How to balance freedom of expression and child protection in the digital age? A comparative legal analysis

Mohammed Abbas Mohsin, PhD in Public Law, Diplomatic advisor 

Photo credit: San Jose Public Library, via Wikimedia Commons

  Abstract

    This blog post presents a comparative legal analysis of the regulatory and judicial frameworks governing the balance between the fundamental right to freedom of expression and the state’s pressing interest in protecting children in the digital age. By examining recent landmark decisions handed down by the Supreme Court of the United States, the Court of Justice of the European Union, the French Council of State, the Italian Regional Administrative Court, and the Supreme Court of England and Wales, this paper analyses how the various judicial authorities in those countries reconcile the requirements for age verification on digital platforms with constitutional safeguards and human rights. This post explores the shift in levels of judicial scrutiny, the extent to which procedural requirements under internal market rules (such as the country-of-origin principle) apply, the unique technical and operational challenges faced by collaborative open-source platforms, and the emerging international consensus that, whilst child protection is of the utmost importance, the regulatory measures employed must remain carefully tailored and procedurally compliant to avoid disproportionate restrictions on adults’ freedom of expression and privacy.

    1. Introduction

    The rapid shift from physical to digital media has led to a radical and evident change in minors’ exposure to sexually explicit content, rendering the traditional restrictions imposed on high-street shops ineffective and unable to keep pace with this problem. Governments around the world have responded by enacting comprehensive age-verification laws targeting online commercial platforms. However, these laws inevitably conflict with the fundamental rights of adult users – who have a constitutional right to access age-restricted content intended for adults – and with digital platforms that rely on the free flow of information.

The key legal conflict lies in determining where the state’s regulatory authority to protect the innocence of minors ends, and where the unlawful restriction of adults’ rights begins.

  This comparative legal analysis examines how various democratic legal systems have addressed this tension. Specifically, it reviews the standard of scrutiny applied to digital age verification laws, the impact of federalism and cross-border economic frameworks, and the unique challenges faced by non-profit cooperative structures in this regard.

 

 

2. The US Constitutional Model: Scrutiny and Incidental Burdens

   The American approach is characterised by the Supreme Court’s strict interpretations of the First Amendment to the Constitution.

  In the case of ‘Freedom of Expression Coalition v. Paxton 2005 ’, the US Supreme Court considered an apparent constitutional challenge to Texas House Bill 1181 (H.B. 1181), which requires commercial entities that distribute sexually explicit content harmful to minors to implement reasonable age verification measures .

   The central constitutional debate in the Paxton case centred on the appropriate level of judicial scrutiny to be applied by the Supreme Court.

   Traditionally, regulations concerning content protected by freedom of expression are subject to strict scrutiny, the most stringent standard in constitutional law, which requires the government to demonstrate that the law is the least restrictive means of achieving a compelling .

   However, the majority opinion, delivered by Justice Thomas, held that Bill No. 1181 was subject only to intermediate scrutiny. in its ruling, the Supreme Court held that the state possesses the traditional authority to prevent minors from accessing speech which it deems obscene from its own perspective; consequently, adults are not entitled, under the First Amendment to the US Constitution, to access such speech without first providing proof of their age.

    Based on the principle established by the Supreme Court in United States v O’Brien, 1968 the majority described the age verification requirement as an ‘incidental burden’ on adults’ right to protected freedom of expression, rather than an outright prohibition

   Under the intermediate standard of judicial review (the intermediate constitutional scrutiny standard), the law was upheld because it advances a substantial government interest unrelated to the suppression of freedom of expression, and does not impose a greater burden on freedom of expression than is necessary.

    The Supreme Court noted that the requirement for age verification is a traditional, widespread and legitimate means of enforcing age restrictions, similar to the purchase of alcohol or firearms

  In a sharp dissenting opinion, Justice Elena Kagan—joined by Justices Sonia Sotomayor and Ketanji Brown Jackson—criticised this analysis, describing it as “entirely circular”. Rather than asking the correct constitutional question —“Does this law impose an unjustified burden on protected adult rights?”—

   the majority defined the constitutional right of adults from the outset as “a right subject to age verification”, and then logically concluded that the law did not violate that right; this is a clear circular logical fallacy that assumes the validity of the conclusion to be proven in order to evade the application of the strict scrutiny standard.

       The dissenting opinion (written by Justice Kagan) held that Texas House Bill 1181 imposes unjustified restrictions on the constitutional rights of adults by virtue of its communicative content—as a direct, content-based regulation—and must therefore be subject to strict scrutiny, in accordance with decades of case law, including the cases of Sable,  Playboy,  Reno and Ashcroft II.

