EDPS Opinion on the Proposal for a Directive of the European Parliament and of the Council on multiple-vote share structures in companies that seek the admission to trading of their shares on an SME growth market

6 February 2023

Opinion 4/2023

on the Proposal for a Directive on multiple-vote share structures in companies that seek the admission to trading of their shares on an SME growth market

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to a Proposal for a Directive of the European Parliament and of the Council on multiple-vote share structures in companies that seek the admission to trading of their shares on an SME growth market. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 7 December 2022, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council on multiple-vote share structures in companies that seek the admission to trading of their shares on an SME growth market.

The Proposal aims to achieve a minimum harmonisation of national laws on multiple-vote share structures of companies listing on small and medium-sized companies growth markets, while leaving sufficient flexibility to Member States for its implementation. Furthermore, the Proposal is part of the Listing Act package, consisting of a set of measures to make public capital markets more attractive for EU companies and facilitate access to capital for SMEs.

With regard to the publication of personal data provided for in Article 6 of the Proposal, the EDPS recalls that any requirement to publish personal data should, in addition to being provided by law, also fulfil the other requirements arising from the Charter and the GDPR, and in particular must meet an objective of public interest and be proportionate to the legitimate aim pursued.

The EDPS questions whether making available to the public at large the identity of holders of multiple-votes shares or of the persons entitled to exercise voting rights on their behalf or of the holders of securities with special control rights is in fact strictly necessary to strengthen investor confidence and facilitate informed investment decision-making. In any event, the EDPS considers that objective(s) of public interest that would justify public accessibility of such data should be clearly set out in the enacting terms of the Proposal. In addition, the EDPS recommends to consider providing for a mechanism that would allow access to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives, as a safeguard to ensure that access to these data would be limited to investment related purposes.

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 7 December 2022, the European Commission issued the Proposal for a ‘Directive of the European Parliament and of the Council on multiple-vote share structures in companies that seek the admission to trading of their shares on an SME growth market’ (‘the Proposal’).

2. The objective of the Proposal is to achieve a minimum harmonisation of national laws on multiple-vote share structures of companies listing on small and medium-sized companies (‘SMEs’) growth markets, while leaving sufficient flexibility to Member States for its implementation.

3. The Proposal is part of the Listing Act package, which consists of a set of measures to make public capital markets more attractive for EU companies and facilitate access to capital for SMEs . The Listing Act package aims to: (i) reduce the regulatory burden where it is considered to be excessive (i.e. where regulation could contribute to investor protection/market integrity in a more cost-efficient manner for stakeholders); and (ii) increase the flexibility given under company law to companies’ founders/controlling shareholders to choose how to distribute voting rights after the admission to trading of shares .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 14 December 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 17 of the Proposal.

2. General remarks

5. According to the Explanatory Memorandum , the Proposal affects the right to privacy and protection of personal data of certain shareholders and persons exercising voting rights in the company, as well as holders of securities with special control rights. Indeed, the EDPS notes that Article 6 of the Proposal clearly provides for the processing of personal data, including the publication of such data. Against this background, the EDPS firstly recommends to add a recital underlining the applicability of the General Data Protection Regulation (‘the GDPR’).

6. Moreover, the EDPS recalls that any requirement to publish personal data should, in addition to being provided by law, also fulfil the other requirements arising from Article 52(1) of the Charter and Article 6(3) of the GDPR, and in particular must meet an objective of public interest and be proportionate to the legitimate aim pursued .

7. In its judgment on Joined Cases C-37/20 and C-601/20 , the Court of Justice of the European Union (‘CJEU’) considered that the general public’s access to information on beneficial ownership constitutes a serious interference with the fundamental rights to respect for private life and to the protection of personal data, enshrined in Articles 7 and 8 of the Charter, respectively and that the information disclosed enables a potentially unlimited number of persons to find out about the material and financial situation of a beneficial owner. In addition, the Court held that the potential consequences for the data subjects resulting from possible abuse of their personal data are exacerbated by the fact that, once those data have been made available to the general public, these can be freely consulted, retained and disseminated.

