The Ombudsman, the President of the Office for Personal Data Protection and the social side sent an interview to the finance minister on the risk of unlimited access to data collected in the Central Register of Real Beneficiaries.
Intervention No 21788 points out the urgent need to modify the concept of the disclosure of the PESEL number in public registers towards a greater guarantee of the protection of the individual's privacy while respecting the principle of transparency in public life.
The constitutionally guaranteed right to privacy and the disclosure of data in CRBR
In particular, the Central Register of Real Beneficiaries, which collects and processes information on natural persons exercising control over companies, raises reservations in this respect in order to prevent money laundering and terrorist financing.
As indicated by the RPO, the persons included in it complain that their personal data, including the PESEL number, are publicly available on the network, which exposes them, for example, to the risk of identity theft.
For such risks as may be expected under Article 67 The anti-money laundering and terrorist financing laws indicated that the register was still open at the legislative stage of the President of the Office for Personal Data Protection, recommending that it be limited to persons of legal or factual interest without success.
The reality now confirms the concerns of the RPO and the President of UODO.
In the light of the above, it was asked whether and what steps the ministry intends to take to protect the constitutionally guaranteed right to privacy of persons included in the CRBR and to adapt its scope to Article 87 Regulation (EU) 2016/679 to 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data?
Full disclosure proportional to legal requirements
The Ministry’s reply shows that the motives pursued by the legislature in including full disclosure of the CRBR are proportionate to the needs of the law against money laundering and terrorism. At the same time, the Ministry announces that this problem will be re-examined as part of the legislative process carried out in connection with the integration of the CRBR with registers of beneficial owners operating in other EU Member States.
The distribution of the heads of companies’ data on the network may have an opposite effect from that intended in the Act, i.e. may involve entities whose data will be widely available, in various criminal incidents resulting from identity theft
As we read in our reply to the interpelling, the justification for the Anti-money Laundering Act and the Financing of Terrorism (Law of p.p.f.t.) provides an explanation of the motives for the legislator.
In the context of the full disclosure of the CRBR data, the legislator took into account the reasons for the submission of the proposal for a case Directive 2018/843, which, in addition to increasing the effectiveness of the measures taken to prevent money laundering and the financing of terrorism, also points to the need to ensure greater transparency of financial transactions, in particular to ensure an adequate level of access to information on the beneficiaries of the actual legal entities.
Amendment Directive 2015/849 shows a change in the perception of systems for collecting and making public information about beneficiaries of legal entities that have taken place in EU law.
Such schemes are no longer regarded as merely instruments in the fight against money laundering and terrorist financing, and are intended to serve wider objectives, i.e.
combating tax avoidance, protecting the security of economic operators by providing them with access to information about potential counterparties, ensuring an adequate level of corporate governance, increasing the control of information by civil society, including the media and civil society organisations, and contributing to maintaining confidence in the fairness of financial transactions and the financial system.
They are therefore tools to protect a particularly important public interest, i.e. to ensure security and public order by enabling the authorities to obtain information, but also by entities outside the "state domain", involved in the anti-money laundering and terrorist financing system.
It should be noted that the good which is violated by the crime of money laundering is the regularity of the economic trade, and allowing this crime to be committed on a large scale threatens to violate the principles of the social market economy which is the basis of the constitutionally protected economic system of the Republic of Poland.
The provision of information about the beneficiaries to actual participants in the economic trade, in particular in the context of widespread cases of the involvement of businesses unaware of this fact in structures aimed at criminal extorting of the tax on goods and services, should also be assessed positively in the context of constitutionally protected principles of business freedom and property rights.
Furthermore, the inclusion of information about beneficiaries with the principle of transparency also facilitates the implementation of constitutionally guaranteed freedom to obtain information.
In the opinion of the legislator, the inclusion of the actual beneficiaries’ data collected in the CRBR with the principle of full transparency was a necessary measure to achieve the objectives of the regulation and remained closely linked to the constitutional values indicated above.
At the same time, it appears that these solutions do not unduly affect the constitutionally protected right to privacy and information autonomy. Accordingly, the legislature regulates Article 67, CRBR's public disclosure was considered proportionate.
It should also be noted that both provisions Regulation (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 (GDPR), as well as the case law of the TEU allow for the possibility of introducing national regulations which may, to a certain extent, affect the limitation of rights to the protection of privacy and personal data in connection with the achievement of specific public interest objectives such as the prevention of money laundering and terrorist financing.
However, as can be seen, making the data available to the heads of companies in the network can have a counterproductive effect from the law, i.e. may involve entities whose data will be widely available, in various criminal incidents resulting from identity theft.
Author: Katarzyna Kołbuś. Editor leading RB Magazine. From Over 10 years related to industry press, including the Financial Gazette and portal ipip.com.pl, which focuses on finance, taxation, law, politics and the economy