  Justice Kagan emphasised that requiring adults to provide sensitive personal information in order to access controversial content imposes an unacceptable ‘chilling effect’, particularly on the internet, where users fear for their reputation, The dissenting opinion was written and drafted by Justice Elena Kagan and joined by Justices Sonia Sotomayor and Kay Tang Brown Jackson. It held that the law must be subject to strict scrutiny, with Justice Kagan and her colleagues arguing that the Texas law (H.B. 1181) for age verification constitutes a direct content-based restriction on adults’ constitutionally protected freedom of expression, thereby requiring it to be subject to the highest standard of judicial scrutiny in order to protect fundamental rights. Consequently, the dissenting opinion affirmed that if there is a less restrictive alternative (such as user-side content filtering) that could protect children to the same extent, the state must adopt it rather than unnecessarily burdening adult expression .

  

3. The Organisational Structure of the European Union: Market Integration and the Country of Origin Principle

   Unlike the dualistic framework based on the principle of separation between freedom of expression and the state’s freedom in the US Supreme Court’s case law, the European Union’s approach is closely intertwined with the rules of the internal market.

  Under Directive 2000/31/EC (the E-Commerce Directive), the ‘country of origin’ principle ensures that information society services are regulated exclusively by the Member State in which the provider is established, thereby preventing the targeted Member States from imposing additional regulatory burdens.

    In its landmark judgment delivered by the Grand Chamber on 16 June 2026, in the case of WebGroup Czech Republic and Others (joined cases C-188/24 and C-190/24), the Court of Justice of the European Union clarified the limits of Member States’ authority to regulate the protection of minors in the digital sphere.

    The Court of Justice of the European Union held that Articles 2(h) and 3 of Directive 2000/31/EC preclude any Member State from imposing a general and abstract obligation under criminal law to prevent minors from accessing pornographic content from service providers established in other Member States.

     These sweeping criminal obligations undermine the country-of-origin principle by going beyond the procedural and substantive safeguards set out in the Directive.

   These sweeping criminal obligations undermine the country-of-origin principle by going beyond the procedural and substantive safeguards set out in the Directive.

  However, the Court of Justice of the European Union has ruled that, provided there is strict compliance with Article 3(4) of Directive 2000/31/EC, Member States are not precluded from adopting measures requiring specific service providers to establish age-verification systems, provided that those providers have not implemented ,appropriate preventive measures under Article 28b of the Audiovisual Media Services Directive .

     These individual exceptions must be interpreted in the light of Article 1 (human dignity) and Article 24 (rights of the child) of the Charter of Fundamental Rights of the European Union .

   In doing so, the Court of Justice of the European Union established a regulatory framework: general, unilateral restrictions on targeted countries are prohibited, but age verification orders directed at specific platforms may be issued provided that the requirements for procedural consultation and notification are met.

  

4. Transposition of laws and litigation between Member States: France and Italy

   The practical contradiction between protection policies in the target countries and the European Union’s Internal Market legislation is clearly illustrated by recent administrative proceedings in Italy and France.

 4.1 The French Council of State (Conseil d’État)

   France has transposed the requirements for the protection of minors through amendments to Article 10 of Law No. 2004-575 on strengthening confidence in the digital economy, empowering the French national regulatory authority (Arcom) to impose age verification standards.

    In the case of Webgroup Czech Republic and NKL Associates (10 June 2025), the Council of State considered a priority constitutional question (QPC) challenging Article 10-2 of this Act.

   The applicants argued that the Act violates the principle of the personal nature of penalties because it penalises publishers for failures in the age verification system caused by third-party ‘trusted identity’ providers who operate the ‘double anonymisation’ protocol .

   For its part, the Council of State refused to refer the request for approval of age verification to the Constitutional Council, considering that the obligation to ensure age verification in accordance with the law remains a personal responsibility incumbent upon platform operators, and that the exclusion of third-party service providers from the direct scope of Arcom’s enforcement does not raise a fundamental constitutional issue.

    Shortly afterwards, in the case of Hami Media Ltd (xHamster) v Minister of Culture (15 July 2025), the Council of State quashed a court order that had suspended the ministerial decree

subjecting the xHamster website (hosted in Cyprus) to French age verification legislation.

   The Cypriot provider claimed that French law would cause severe economic losses as a result of user migration and a breach of the privacy rights of adult users.

    Under Article L. 521-1 of the Code of Administrative Justice, the suspension of a licence requires proof of an ‘emergency situation’ that outweighs the public interest. The Council of State held that the commercial and privacy-related objections did not satisfy this condition when weighed against the overriding public interest in protecting children from explicit pornographic material .

  

  4.2 The Italian Regional Administrative Court (TAR Lazio)

  In Italy, the Caivano Decree (Article 13-bis of Legislative Decree 123/2023) a general obligation for age verification on pornography platforms operating in Italy, delegating the technical rules to the Italian Communications Authority (AGCOM) .

    The Italian Communications Authority (AGCOM) issued Circular No. 96/25/CONS and subsequent lists of platforms subject to the obligation, thereby extending the age verification requirements to include EU service providers based abroad, including Aylo Freesites Ltd (registered in Cyprus) .

   As a result of this  Aylo challenged the proceedings on several grounds, including breaches of the data minimisation principle set out in the General Data Protection Regulation (GDPR) and the country of origin rule.