8. The CJEU further considered that, although the EU legislation in object put in place pursued an objective of general interest capable of justifying even serious interferences with the fundamental rights enshrined in Articles 7 and 8 of the Charter, and that the general public’s access to information on beneficial ownership was appropriate for contributing to the attainment of that objective, it also found that the interference provided by that measure was neither limited to what strictly necessary nor proportionate to the objective pursued.

9. The EDPS takes note of the differences between the present Proposal and the provisions of the Directive at issue in Joined Cases C-37/20 and C-601/20, both in terms of the objectives pursued and the categories of data concerned. Nevertheless, the EDPS considers that the publication of personal data envisaged by the Proposal may go beyond what is strictly necessary and proportionate for the reasons set out in the following section.

3. Publication of personal data

10. The EDPS notes that Article 6(1)(c) and 6(1)(e) of the Proposal respectively provide that Member States shall ensure that companies with multiple-vote share structures whose shares are traded or are to be traded on an SME growth market make publicly available, among others, “(...) the identity of holders of any securities with special control rights and a description of those rights” and “the identity of the shareholders holding multiple-vote shares and of the natural person or legal entity entitled to exercise voting rights on behalf of such shareholders, where applicable”.

11. From the Explanatory Memorandum to the Proposal, it appears that the rationale for the publication requirement is to strengthen investor confidence and facilitate informed investment decision-making, thereby enhancing both investor protection and market efficiency. Since the investor can be any member of general public, it is argued that this information should be publicly available. Moreover, the Explanatory Memorandum explains that the Proposal requires the disclosure of personal data exclusively in relation to the shareholders and persons that have significant decision-making power or may otherwise exercise control rights in the company, since, in the absence of such disclosure, investors would not be able to take fully informed investment decisions .

12. The EDPS notes that the obligation to make certain categories of personal data public aims at strengthening, via such transparency, investor confidence and facilitate fully informed investment decisions, as also explained in recital 13 of the Proposal. The objective of the Proposal is therefore to provide information on corporate governance of the companies concerned. However, recital 13 of the Proposal also refers to ‘transparency on ultimate ownership’. The EDPS considers that such reference to ‘ultimate ownership’ should be deleted, since this is not mirrored by the purpose and the content of the information to be provided.

13. As regards the publication of personal data, the EDPS firstly questions whether making available to the public at large the identity (the names) of holders of multiple-votes shares or of the persons entitled to exercise voting rights on their behalf or of the holders of securities with special control rights is in fact strictly necessary to strengthen investor confidence and facilitate informed investment decision-making. While it is apparent that the disclosure would increase the amount of information available to potential investors, the impact assessment does not adduce any further evidence demonstrating that such public disclosure would be strictly necessary to protect investors or ensure market efficiency.

14. Moreover, although the categories of personal data to be made available would be limited , the EDPS considers that, given the interference to the fundamental rights to privacy and data protection stemming from the publication of such personal data, the objective(s) of public interest that would justify the public accessibility of such data should be clearly set out in the enacting terms of the Proposal as such.

15. In addition, the EDPS recommends to consider providing for a mechanism that would allow access not to the public, but only to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives. A clear specification of the purposes and conditions under which access may be granted would constitute an important safeguard to ensure that access to and use of these personal data would be limited to the purposes for which they are made available.

4. Conclusions

16. In light of the above, the EDPS makes the following recommendations: (1) to add a recital confirming the applicability of the GDPR to the processing of personal data performed in the context of the Proposal; (2) to delete the reference to “ultimate ownership” in recital 13 of the Proposal, since this is not mirrored by the purpose and by the content of the information to be provided; (3) to clearly spell out the objective(s) of public interest pursued that would justify the publication and public accessibility of personal data in the enacting terms of the Proposal as such; (4) to consider providing for a mechanism that would allow access to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives as a safeguard to ensure that access to these data would be limited to the investment related purposes. Brussels, 6 February 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7