”) lodged an injunction with the District-Court at the Hague. Privacy First inter alia asked the Judge to suspend the obligation to provide the UBO’s data according to article 15a of the Dutch trade register act (Dutch: “Handelsregisterwet”) and to order that the UBO registry will be offline.
According to Privacy First the Dutch implementation of the Directives AMLD4 en AMLD5 is in breach with inter alia Article 8 of the European Human Rights Treaty and local GDPR law. According to Privacy First, the conditions for a legitimate infringement of the fundamental rights to the protection of privacy and personal data have not been met. Privacy First refers inter alia to a data breach recently found in the Belgian UBO register and the recent hack of the Luxembourg UBO register by the French newspaper Le Monde.
It has been judged that as long as AMLD5 is in full force, the Dutch State cannot be put in a position in which the State manifestly violates that Directive. Also, the Judge said that the CJEU did not yet rule on the lawfulness of the public UBO register prescribed by AMLD4 and AMLD5. In this state of affairs, there is no room to test the legitimacy of those parts of the Dutch implementing legislation that are being discussed by Privacy First.
However, the Judge said it cannot be ruled out in advance that the CJEU will come to the conclusion, partly on the basis of the advice from the EDPS, that the (partly) public nature of the UBO register is not in line with the objectives of the UBO register compared to the principle of proportionality to be respected by the European legislator. This means that, in principle, the Dutch court can submit preliminary questions about this to the CJEU. However, the injunction Judge will not proceed to ask questions in this regard. The reason for this is that the Tribunal d’arrondissement in Luxembourg already put questions on this point to the CJEU on 13 November 2020. See: http://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:RBDHA:2021:2457
Privacy First filed an appeal to the Judgement on 15 April 2021. See https://www.privacyfirst.nl/rechtszaken-1/item/1223-rechter-twijfel-over-ubo-register-is-terecht.html
Pending the outcome of the various lawsuits, the UBO’s of Dutch entities which are not yet registered must in principle be registered before March 27, 2022.