   The Lazio Administrative Court of Appeal dismissed the complaints relating to the General Data Protection Regulation and the substantive complaints, concluding that the Communications and Information Technology Authority’s ‘technologically neutral’ standards, adopted following consultation with the Data Protection Authority, respect the principle of data minimisation by prohibiting the retention of identity documents.

   However, the court annulled the automatic extension of the requirements to foreign platforms established in the European Union, as the Italian Communications Authority (AGCOM) had completely disregarded the mandatory procedural requirements laid down in Article 3(4)(b) of Directive 2000/31/EC .

   Under this rule, before any Member State can restrict an information society service from another Member State, it must first formally request the home Member State (Cyprus) to take precautionary measures and notify the European Commission. 

  As the Italian Communications Authority (AGCOM) had not followed this procedure, the Italian court partially annulled the measure, emphasising that host states may not unilaterally impose restrictions on freedom of expression across the borders of the European Union without due regard for the rule of law.

 

5. The United Kingdom and the dynamics of collaborative platforms:

The Online Safety Act 2023

    The ongoing debate in the United Kingdom highlights how broad legislative definitions of digital technologies can inadvertently threaten non-profit digital infrastructures that serve the public interest.

   Under the UK’s Online Safety Act 2023 (OSA), ‘Category 1’ online services are subject to extensive legal obligations, including a duty to ‘empower users’ under Section 15 to allow users to filter out content from unverified accounts .

     In the case of Wikimedia Foundation and Others v Secretary of State for Science, Innovation and Technology (11 August 2025), the host of the Wikipedia website challenged the threshold regulations set out in the Online Safety Act. The Wikimedia Foundation argued that Wikipedia’s collaborative editing model – in which anonymous and attributed edits are dynamically merged – is functionally incompatible with an identity verification mechanism.

    Isolating edits from unverified users would render the encyclopaedia unusable, which would constitute a breach of Article 10 (freedom of expression) of the European Convention on Human Rights.

  The High Court, presided over by Judge Johnson, dismissed the European Convention on Human Rights claims as premature.

   Applying the strict ‘victim status’ criteria reaffirmed by the European Court of Human Rights in the case of ‘Swiss Anti-Espionage Association v. Switzerland’, the court ruled that, as the Office of Communications (Ofcom) had not finalised the Category 1 listing or classification of Wikipedia, the applicants had failed to establish a ‘risk of a future breach’ with sufficient concreteness.

     As regards the substance of the challenges relating to the interpretation and rationality of the law, the court upheld the Secretary of State’s regulations, ruling that the Secretary of State had acted rationally in relying on high-quality research carried out by Ofcom, and that the legislature was entitled to set objective and broad criteria rather than ad hoc decisions.

 

6. Comparative Analysis and Judicial Interpretation

    Comparative analysis and judicial interpretation reveal differing legal classifications of the same legal issue and the technical burden involved.

   In the United States, age verification is considered an incidental, content-neutral burden and is assessed under moderate judicial constitutional scrutiny, thereby reducing the constitutional obstacles facing the states .

   While in the European Union, whilst the substantive right to the protection of minors is highly valued, the legal system focuses on the country-of-origin rule and the strict two-tier procedural approach under Article 3(4) of the E-Commerce Directive . 

  Administrative cases in France and Italy show that platforms established in EU Member States (such as Cyprus) are protected from abuses by the host state, unless those states fully comply with the requirements for notification and consultation.

   Finally, the UK’s experience serves as a warning that a failure by legislative bodies to narrow the scope of definitions may ensnare non-commercial collaborative platforms serving the public interest, such as Wikipedia, thereby threatening to fragment the open internet under the guise of safety.

 

7. Conclusion

Striking a balance between freedom of expression and child protection in the digital age is not merely a technical challenge, but a matter central to the constitutional framework.

 Recent judicial consensus agrees on the urgent need to protect minors. However, the legal approaches taken vary considerably: the United States applies a lenient standard of scrutiny with regard to ‘incidental’ restrictions, whilst the European Union imposes a strict procedural framework to preserve the single digital market; administrative courts exercise close oversight of regulatory compliance.

  As digital platforms continue to evolve, the challenge remains to implement verification systems that are secure, privacy-preserving and procedurally sound, protecting children without fragmenting the global flow of knowledge or restricting adults’ freedom of expression online.

 

The interplay between corporate transparency and personal data protection: A new stage in the CJEU’s case law

 

Dr Samira Allioui, Centre d'études internationales et européennes, Université de Strasbourg

Photo credit: Alexas Fotos, via Wikimedia Commons

On 3 September 2026, the Court of Justice of the European Union (the Court) delivered its judgment in Case C-798/24, Jautiva, addressing the compatibility of unrestricted public access to shareholder information with European Union (EU) company law and data protection rules. The CJEU ruled on the conflict between, on the one hand, the right to the protection of personal data and, on the other, national legal provisions—derived from European Union law—requiring the public disclosure of information regarding the shareholders of public limited companies. The Jautiva case addresses precisely where that boundary lies. This approach is not new; it follows on from the WM and Sovim judgment of 2022 (Joined Cases C‑37/20 and C‑601/20), in which the CJEU had already called into question public access to ultimate beneficial owner (UBO) registers and where the judges had already cast doubt on unrestricted public access to beneficial ownership registers.

