Never before was the entry into force of a piece of European Union legislation accompanied by millions of emails from friends, colleagues, suppliers and many more we had forgotten all about, all desperate to get in touch with us to let us know that we could legally forget about them (by not opting into their mailing lists).

By now, it is almost unimaginable to find anyone with an email account that has not heard of the new General Data Protection Regulation (GDPR) that entered into effect on 25 May 2018.

However, the GDPR is much more than a regulation about spam. It redefines not only the relationship between businesses and consumers, but also that between citizens and the state.

A new social contract

In a report published at the beginning of May, the European parliament confirmed that the GDPR will also affect the position of taxpayers.

It said: "The GDPR specifically addresses the lack of detailed rules on right of taxpayers to the protection of their data vis-à-vis the expansion of the power of the tax administrations by way of automatic exchange of information. The insufficient guarantees of taxpayers' rights not only poses an imminent threat to the status of taxpayers under [the exchange of information rules], but also potentially diminishes the validity of automatic exchange of information as an international standard."

This statement vindicates those campaigners who for years have been highlighting the deficiencies of the new rules on automatic information exchange.

Public registers

The GDPR was introduced with the "aim to give citizens back control of their personal data and create a high, uniform level of data protection across the EU fit for the digital era" (in the words of the European Parliament).

This trend towards data protection is at odds with the increased use of public registers to list the ultimate beneficial ownership of individuals over companies, foundations and even trusts.

In April 2016, the UK was the first G20 country to introduce a fully public register of ultimate beneficial ownership, known as the Registers of Persons with Significant Control (or PSC registers). In a nutshell, the PSC rules require disclosure in the public interest of anyone with ultimate control over more than 25% in UK companies and certain partnerships.

At the beginning of this year, the UK also introduced registers of trusts which generate tax consequences in the UK (eg a trust that owns rental property in the UK directly, which is increasingly common following the introduction of the Annual Tax on Enveloped Dwellings [ATED]).

The EU is following the UK's lead: on 14 May 2018, the European Parliament approved the text of a new Anti-Money Laundering Directive, which will introduce fully public registers of beneficial ownership of companies throughout the EU.

Under the existing EU rules (which have yet to be implemented by all EU member states), access to beneficial ownership registers by the public requires evidence of a "legitimate interest", which in many cases is limited to the detection of money laundering and terrorism financing. However, the 5th Anti-Money Laundering Directive will remove the need to show a legitimate interest and instead will introduce full publicity.

These developments concern UK and EU companies. However, the UK has already gone a step forward. In January, the government confirmed that its planned beneficial ownership register of foreign companies that own or buy UK property will go live in early 2021.

It is noteworthy that, in April 2016, the finance ministers of the G5 (France, Germany, Italy, Spain and the UK) wrote a letter to the G20 "calling for the development of a system of interlinked registries containing full benefit [sic] ownership information and mandating the OECD, in co-operation with the FATF to develop common international standards for these registries and their interlinking".

A single legal framework?

A closer look to the EU rules shows that the GDPR and the public beneficial ownership registers are two sides of the same coin or, to put it differently, two emanations from a single set of rules.

Articles 7 and 8 of the EU Charter of Fundamental Rights enshrine the rights to privacy and data protection. The fundamental right to privacy is also enshrined by the European Convention on Human Rights, which was agreed in 1950.

Like many other rights, the rights to privacy and data protection are not absolute. Instead, governments may introduce derogations, albeit subject to strict requirements, notably the existence of a sufficient legal basis; the existence of a legitimate public objective, such as the fight against crime; and the respect of the principle of proportionality, notably the idea that any restriction of the fundamental rights to privacy and data protection must be necessary in order to achieve the pursued objective.

Clearly, the introduction of public registers showing who is behind companies and other entities is an adequate measure to tackle money laundering and terrorism funding. There is no doubt that if everyone knows who's behind a company, it is more difficult for a criminal to hide behind it.

However, the question is whether the introduction of public registers is necessary to combat money laundering, terrorism financing and other crimes, such as corruption and tax evasion.

Governments have no doubt reached the conclusion that history is on their side and that the widespread tax evasion scandals unearthed in the mid- 2000s – as well as the Panama Papers and the Paradise Papers – have left them with no other credible choice.

Privacy campaigners, on the other hand, will continue to argue that the introduction of fully public registers, while being adequate to achieve their goals, go beyond what is necessary and therefore violate the rights to privacy and data protection of compliant citizens who wish to "hide" behind a company for legitimate commercial or personal reasons.

The tension between the public interest pursued by the public registers of beneficial ownership and the right to data protection that underpins the GDPR makes a clash between the two universes inevitable.

The question, therefore, is not if a judicial challenge of the public registers will take place, but when.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.