CJEU Advocate General: anti-money laundering units may keep a person’s data secret, but not without safeguards
Always see our news on Google
Financial intelligence units investigating suspicions of money laundering may limit or even refuse a person’s access to the data they hold about that person, proposes Laila Medina, Advocate General of the Court of Justice of the EU. Secrecy may be necessary to avoid compromising investigations, but it cannot operate without clear rules, independent oversight, and the possibility for the person concerned to exercise their rights through the data protection authority. The conclusions are not binding on the judges of the CJEU.
A person may not find out whether a national financial intelligence unit holds data about them when disclosure of the information could compromise the prevention of money laundering or terrorist financing. However, according to the conclusions presented on 8 October by Laila Medina, Advocate General of the Court of Justice of the European Union, the authorities cannot turn this need for secrecy into an absolute, uncontrolled prohibition without safeguards.
The case originated in Estonia, where a man repeatedly tried to find out what information the national financial intelligence unit held about him and whether it had been shared with banks or foreign authorities. The authority refused to confirm even the existence of the data, citing the duty of confidentiality necessary to protect the anti-money-laundering system.
In brief
Financial intelligence units may refuse direct access to data when disclosure would compromise the prevention or investigation of money laundering.
A total prohibition is permitted only if the law establishes clear, precise, and proportionate conditions and safeguards against abuse.
In certain situations, the authority may refrain from explaining to a person why it refused access if the explanation would confirm the existence of an investigation or harm the public interest.
However, the person must be informed that they may exercise their rights indirectly through the independent data protection authority.
The Advocate General’s conclusions are not a judgment of the CJEU. The Court’s judges will decide the case at a later date.
Financial intelligence units, or FIUs, occupy a position different from that of an ordinary administration. They receive and analyse information about suspicious transactions, may request data from financial institutions, and exchange information with national authorities and similar units in other states. In many situations, the mere fact that a person learns they are being analysed may compromise ongoing checks.
Medina proposes that the Court establish clearly for the first time that, when carrying out their mission of preventing, detecting, and combating money laundering and terrorist financing, these units must be treated as competent authorities within the meaning of the EU Directive on data protection in criminal matters.
The consequence is important. Data processing for this activity would not primarily be governed by the general GDPR regime, as the Estonian Supreme Court had previously considered, but by Directive 2016/680, designed for data used by authorities in preventing and combating crime.
The difference does not eliminate the person’s rights. The Directive allows access to one’s own data to be restricted when this is necessary to protect an investigation, prevent an offence, or safeguard other public interests provided for by law. However, the restriction must remain necessary and proportionate.
The Advocate General even accepts that, in the field of money laundering, a complete restriction of direct access may be justified. Confidentiality is essential in a system in which banks and other entities report suspicious transactions without alerting the person concerned.
The problem arises when secrecy becomes automatic and unlimited. Legislation must explain in what situations access may be refused, how long the restriction may last, and what safeguards exist against the abusive use of data. The authority cannot simply be given the freedom to keep all information secret until its destruction without criteria allowing the necessity of the measure to be verified.
In the Estonian case, the information submitted to the Court suggests that access could be blocked for all persons and for the entire period during which the data were retained. Medina considers that such a system would violate EU law if the legislation does not provide sufficiently clear rules and safeguards enabling the supervisory authority and the courts to verify whether the restriction is justified.
Independent oversight thus becomes the central element of the proposed solution.
If a person cannot see the data directly, the national data protection authority must be able to verify on their behalf what information exists, whether the processing is lawful, and whether the refusal of access is justified. The supervisory authority must be able to discuss the matter confidentially with the financial intelligence unit and have access to the information necessary for verification.
The person concerned may then use this mechanism to obtain effective oversight of legality, including before a court, without the sensitive data or the existence of an operation necessarily being disclosed to them.
The conclusions also acknowledge an even more delicate situation: an FIU may refuse to explain why it is not providing access when merely stating the reasons would reveal whether or not the person is being analysed and could endanger the public interest.
However, the authority cannot completely close off the possibility of challenging the decision. Even if it does not explain the reason for the refusal, it must tell the person that they may exercise their rights through the data protection authority.
The case is relevant to all EU Member States because each national anti-money-laundering system uses a financial intelligence unit, and the exchange of data between these units is one of the essential components of European cooperation against illicit financial flows.
The stakes are heightened by the nature of the information that reaches these databases. A person may appear in a financial analysis without being charged or even without a formal criminal investigation existing. The data may come from suspicious transaction reports, information received from banks or other reporting entities, and exchanges between authorities.
For precisely this reason, Medina seeks to reconcile two objectives that appear to conflict. The anti-money-laundering system must operate without suspected persons being alerted before the authorities can analyse the transactions. At the same time, the existence of secret databases cannot eliminate the fundamental right to data protection and control over how authorities use personal information.
The Court is not required to follow the Advocate General’s conclusions. The role of Advocates General is to propose a legal solution in complete independence, while the CJEU judges deliberate separately. The judgment will be delivered at a later date.
If the judges follow this interpretation, the effect will not be to require FIUs to disclose to people whether they are being monitored. However, it would confirm the principle that the secrecy necessary to combat money laundering must be accompanied by verifiable rules and an independent avenue through which the lawfulness of data use can be reviewed.
Latest News
22:45
22:15
21:55
21:33
21:12
See more news
NEWS ON THE SAME TOPICS