WM and Sovim SA v. Luxembourg Business Registers (LBR): an ode to business confidentiality?

As a reminder, in the WM and Sovim judgment, the CJEU had already called into question public access to registers of beneficial owners. The judgment represented a serious setback to European Union efforts to promote fiscal and financial transparency and to enhance the effectiveness of the fight against money laundering. Making beneficial ownership registers public was one of the key tools for identifying a company’s true owner and, in doing so, lifting (at least in part) the veil on illicit schemes that facilitate money laundering and tax evasion.

The cases in question concerned the transposition into Luxembourg law of Article 30(5), first subparagraph, point (c) of the 2015 money laundering Directive, as amended in 2018 (the Fifth Anti-Money Laundering Directive or "5AMLD"). In accordance with 5AMLD, the legislation had structured the Luxembourg Register of Beneficial Owners (RBE) so that information regarding the beneficial owners of registered entities could be stored and made available; access to this data was open to any member of the general public. In certain exceptional circumstances and on a case-by-case basis, a beneficial owner or registered entity could request the register administrator—LBR—to restrict access to specific authorities or entities. After a beneficial owner and a company challenged decisions by the LBR rejecting their requests to restrict public access to information concerning them, the referring court—the Luxembourg District Court—considered that the disclosure of such information could entail a disproportionate risk of infringing the fundamental rights of the beneficial owners concerned. It therefore asked the Court, inter alia, to verify the validity of the EU provisions regarding access to information on beneficial owners.

The Court first noted that, since the data in question includes information on identified natural persons—namely the beneficial owners of companies and other legal entities established within the territory of Member States—access to that data by any member of the general public infringes the fundamental right to respect for private life.

Furthermore, making such data available to the general public constitutes the processing of personal data. Such disclosure represents a serious interference with the fundamental rights enshrined in Articles 7 and 8 of the EU Charter of Fundamental Rights (CFR), given the potential for subsequent use of the disclosed information.

Admittedly, the Court had already had the opportunity to point out that certain data processing operations—even those that do not reveal significant information about individuals' private lives—can nonetheless constitute an infringement of their privacy when the data, taken as a whole, expose individuals to a "risk of profiling." However, it is important to point out that in those cases, the Court reached this conclusion either by highlighting the “sensitive nature of the information that such data may reveal” or because the data in question made it possible to draw very precise conclusions regarding the individuals’ daily habits, activities, and social relationships (the Digital Rights judgment, para 27).

However, as Advocate General Pitruzella noted in his Opinion on the case (at para 101), the risk of profiling enabled by the public nature of the registers was limited, both because it was not possible to conduct searches by individual and because identifying a person’s investments provides only a limited insight into their assets.

The concept of "legitimate interest": an inadequate remedy for the lack of public access to registers in WM and Sovim SA

When examining the justification for this interference, the Court confirmed that the provision regarding public access to the information complies with the principle of legality, does not infringe the essence of the fundamental rights, pursues an objective of general interest, and can be considered appropriate for achieving that objective.

However, the Court held that the interference could not be considered limited to what is strictly necessary. In this regard, the Court compared the amended provisions with the previous provision, which required organizations or individuals to demonstrate a "legitimate interest" before gaining access to information on beneficial owners. Furthermore, the Court held that any difficulty in precisely defining the circumstances and conditions under which such a "legitimate interest" arises does not justify the EU legislature providing the general public with access to that information.

In addition, the Court emphasized that the interference at issue is not proportionate stricto sensu. Thus, the optional provisions allowing Member States to make information on beneficial owners available subject to online registration and to provide, in exceptional circumstances, for an exemption from public access to that information are not, in themselves, capable of demonstrating either a fair balance between the general interest objective pursued and the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Right (CFR), or the existence of sufficient safeguards enabling the persons concerned to effectively protect their personal data against the risk of abuse.

Consequently, the amended point (c) of the first subparagraph of Article 30 of the AML Directive—which requires Member States to ensure that information on the beneficial owners of companies and other legal entities incorporated within their territory is accessible to any member of the general public in all circumstances—is invalid.

The Court emphasized that the EU legislature had not struck the right balance regarding the fight against money laundering. There were fears at the time that this would "have fraudsters rubbing their hands with glee," and these rulings sparked anger among activists, who were shocked that a court would side with the leaders of tax havens at the expense of public transparency. Others, however, maintained that this represented a victory for data protection and the rule of law within a highly politicized context.

While in WM and Sovim SA v LBR, the Court annulled the 5AMLD provision granting the public access to beneficial ownership registers, Jautiva applies the same logic to a different dataset: declarations by shareholders of public limited companies.

Following the WM and Sovim judgment, several registers went beyond what the ruling required by withdrawing entire datasets. In several Member States, this practice remained effectively suspended while national regimes based on "legitimate interest" were being established.

