Transparency under pressure in Luxembourg and Spain

Luxembourg has always been an outsider in Europe, often labelled as a tax haven for companies. Whereas the National Bank of Belgium offers open access to three years of historical annual accounts for a limited fee via a licence and an API, Luxembourg has closed its doors. Until recently, the information could still be scraped, but new security measures have completely blocked that route.

The consequences are obvious:

• No API, no licence, no bulk access. 
  Anyone who wants information must request each annual report separately. This is a costly and therefore unfeasible operation for data providers and analysts.
• Everyone is in the same boat.
  No player focusing on the Luxembourg business information market has full access anymore.

However, Luxembourg has around 145,000 companies, of which around 80% are required to publish their balance sheets. This percentage is much higher than in Belgium, which should promote transparency. But public access to this data has virtually disappeared.

This is no coincidence. The country built its financial appeal precisely on secrecy, discretion and limited transparency. Transparency is not a priority there, but a threat to the established model.

‘The quality of business information in Luxembourg will therefore always be inferior to that found in other countries. There is no other explanation. It is simply in the country's DNA, which every data provider has to deal with,’ says Peter Gazelle, Managing Director of GraydonCreditsafe.

This development is part of a broader trend in which Luxembourg, together with Liechtenstein, applies a minimalist interpretation of European transparency rules. Although there are EU directives that require companies to publish annual accounts, national implementation remains limited. Or deliberately cumbersome.

Spain also recently restricted access to company data, albeit for a different reason: data protection. The Spanish Data Protection Authority (AEPD) decided that data from sole traders should no longer be available unless the person concerned gives their explicit consent.

Sole traders often use information that can be interpreted as both professional and private. Incidentally, the Spanish identification number for sole traders is linked to the date of birth of the person in question, which is a sensitive matter.

In concrete terms, this means that thousands of Spanish sole traders must be removed from commercial databases. Not just from GraydonCreditsafe, but from all data suppliers.

The AEPD invokes the LOPDGDD (Ley Orgánica 3/2018), the Spanish implementation of the GDPR, which provides stricter protection for the personal data of natural persons with commercial status.

This decision exposes a fundamental area of tension:

• Open data versus privacy. Transparency about business activities clashes directly with the protection of personal data.
• Economic impact. Companies that use business information for credit analysis, risk management or fraud prevention are losing an important source of information.

Whereas Belgium explicitly defines sole proprietorships as “companies” in the Companies Act of 2019 and the Insolvency Act of 2018, Spain considers them to be natural persons. This means they have full privacy rights. It shows how European policy is not applied uniformly, despite thirty years of attempts at harmonisation.

The European Union is trying to stimulate the reuse of public data with initiatives such as the EU Data Act and the Open Data Directive (2019/1024). However, in practice, national interests tend to prevail.

• Transparent core countries such as Belgium, the Netherlands, and France see open data as a lever for innovation and trust.
• Protective regimes such as Luxembourg, Germany, and Spain focus more on discretion, competitive position, or privacy. Without the necessary transparency, it will be quite a challenge in those countries to comply with the AML guidelines.

These divergent views lead to a fragmented data landscape. Every market participant must constantly balance legal restrictions, commercial needs, and societal expectations.

For data suppliers and users of business information, the message is clear:

1. Accept differences between countries. Don't expect the transparency or timeliness of data in countries like Luxembourg or Spain to be the same as in Belgium.
2. Differences can also be an added value. By integrating all sources into a single, uniform platform, GraydonCreditsafe can create value where others remain fragmented.
3. Monitor European developments. New regulations, such as the Data Act and the Artificial Intelligence Act, will create new frameworks for data access and reuse.

The battle between transparency and protection is far from over. Luxembourg opts for discretion, Spain for privacy, and the European Union for uniformity. So far, without result.

However, there is a clear argument in favour of transparency. When a limited liability company goes bankrupt or is declared insolvent, the damage is averted to society. Sole proprietorships are also embedded in the economic fabric, and that inevitably entails risks. From that perspective, doesn't it make sense that transparency is crucial to limiting the damage, for which the community bears the brunt?

For organisations that work with corporate data, the challenge is clear: it is becoming more difficult to do business "securely" in certain countries.

In a world where data is becoming increasingly scarce, trust is the ultimate currency.