A lawyer campaigning to protect financial privacy says a Luxembourg court has taken an important step in potentially limiting how far European legal authorities can push for public registers of beneficial ownership. Cybersecurity breaches of the US Treasury are also a reminder that data-exchange pacts carry risks, the lawyer says.

Luxembourg courts have asked the Court of Justice of the European Union about whether public registers of public ownership are valid, a further twist in a global debate about how private financial information should be protected, a law firm says.

Mishcon de Reya, the law firm, said that the Luxembourg development followed a number of appeals that it and other parties have made. One of the firm’s partners, Filippo Noseda, is a prominent critic of calls to put financial data into the public domain without strong safeguards. He has in the past warned that intra-government pacts to exchange information to hunt down alleged tax evaders are at risk because of cybersecurity breaches. He is also a critic of public registers of beneficial ownership.

'It has come to my attention that the Luxembourg courts have decided to refer the question of the compatibility of public registers of beneficial ownership with fundamental rights to the European Court of Justice,” Noseda said on his firm’s website. “This is welcome news in what is a very sensitive area. Indiscriminate access to personal information raises serious legal issues for company owners and their families. We filed several appeals against the Luxembourg Business Register and asked that the matter be referred to the European Court of Justice.”

“The request for a ruling has direct implications for all EU Member States, because the introduction of public registers is an EU requirement under the 5th anti-money laundering directive. It has also direct implications for the UK's Crown Dependencies and Overseas Territories (such as Bermuda, the BVI and the Cayman Islands) who have been pressured by the UK government to introduce fully public registers as opposed to registers that are accessible to authorities and parties showing a legitimate interest,” Noseda said. 

And his comments come a few days after the US Senate voted to approve a bill to crack down on anonymous shell companies in the US. Meanwhile, jurisdictions such as the Cayman Islands, Bermuda, the BVI, the Isle of Man, Jersey and Guernsey – all with ties to the UK – have introduced public registers of beneficial ownership for companies (but not trusts). 

Noseda has warned that cybersecurity breaches in government tax departments, central banks and commercial institutions also threaten the integrity of government-approved data exchanges under the Common Reporting Standard. (The US is not a CRS signatory.) Separately, the US Financial Account Taxation Compliance Act, or FATCA, also requires non-US financial institutions to pass details about expat Americans to the Internal Revenue Service. Noseda has argued security breaches also raise risks over FATCA’s remit.

The Washington Post, The Guardian and other media said Russian government hackers are behind a breach at the US Treasury and Commerce departments and have been able to monitor email traffic within the departments for months.

Noseda said his law firm’s file on data breaches which could affect data sharing deals now runs to 55 pages.