Background of the Jautiva case: a clarification of public access to shareholder information

The Jautiva case arose when 17 minority shareholders of a public limited company challenged legislation requiring shareholder information to be made publicly available online. For natural persons, this information included their identity and contact details, as well as the class, number, and nominal value of the shares held and the associated voting rights. This information was accessible to unidentified users and could therefore be downloaded in bulk.

To justify this disclosure regime, Latvia cited three main objectives: preventing money laundering and the financing of terrorism and proliferation; ensuring a transparent economic environment and protecting third parties; and facilitating compliance with national, international, and EU sanctions.

To determine whether EU company law required such disclosure and whether unrestricted access was compatible with the GDPR (Articles 7 and 8 of the CFR), the Latvian Constitutional Court referred the matter to the Court. In its request, the Constitutional Court, among others, sought clarification, as to whether EU company regulation requires information on every shareholder of a joint-stock company to be made publicly available and whether such disclosure of personal data is permissible under the GDPR.

Article 14 of the Company Law Directive requires the disclosure of information concerning certain persons who represent a company or participate in its administration, supervision, or control. In its reasoning, the Court rejected the argument that this concept extends to any shareholder. Indeed, whereas persons involved in the administration or supervision of a company are appointed to specific roles and exercise corresponding powers, shareholder status derives from holding a stake in the share capital. In particular, minority shareholders do not exercise management or supervisory functions simply by virtue of holding shares, nor do they generally represent the company or bind it in dealings with third parties. The Court therefore concluded that the Company Law Directive does not require information concerning every shareholder to be made available to the public.

Disproportionate access but legitimate objectives

Next, the Court examined whether Latvia could nonetheless provide for unrestricted public access under its national law. While the objectives cited by Latvia could constitute legitimate objectives of general interest, this did not exempt the disclosure regime itself from meeting the requirements of necessity and proportionality laid down in the GDPR and the CFR.

The Court held that such public disclosure constituted a serious interference with the rights protected by Articles 7 and 8 of the CFR. The information made public could enable the creation of a profile regarding a person’s financial situation, the sectors in which they invest, and the companies in which they hold shares. These concerns were heightened by the fact that the information was accessible online to a potentially unlimited number of people and could subsequently be stored and disseminated (§71).

In light of recent events in Latvia, where several public databases were subjected to cyberattacks and large-scale personal data breaches, the observation made by the Court in paragraph 72 is particularly relevant:

"The potential consequences for the data subjects resulting from any misuse of their data are aggravated by the fact that, once such data have been made accessible to the public, they can not only be freely consulted but also stored and disseminated, and that, in the event of such successive processing operations, it becomes increasingly difficult—if not impossible—for those persons to defend themselves effectively against misuse."

Regarding corporate transparency

The Court considered that the disclosure of information concerning all shareholders—particularly minority shareholders who do not exercise management or control functions—did not appear necessary for the protection of third parties.

Objectives related to combating money laundering and complying with sanctions regimes did not justify unrestricted access either. Given the existence of less intrusive solutions—such as limiting access to persons who can demonstrate a legitimate interest and, for sanctions purposes, adopting more targeted disclosure methods—the existence of a recognized public interest objective does not, in itself, justify making personal data freely accessible to everyone.

Necessity and proportionality

In WM and Sovim v LBR, the Court held that unrestricted public access to beneficial ownership information constituted a serious interference with the rights protected under Articles 7 and 8 of the CFR and went beyond what was strictly necessary for AML purposes.

Jautiva applies the same proportionality considerations in the context of registered shareholders which is relevant in particular for minority shareholders who may neither qualify as beneficial owners under applicable thresholds nor exercise control over the company. The judgment does not prevent Member States from maintaining company registers or providing access to shareholder information. However, it does confirm that the manner in which personal data are made available must remain consistent with the GDPR principles of purpose limitation, data minimisation and proportionality. It should be noted that Directive 2024/1640, part of the sixth money laundering package (adopted after the WM and Sovim judgment), already provides for access to beneficial ownership information by members of the public who can demonstrate a legitimate interest, alongside the access available to competent authorities and obliged entities. In other words, the current EU AML framework has already moved towards a more restricted model of access.

Legitimate interest and the limitations surrounding access to ownership-related personal data

Jautiva confirms that access to such information cannot be treated as unlimited and remains subject to the requirements of necessity, proportionality and data protection. Here, the Court reiterates that transparent is not an end in itself by holding that the Company Law Directive does not require the disclosure of information relating to all shareholders, including minority shareholders. In addition to that, it held that the GDPR precludes national legislation making personal data relating to shareholders of public limited liability companies available to the general public where access is not subject to any conditions, such as demonstration of a legitimate interest.

It is surprising that the legitimacy of the objectives provided by Latvian law has not been called into question. More precisely, Latvian law provided for public access to data concerning all shareholders of a public limited company, including minority shareholders, for the purposes of combating money laundering, terrorist financing and the proliferation of weapons of mass destruction, as well as implementing international and European sanctions.  

