UK Information Commissioner warns of privacy threat from public trust registers
The UK government's Information Commissioner's Office (ICO) has warned HM Treasury that trust beneficiaries would be placed at a 'real risk of identity theft' by current draft EU legislation that will make trust registers fully open to the public.
The ICO is concerned about proposed amendments to the EU Fourth Anti-Money Laundering Directive (Directive 2015/849, or 4AMLD). The directive's current form is soon to be transposed into UK law, and the UK's Treasury is conducting a consultation on the exact wording of the relevant legislation – the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
The draft regulations establish a register of beneficial ownership information for express trusts with tax consequences (Clause 44 of the regulations), as required by 4AMLD. The information to be included in this register includes data about the beneficial owners' residential address, date of birth, national insurance number, and passport number where the residential address is not in the UK – all of it clearly sensitive personal data under the Data Protection Act 1998.
The current form of 4AMLD, and the related UK regulations, limit the power to inspect the register to law enforcement authorities in the UK. Disclosure of the information in the register may be provided only to another EU (or EEA) member state's money laundering authority. This, says the ICO, provides 'a level of comfort' considering the sensitivity of the data fields included in the register.
However, since the text of 4AMLD was agreed at European level in May 2015, the European Commission has proposed draft legislation amending the directive to allow full public access to registers of trust beneficial ownership. In principle, this amendment would have to be followed through into the implementing UK regulations.
'It will be important to ensure that any final decision on this proposed amendment, and its UK transposition if agreed, takes full account of data protection law and the right to privacy', says the ICO in its consultation response. It notes that the data in the registry, either on its own or in combination with other available data, 'would pose a real risk of identity theft if it were made public'.
The ICO insists that future proposals on trust beneficial ownership registers must be subject to the same scrutiny and public consultation as that recently conducted by another arm of government, the Department of Business, Energy and Industrial Strategy, on its Persons of Significant Control Register for company ownership.