Privacy is not the absence of information. It is the existence of boundaries around information.
That distinction matters in a world where banks identify beneficial owners, tax authorities exchange financial data and corporate registries increasingly verify who controls legal entities. A legitimate demand for privacy does not require pretending that ownership, residence or source of funds should be unknowable. It asks a different question: who needs the information, for what lawful purpose, for how long, with what security and with what limits on onward use?
Opacity is different. Opacity is designed to stop relevant counterparties or competent authorities from understanding facts they are legally entitled to know.
The modern challenge is therefore not privacy versus transparency. It is proportionate transparency without unnecessary exposure.
Key takeaways
- Disclosure and publicity are different. Information available to a competent authority or regulated bank does not automatically need to be available to the entire world.
- Privacy has an institutional architecture. Purpose limitation, data minimisation, security, accuracy and controlled access are part of legitimate transparency, not exceptions to it.
- International planning cannot rely on opacity. Ownership, residence, management and source of funds should be explainable even when personal exposure is kept to what is legally necessary.
The false choice between secrecy and total exposure
Financial transparency debates are often framed as a binary choice.
One side imagines that privacy requires secrecy: hidden owners, accounts that cannot be connected to taxpayers and structures that prevent authorities from reconstructing economic reality.
The other side sometimes treats more public information as automatically better.
Neither position is robust.
The EU’s General Data Protection Regulation gives a useful starting point. Article 5 requires personal data to be collected for specified and legitimate purposes, limited to what is necessary, kept accurate, retained no longer than necessary and protected against unauthorised or unlawful processing. Those principles do not prohibit legitimate data collection. They impose discipline on it.
That is privacy as governance, not invisibility.
Beneficial ownership shows why the distinction matters
The Financial Action Task Force strengthened Recommendation 24 to require countries to ensure that competent authorities can obtain adequate, accurate and up-to-date information on the beneficial ownership and control of legal persons.
That objective addresses a real problem: a company can be used lawfully, but legal personality can also be abused to disguise the human beings who ultimately own or control assets and transactions.
Yet “the authorities must be able to identify the beneficial owner” is not the same proposition as “every member of the public should have unrestricted access to every beneficial owner’s personal data”.
The Court of Justice of the European Union made that distinction concrete in the Luxembourg Business Registers litigation. In 2022 it held invalid the EU requirement that beneficial-ownership information be accessible in all cases to any member of the general public, finding the interference with privacy and data-protection rights disproportionate. The judgment did not abolish beneficial-ownership transparency. It challenged the breadth of unrestricted public access.
That is precisely the middle ground a serious privacy framework needs.
Automatic exchange also needs safeguards
The Common Reporting Standard and the Crypto-Asset Reporting Framework are designed to move information between tax administrations. Their policy objective is to reduce the ability to hide financial accounts or relevant crypto-asset transactions behind cross-border complexity.
The fact that data travel automatically does not make confidentiality irrelevant. The OECD’s tax-transparency framework includes confidentiality and data-safeguard requirements because automatic exchange would be institutionally indefensible if sensitive taxpayer information could be accessed or redistributed without control.
The same principle applies operationally to banks and professional providers. KYC, source-of-funds and source-of-wealth evidence may be required for a legitimate risk assessment. That does not mean the information should be collected without purpose, retained forever or exposed more widely than necessary.
What privacy protects
Privacy has economic and human consequences that are easy to ignore in abstract transparency debates.
Public exposure of wealth, addresses, ownership structures or family connections can create risks of fraud, extortion, identity theft, harassment and physical security. It can reveal commercial strategy or personal relationships that have no legitimate bearing on a public policy objective.
For internationally mobile families and founders, the data surface is especially broad. Passports, tax-residence records, company registers, bank KYC files, beneficial-ownership declarations, contracts, transaction histories and crypto records may sit in different institutions and countries.
The answer cannot be to make those records fictitious or contradictory. The answer is to make them accurate, explainable and appropriately contained.
The strongest objection: controlled systems still leak and expand
The strongest objection to this institutional middle ground is that formal safeguards are not guarantees.
Databases are breached. Authorities make mistakes. Data collected for one purpose can later be used for another. A “restricted” register can become public after a political change. Cross-border exchange multiplies the institutions through which information passes.
That objection is serious because it shows why privacy cannot be reduced to a legal checkbox.
But it does not establish that opacity is the safer answer. Deliberately preventing competent authorities or regulated counterparties from understanding ownership or funds can create different risks: criminal misuse, frozen transactions, failed banking relationships, tax disputes and an inability to defend the legitimacy of the structure itself.
The better response is proportionality at each layer: collect what is justified, verify it, protect it, define who may access it and resist turning targeted transparency into indiscriminate publication.
Privacy is not a small-state question
Size, decentralisation, openness and exit do not map neatly onto privacy.
A small state can centralise enormous amounts of personal data. A large federation can distribute data responsibilities. An open economy may participate deeply in automatic exchange. And leaving a jurisdiction rarely deletes the information already held about past periods.
Decentralising data can reduce one concentration risk while creating more endpoints to secure. Centralising data can improve consistency while increasing the consequences of a breach. There is no universal institutional answer independent of purpose and design.
The relevant distinction is therefore not small versus large. It is necessary access versus unnecessary exposure.
What lawful international privacy looks like
A defensible cross-border structure should be able to answer basic questions without improvisation.
Who owns the entity? Where is the person resident? Who manages the company? Where did the funds come from? Why does the transaction make commercial sense? Which institutions are legally entitled to this information?
At the same time, the structure should not create needless exposure. Personal data should not be scattered across providers without reason. Sensitive documents should not be circulated casually. Ownership information that must be filed with a competent authority does not become a justification for publishing the owner’s entire financial life.
The modern privacy principle is therefore demanding in both directions:
do not hide what the law legitimately requires to be known; do not expose what nobody legitimately needs to know.
That is not secrecy. It is institutional restraint.
Sources
- EUR-Lex — General Data Protection Regulation, Article 5
- FATF — Guidance on Beneficial Ownership of Legal Persons
- FATF — Public Statement on revisions to Recommendation 24
- Court of Justice of the European Union — Joined Cases C-37/20 and C-601/20, Luxembourg Business Registers
- OECD — Crypto-Asset Reporting Framework and amended Common Reporting Standard
Disclaimer
This article is general commentary on privacy, financial transparency and institutional design. It does not constitute legal, data-protection, tax or compliance advice. Access rights, beneficial-ownership rules, reporting obligations and privacy protections vary by jurisdiction and should be checked under current law for the specific facts involved.