The dual scope of the decision

First, it should be noted that the tools available to obliged entities to fulfil their due diligence obligations, and to competent authorities, are not called into question by the judgment. Second, the imposition of sanctions or the pursuit of AML/CFT objectives does not justify unlimited public access. Indeed, the Court advocates instead for the implementation of differentiated access regimes based on the objective pursued and the status of the requester. However, it is worth considering who will henceforth be able to claim a legitimate interest justifying access to this information.

By confirming that the disclosure obligations imposed by European Union company law cannot be interpreted as automatically extending to information concerning all shareholders—and that national measures providing for broader public access to such information remain subject to the GDPR as well as the principles of necessity and proportionality—the Jautiva judgment marks a new milestone in Court case law regarding the interplay between corporate transparency and the protection of personal data.

Conclusion

Given that these are distinct legal categories—potentially entailing different obligations regarding access, reporting, and disclosure for investors, international groups, and companies—the judgment underscores the importance of clearly distinguishing between the exercise of corporate functions, the holding of shares, the exercise of control, and the status of beneficial owner.

On the one hand, the judgment clarifies that a national regime authorizing unlimited and unconditional online access to the personal data of all shareholders must meet a strict test of necessity and proportionality. On the other hand, the judgment provides an important clarification regarding corporate transparency: EU law does not require the public disclosure of information concerning every shareholder of a public limited company simply by virtue of their status as a shareholder.

More specifically, the significance of this judgment does not lie in pitting the protection of privacy against transparency as mutually exclusive values. Rather, the judgment requires that any disclosure obligation be based on a legal basis and remain proportionate to the objective pursued.

The Jilin Judgment (Case C‑249/25): Can Member States Suspend Asylum Procedures During Temporary Protection, and for How Long?

 

Dr Meltem Ineli Ciger, Associate Professor of International Law, Süleyman Demirel University

Photo credit: Maksym Kozlenko, via Wikimedia Commons

On 1 October 2026, the Court of Justice delivered Case C‑249/25 (Jilin), its fourth preliminary ruling on the Council Directive 2001/55/EC (Temporary Protection Directive, ‘TPD’) since the Directive was activated for people displaced from Ukraine. It follows Joined Cases C‑244/24 and C‑290/24 Kaduna (19 December 2024), Case C‑753/23 Krasiliva (27 February 2025) and Case C‑195/25 Framholm (20 November 2025), all discussed on this blog (here, here and here). The question in Jilin is: can a Member State suspend processing of applications for international protection of temporary protection beneficiaries until temporary protection ends? The Court’s answer is no, subject to an exception for cases of ‘objective impossibility’. This post summarises the judgment and then examines what the Court left undefined. It criticises the absence of any explicit reference to international refugee law as well as the requirements of necessity and proportionality in the Court’s assessment.

·         The facts and the questions referred

UB, a Chinese national of Uyghur origin, arrived in the Netherlands on 7 March 2022 with his Ukrainian wife and their child, and applied for asylum on 13 April 2022. During the examination, the Dutch authorities found that, as the family member of a Ukrainian national who had lived in Ukraine before 24 February 2022, he qualified for temporary protection. They therefore stopped examining his asylum claim, on the basis that it could resume once temporary protection expired (para 22). Article 43a of the Dutch Aliens Act 2000 allows this: for temporary protection beneficiaries, a decision on an asylum application may be taken at any time up to six months after temporary protection ends (para 19).

UB sent a formal notice of default in January 2024 and then brought an action for failure to act. The District Court of The Hague held that the 21‑month maximum time limit had started to run when the application was lodged, ordered the Minister to decide within eight weeks. On the Minister’s appeal, the Raad van State asked the Court of Justice two questions:

(1)   Does Article 17(2) of the TPD allow Member States to suspend the examination of an application for international protection made by a temporary protection beneficiary for the duration of temporary protection?

(2)   Do the time limits in Article 31 of the Directive 2013/32/EU (Asylum Procedures Directive, ‘APD’) start or resume running only when temporary protection ends, where the application was made before or during temporary protection?

Article 17(1) of the TPD provides that ‘[p]ersons enjoying temporary protection must be able to lodge an application for asylum at any time’; paragraph 2 adds that ‘[t]he examination of any asylum application not processed before the end of the period of temporary protection shall be completed after the end of that period.’ Article 31 of the APD sets the timetable for the regular procedure. A decision must be taken within six months of the lodging of the application (Article 31(3)). That period may be extended by up to nine months where complex issues of fact or law arise, where a large number of people apply simultaneously, or where the delay is attributable to the applicant; in duly justified circumstances, it may be exceeded by a further three months. Where the situation in the country of origin is uncertain but expected to be temporary, the decision may be postponed, subject to six‑monthly reviews (Article 31(4)). ‘In any event’, the procedure must be concluded within 21 months of the lodging of the international protection application (Article 31(5) of the APD).

