The CJEU curbs indiscriminate disclosure of shareholders: the Jautiva judgment and its echo in Spain

The Court of Justice of the European Union judgment of 3 September 2026 (case C-798/24, Jautiva) is already feeding legal debate in Spain. The ruling, on the public disclosure of shareholders' personal data in Latvia, concludes that EU law does not require publishing information on all shareholders simply because they are shareholders (including minority ones) and opposes making their personal data available to anyone without requirements such as proving a legitimate interest. Professors, lawyers and notaries analysed its reach this week at a working meeting at Pérez-Llorca's offices, as reported by Diario Jurídico.

What the CJEU decided

Latvian law allowed anyone to access online the personal data of shareholders of public limited companies, including minority ones: name and surname, personal identification number and, in certain cases, date of birth, ID document details, contact address and even email, with online consultation and bulk download.

The Court examined that disclosure through the rights to respect for private life and to personal data protection (articles 7 and 8 of the Charter of Fundamental Rights) and concluded that indiscriminate dissemination, without a legitimate-interest requirement, fails the test. Professor of Administrative Law and former AEPD director José Luis Piñar summed it up at the meeting: "The narrative can make us confuse transparency with publicity, make us think everything must be made public", recalling that any limitation of rights must be laid down by law and pass the proportionality test of article 52 of the Charter.

The Spanish echo: the Draft Organic Law on Public Integrity

The meeting set the judgment against the Draft Organic Law on Public Integrity, which plans to make registry filing constitutive for transfers of shares in limited liability companies, formalisable through electronic private document, judicial or administrative document, or public deed, replacing the current system of public deed and prior notarial control.

Participants raised relevant reservations. Professor of Civil Law Lorenzo Prats considered that the draft, as currently framed, could fall into the same defect as the Latvian rules. Professor of Company Law Pedro Portellano argued that the security of legal commerce does not require everything to be on the register ("The Commercial Registry being the centre of legal commerce does not mean absolutely everything must be in it") and warned of the difficulty of controlling a generically conceived legitimate interest: "How can registrars control that? I think in no way". Notary Juan Álvarez-Sala condensed it into a formula: "Not everything registrable must be publishable".

The president of the General Council of Notaries, Concepción Pilar Barrio del Olmo, focused on the risks of excessive disclosure of wealth information, and Pérez-Llorca partner Josefina García Pedroviejo brought the practice perspective: "From the point of view of commercial practice, our clients are not comfortable with this whole situation". Her colleague Raúl Rubio highlighted the notary's role as guarantor of clients' data protection.

Why it matters to firms

The ruling adds to the European line that modulates corporate and beneficial-ownership transparency through data protection, a tension firms already manage for their clients. For company and data protection teams, the judgment is a new argument on two fronts: proportionality analyses of disclosure obligations and the foreseeable debate on the design of the share-transfer register if the Spanish draft moves forward.

On the beneficial-ownership ecosystem in firm practice, see our analysis of the beneficial ownership register and the editorial on beneficial ownership and transparency.