The Court of Justice of the European Union (“CJEU“) has recently provided its judgement on the scope of the right of access under Article 15 of the General Data Protection Regulation (“GDPR“), concerning the rights of data subject to receive information about third parties with whom their personal data was shared by the controller.

The decision comes following a request by an Austrian data subject, which was filed with the Austrian postal services company, to exercise his right of access, and requesting the disclosure of the identities of recipients with whom his personal data was shared. In its initial response, the Austrian postal services company provided the data subject with the purposes of processing, stating that it shares such personal data with trading partners for marketing purposes, and referred the data subject to its website for more information.

After the data subject has brought legal proceedings against the company, it agreed to disclose to the data subject the categories of third parties with whom personal data may be shared, without sharing their specific identities.

Having been rejected by the courts of first instance and appeal, the data subject appealed to the Supreme Court of Austria, which referred the case to the CJEU. The question in front of the CJEU was whether Article 15 of the GDPR leaves the controller the choice to disclose either the categories of recipients or the specific identities of such recipients, or whether it is the data subject’s choice to decide on the required granularity.

In its decision, the CJEU adopted the opinion submitted by the European Union’s Advocate General, and concluded that in cases where personal data was disclosed to third parties, controllers are obliged to provide the data subjects, upon request, with the actual identities of the specific recipients. According to the CJEU, such interpretation is in line with the recitals of the GDPR and its purposes. The right of access under Article 15 of the GDPR, including information about the specific recipients, is necessary to enable data subject to exercise their other rights conferred under the GDPR.

It should be noted that for the purposes of the judgement, the CJEU differentiated between the controllers’ obligations to disclose the recipients or categories of recipients under Article 13–14 and the obligation under Article 15. Meaning that controllers shall not be obliged to disclose their specific recipients in their privacy notices, but rather upon request to exercise the right of access.

As data subjects right are not absolute, controllers may be exempted from the obligation to disclose the identities of recipient in specific circumstances where it is impossible to disclose such information, such as in instances where it is unknown, or when the requests are manifestly unfounded or excessive.

Feel free to contact us if you have any queries regarding the CJEU judgement and its implications.