
Articles5 and 6 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in the light of Articles7 and 8 of the Charter of Fundamental Rights of the European Union,must be interpreted as precluding national legislation which requires personal data relating to all the shareholders, including minority shareholders, of public limited liability companies relating to the identity and contact details of each shareholder, the class, number and nominal value of the shares held by that shareholder, and the number of votes attaching to those shares, to be made available to the public in order to ensure a transparent business environment so as to protect the interests of third parties, prevent money laundering and the financing of terrorism and the proliferation of weapons of mass destruction, and provide the information necessary for the implementation of national, international and EU sanctions, where access to such data is not subject to any conditions, such as demonstrating a legitimate interest.

Points (d) and (e) of the first subparagraph of Article 6(1) of Regulation 2016/679 must be interpreted as meaning that the processing of personal data by the operator of an online social network, which entails the collection of data of the users of such a network from other services of the group to which that operator belongs or from visits by those users to third-party websites or apps, the linking of those data with the social network account of those users and the use of those data, cannot, in principle and subject to verification by the referring court, be regarded as necessary in order to protect the vital interests of the data subject or of another natural person, within the meaning of point (d), or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, within the meaning of point (e);