UBO registration process by Chamber of Commerce causes privacy concerns
Locations
Since September 27th 2020, existing Dutch entities must register their ultimate beneficial owners (UBO) within 18 months. Dutch entities incorporated after September 27th 2020 must register their UBO when applying for their first registration with the Dutch Chamber of Commerce.
After having finalised the first UBO registrations, we have experienced certain concerns about the current implementation of this UBO-register by the Chamber of Commerce. In this article we will share with you our concerns and recommendations.
UBO Registration applications
Civil-law notaries in the Netherlands are allowed to file UBO registration applications with the Chamber of Commerce regarding Dutch entities for their clients. In order to be able to complete such application, the civil-law notary must receive certain confirmations and documents evidencing the type of (in)direct interest of the UBO in the Dutch entity. When filing the application for registration of the UBO electronically, documents will have to be uploaded into the online UBO registration application for civil-law notaries (NAU). Since there can be a variety of corporate structures, in which a person could be considered to qualify as a UBO, it is not yet clear with respect to each possible situation which supporting documents would be accepted by the Chamber of Commerce as sufficient evidence of such qualification. The Chamber of Commerce can be of the opinion that more supporting documents are required. In that case, the handling of the UBO registration application would remain on hold until such requested documents are uploaded via NAU by the civil-law notary.
Alternatively, it is also possible that a director of the Dutch entity files the UBO registration application by himself using an online registration application. In the event the Chamber of Commerce requires additional supporting documents to approve the UBO registration, such information shall be requested by way of a letter, addressed to the entity for which the application was filed, and not directed to any person in particular.
Confirmation of UBO registration
The Chamber of Commerce approves and confirms the registration of the UBO to the respective entity as well as the UBO, by sending an automatically generated letter to the office address of the Dutch entity and the private address of the UBO. This letter explains in general which registered information is public and which information doesn't become public. Only specific authorities, such as the Public Prosecutor's Office have access to the information that is not public However, after we have finalized the first UBO registrations with the Chamber of Commerce we noticed that the letter contains also a confirmation of all information of the UBO which has been registered with the UBO-register, irrespective whether public or not, including the Social Security Number (for Dutch citizens) and Tax Identification Number (for foreigners), the private address, the interest percentage and type of interest held in the entity and the date of birth. Presumably, the registered UBO information is confirmed in this manner in order to enable the management board of the Dutch entity and the UBO to file an opposition against the UBO registration or to correct an inaccurate or incomplete UBO registration.
Privacy concerns
The manner of communication of the Chamber of Commerce causes serious privacy concerns. By communicating the registered information in an annex to the letter addressed to the entity without directing the letter at least confidentially to the management board, the Chamber of Commerce seems to accept the risk of unintentionally sharing highly sensitive private information with unauthorised persons. Imagine the following situation: one of the managing directors of a Dutch B.V. forming a joint venture between two shareholders files an application UBO registrations; one shareholder is a multinational family owned company with two UBOs, and the other is a holding company with three Dutch founders, one of whom qualifies as a UBO. Once the Chamber of Commerce has approved the registration application, the letter from the Chamber of Commerce confirming the UBO registrations is delivered at the B.V.'s office address. The letter is processed by the junior controller, who has been instructed to process all invoices, tax bills and letters from the tax authority and the Chamber of Commerce. This letter from the Chamber of Commerce, however, contains sensitive personal information, which within that B.V. would never have been disclosed to any employee. Moreover, the Chamber of Commerce should never disclose a Social Security Number and a Tax Identification Number to anyone.
Interestingly, the Dutch Data Protection Authority (the Autoriteit Persoonsgegevens, DPA) has advised several times on privacy issues raised by the UBO-register during the Dutch legislative process. The advice by the DPA, however, primarily focussed on the content of the UBO-register Implementation Act itself. For example, the AP advised that the reasons for processing of sensitive personal data in the UBO-register needed to be further specified for the UBO-register Implementation Act in compliance with the General Data Protection Regulation (GDPR). However, the DPA did not extend its advice to the execution of UBO registrations in practice. The unfortunate result is that the privacy check upfront may have been comprehensive, but that the execution of the UBO registration process is flawed from a privacy perspective.
Recommendations
We assume that the Chamber of Commerce will evaluate the implementation of the UBO-register and may reconsider this undesired communication process in time. The Chamber of Commerce might consider the option of sending confirmations by a secured encrypted email to an email address to which only directors of a company have access. Additionally, the Chamber of Commerce might decide to no longer add the annex containing registered information to the letter addressed to the UBO confirming his registration.
Until the communication process has been changed, directors of any Dutch entity should ensure to give clear instructions to their reception and administration to hand them the unopened envelope of the Chamber of Commerce, once a UBO registration has been completed. UBOs should be made aware that they can expect to receive on their private address these automatically generated letters from the Chamber of Commerce. Finally, we would advise a general counsel of a corporate group with one or more UBOs holding several Dutch companies, to coordinate the UBO registration process for all companies involved, so as to ensure that the UBO receives the letters confirming the UBO registrations all at the same time.
In our UBO Registration brochure (https://www.fieldfisher.com/en/insights/ubo-registration-in-the-netherlands) we have summarized the information regarding UBOs which must be registered with the UBO-register.
The civil-law notaries of Fieldfisher are ready to assist with the completion of the UBO registration application.
Please contact us should you require our advice.