Under Article 4 of the TPD, temporary protection should have lasted no more than three years. In practice, the Council has repeatedly prolonged the regime for people displaced from Ukraine, most recently until 4 March 2028 (Council Implementing Decision (EU) 2026/1912). In doing so, it has turned an exceptional, time‑bound emergency response into an open‑ended EU policy (see here, here, here and here). On the Dutch reading, an asylum claim lodged in spring 2022 might not have to be decided until late 2028.

·         The judgment

The Court joined the two questions and reformulated them as whether Article 17(2) of the TPD and Article 31 of the APD preclude national authorities from ‘automatically suspending’ the examination of international protection applications lodged by temporary protection beneficiaries, so that the decision time limit does not begin or continue to run until temporary protection has ended (para 34). The Court said yes and noted that such an automatic suspension is unlawful, whilst clarifying that Member States may only temporarily defer individual examinations beyond statutory deadlines in exceptional circumstances where strictly necessary to address an objective impossibility and prevent system collapse (para 64). The judgment provides three reasons.

First, the Court held that Article 17(2) of the TPD only governs what happens to applications not processed before the end of the temporary protection period. It says nothing about whether MS can suspend asylum applications during temporary protection (para 38) (This is also in line with Skordas’ assessment here p. 1213). Temporary protection should not prejudge recognition of refugee status under the 1951 Convention (Article 3(1)); beneficiaries must be able to apply for asylum ‘at any time’ (Article 17(1)); and a person whose asylum application is rejected continues to enjoy temporary protection (Article 19(2)). The Court noted that the legislature, in light of all these provisions, therefore envisaged that asylum procedures would run during temporary protection (paras 39–41). The Court, in line with the AG opinion, reasoned that the Commission’s original proposal included an option to suspend asylum procedures during temporary protection, but Member States could not agree on it and dropped it. No such power can therefore be read into Article 17(2) by implication (paras 42–44, following points 42–45 of Advocate General Campos Sánchez‑Bordona’s Opinion).

Second, the Qualification Directive and the APD apply to all applications for international protection, and nothing excludes applicants who already enjoy temporary protection. Article 31 of the APD time limits therefore apply ‘in principle’ to them as well (paras 45–48). In the Court’s view, Article 31 already takes account of pressure on asylum systems: it allows an extension of up to nine months where large numbers apply simultaneously, a further three months in duly justified circumstances, and postponement for an uncertain situation in the country of origin, all within the 21‑month limit (paras 49–53).

Third, a general and automatic suspension is not necessary to achieve the Directive’s aims (para 54). The TPD is meant to protect asylum systems from being overwhelmed, but it is also meant to ensure that beneficiaries keep ‘a real opportunity to obtain international protection’ once their situation has been examined (para 56). An EU‑wide activation of temporary protection does not mean that every Member State faces more applications than it can handle (para 58). When temporary protection expires, the authorities would face exactly the simultaneous surge of applications that temporary protection was supposed to prevent (para 59).

Having rejected automatic or a blanket suspension, the Court nonetheless recognised an exception. The Court noted it cannot be entirely excluded that a considerable number of applications lodged by temporary protection beneficiaries over a short period will make it ‘objectively impossible’ for a Member State to decide them all within the Article 31 time limits, ‘despite all the reasonably conceivable measures to deal with such an influx’ (para 60). In that case, the State may take measures such as examining applications in phases and setting priorities. This may lead it to defer the examination of some applications temporarily, even if not every application can then be decided within the Article 31 time limits (paras 61–62). National courts must check, in each case, that a missed deadline is not the product of a general and automatic suspension and results only from measures that are necessary to deal with the objective impossibility (para 63).  

·         Analysis

1. The tension of the judgment with the logic of temporary protection

The judgment sits uneasily with how temporary protection is usually understood. Under Article 2(a) TPD, the very purpose of immediate, group‑based protection is to avoid an asylum system being overwhelmed by a mass influx (para 35). In international practice, temporary protection has generally worked by suspending individual refugee status determination.

Jilin confirms that the EU took a different path in 2001. The Member States considered a suspension power and chose not to adopt one (para 42). What they kept instead was Article 19(1), which allows States to provide that a person cannot hold temporary protection and asylum‑seeker status at the same time. The result of the Jilin is that, in EU law, temporary protection can run alongside the asylum procedure. Whether that model can actually deliver on the aim stated in Article 2(a) is a fair question. The Court answers that Article 31 APD already provides the flexibility needed (para 53).

2. An exception that leaves much to explain

The difficulty is that the Court then created an exception that it barely defines. Four questions are left open. What counts as ‘objective impossibility’? The Court requires a ‘considerable number’ of applications ‘over a short period’ and the exhaustion of ‘all the reasonably conceivable measures’, but gives no threshold, no indicators and no burden of proof. Whether a State has hired enough staff, reallocated resources or used the accelerated procedures available to it will be argued case by case before national courts.

