The Advocate General at the Court of Justice of the European Union has published the opinion on the data protection rules that apply to Financial Intelligence Units (FIUs). Read the press release regarding case C-222/25 (Rahapesu Andmebüroo), which states the following regarding access rights:
Secondly, under EU law, a total prohibition on access to personal data held by FIUs may be compatible with their mission to safeguard strict confidentiality. However, any such restriction must comply with the principle of proportionality, which requires it to be limited in scope and duration to what is necessary to achieve the legitimate aim.
It must also be anchored in legislation that provides clear and precise rules governing its scope and application. This legislation must provide the minimum safeguards necessary to prevent data abuse or unlawful access, and enable the supervisory authority and the courts to exercise effective control over decisions regarding restrictions.
The conditions for restricting access rights in order to protect against misuse or unlawful access may be set out not only in a single legislative act, but also in a coherent set of legislative and subordinate acts that together define the limitations, provided that this set allows for a clear and precise understanding of the scope of the restriction and that it is foreseeable by the persons subject to it. However, in the present case, it does not seem that the applicable legal framework sets out clear conditions for restricting the right of access. It is for the national court to assess whether such restrictions comply with the standards set out in EU law.
Thirdly, to compensate for the absence of a direct right of access, the rights of data subjects must be indirectly protected through the supervisory authority. The authority must then be empowered to hold confidential discussions with FIUs to determine precisely which data are required for the data subject to obtain an effective judicial remedy.
Finally, EU law permits FIUs to refuse a data subject access request without providing reasons when disclosure would endanger the public interest. In such cases, however, the FIU must inform the data subject of the possibility of exercising their rights indirectly through the supervisory authority.
