[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fg-EnT_ziv5J-oX8aEa0jmmB45rQmJLphMwXkGN4nTbQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48},"0e5407e2-c4b0-4a1e-8729-404944afd062","cjeu-rules-public-disclosure-of-shareholder-data-violates-gdpr-principles","c21e5b04-d765-4a1a-9938-57c15db90851","CJEU Rules Public Disclosure of Shareholder Data Violates GDPR Principles","The Court of Justice of the European Union ruled that national legislation mandating broad public accessibility of minority shareholders' personal data breaches GDPR Articles 5 and 6, specifically the principles of data minimization and purpose limitation. The core failure was that national law went beyond what EU company law directives (2017\u002F1132) actually require, exposing personal data without a proportionate justification. This matters because organizations and legislators must not default to maximum disclosure when less intrusive access controls — such as requiring proof of legitimate interest — can achieve the same lawful objective. The ruling reinforces that 'publicly accessible' does not mean 'unrestricted by default' under GDPR, and that proportionality must be actively evaluated.","**Immediate actions:**\n- Audit any publicly accessible registers or databases containing personal data to assess whether current disclosure levels are proportionate and legally justified.\n- Implement access-gating mechanisms (e.g., legitimate interest verification) before granting access to sensitive personal data in public registries.\n\n**Policy & Compliance improvements:**\n- Review national or organizational data-sharing policies against GDPR Articles 5(1)(b) (purpose limitation) and 5(1)(c) (data minimization) to identify over-disclosure risks.\n- Establish a legal basis review process ensuring that any data publication requirement is cross-referenced with applicable EU law before implementation.\n- Engage Data Protection Officers (DPOs) when designing or modifying public disclosure frameworks that involve personal data.\n\n**Long-term governance measures:**\n- Conduct periodic Data Protection Impact Assessments (DPIAs) for all systems that make personal data publicly accessible.\n- Implement role-based access controls on public registries so that sensitive personal data fields are only visible to parties demonstrating a documented legitimate interest.\n- Train legal and compliance teams on the proportionality principle under GDPR to prevent future legislative or procedural over-reach.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5(1)(b) – Purpose Limitation","GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 6 – Lawfulness of Processing","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","EU Directive 2017\u002F1132 – Company Law Directive","NIST Privacy Framework PR.DS-P1 – Data minimization","NIST SP 800-53 AC-3 – Access Enforcement","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework","ITIL – Information Security Management (Service Design)","published","2026-09-08T10:23:15.297201+00:00","2026-09-08T10:23:15.226+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-798\u002F24_-_Jautiva&diff=52929&oldid=52928","cjeu-c-798-24-jautiva-b7f7db","CJEU - C-798\u002F24 - Jautiva",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":43,"name":44,"slug":45,"description":46,"color":47},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]