How does the exception fit with Article 31 itself? At para 53 the Court tells us that Article 31 already reflects the legislature’s ‘due consideration’ of pressure caused by simultaneous applications, which is why automatic suspension is unnecessary. However, paras 60–62 allow those same calibrated limits to be exceeded.  

Does it reach beyond 21 months? Article 31(5) of the APD requires the procedure to be concluded ‘in any event’ within 21 months. The operative part of the judgment allows deferral ‘including by exceeding that decision‑making period’, without saying whether the 21‑month limit is included. If it is, the Court has created a judge‑made derogation from a limit the legislature described as absolute.  

For how long, and for whom? Deferral must be ‘temporary’, and concern only ‘some’ applications, but the Court sets no outer limit and gives no criteria for prioritisation. Nothing in the judgment prevents a MS from prioritising other caseloads and leaving temporary protection beneficiaries at the back of the queue, which is the outcome Jilin was meant to prevent.

The exception will also apply unevenly. Para 58 makes clear that the test is specific to each State. The relevant variable, however, is not how many temporary protection beneficiaries a Member State hosts but how many asylum applications they lodge in a short period (para 60). Can a MS hosting large numbers of Ukrainians who never apply for asylum not rely on the exception? Can only Germany, Poland or Czechia make use of this possibility? What about other MS hosting a smaller number of temporary protection beneficiaries? These are the questions, in my opinion, left open.

3. What is missing? The international refugee law dimension and the doctrine of derogation

The international refugee law is absent from the judgment. The TPD makes explicit reference to the 1951 Convention. Recital 10 states that temporary protection ‘should be compatible with the Member States’ international obligations as regards refugees’ and ‘must not prejudge the recognition of refugee status pursuant to the Geneva Convention’, and Article 3(1) repeats the point. All Member States are parties to the 1951 Convention and its 1967 Protocol; Article 78(1) of the TFEU requires the EU’s asylum policy to be in accordance with the 1951 Convention, and Article 18 of the Charter guarantees the right to asylum ‘with due respect for’ the Convention.

This matters because temporary protection, conceived as a short emergency response, now routinely becomes protracted. Temporary protection for people displaced from Ukraine will have lasted six years by March 2028. When protection is prolonged, suspending individual status determination can no longer be explained simply as managing an emergency. The 1951 Convention contains no general derogation clause (cf. Durieux and McAdam 2004).  One of the issues which deserved attention, in my opinion, was therefore whether a State Party to the 1951 Convention may, for years, deny people who may well be refugees access to the asylum procedure through which they can claim the Convention rights that build up with lawful and durable stay. However, one should frame such a departure from the Convention as a derogation, as a necessity under general international law or by analogy with human rights derogation clauses; any derogation must be necessary, proportionate and temporary (see, for a fuller analysis, section 2 of this article). International refugee law scholarship has examined this question in depth (cf. Edwards 2012; Durieux 2014). I argued that a genuine mass influx may justify temporarily setting aside individual procedures. It is far less clear that a suspension lasting several years can meet the requirements of necessity and proportionality under international or EU law.

The Court did not engage with any of this. Its analysis stays within the relationship between the TPD and the APD. It never addressed or took into account whether deferring asylum procedures for up to six years is compatible with the 1951 Convention, even though Recital 10 and Article 3(1) of the TPD point straight to that question. It is worth mentioning the Advocate General’s Opinion (paras 60-65), in which he relied on Article 18 and on Article 52(1) of the Charter; he came close to taking these issues into account. Ironically, the outcome of Jilin is broadly what an international law analysis would support: no automatic, open‑ended suspension. But because the Court reached it through EU asylum acquis alone, it left the exception in paras 60–63 without an explicit necessity and proportionality framework that international law would have supplied.

Conclusion

Jilin is quite a vague judgment that leaves much to be discussed, especially given the new exception it introduces to the ban on general suspension of asylum procedures. Although the Court relied on objective impossibility as a ground, it does not make clear when Member States may continue to defer the processing of international protection claims lodged by temporary protection beneficiaries.

Jilin is the CJEU’s fourth preliminary ruling on the TPD, and it repeats a pattern visible in the earlier three. The Court reads the Directive carefully on its own terms and contrasts it with another instrument of the EU acquis but engages little with the international origins of temporary protection, its relationship with the 1951 Convention and leaves unresolved the basic tension between prolonged temporary protection and Member States’ obligations under the 1951 Convention.  

The judgment will matter well beyond UB’s case. Since 12 June 2026, applications lodged after that date are governed by the Asylum Procedures Regulation (Article 35 of Regulation (EU) 2024/1348), which shortens the extension for large numbers of simultaneous applications to six months, though it does not impact the backstop 21-month time limit. Jilin’s reasoning, that the general asylum time limits apply to temporary protection beneficiaries unless the legislature provides otherwise, is likely to carry over to the new regime. The exception created by the judgment may become even more attractive to States as a result. As the Court itself warned (para 59), Member States that suspended asylum claims face the prospect of a surge of pending decisions when temporary protection ends in March 2028. Jilin requires them, to a certain albeit vague extent, to start deciding on those claims now.