On 12 January 2023, the Court of Justice of the European Union (CJEU) delivered its ruling in Case C-154/21 (RW vs Österreichische Post AG) holding that, when exercising their right of access under the GDPR, the data subjects must be provided, as a rule, with the concrete name of the data recipients, and not only the categories of such data recipients.
In brief, RW exercised its right of access under the GDPR against the Austrian Post, aiming to find out which personal data concerning him were processed by the Austrian Post, including the recipients to whom these data might have been disclosed. In response, the Austrian Post reverted with categories of recipients, instead of naming specific recipients.
The case was brought before CJEU and the court held that the right of access implies that “if data have been or will be disclosed to recipients, the controller is obliged to inform the data subject of the identity of the recipients”. CJUE also provides two exceptions from this rule, i.e.:
- unless it is not possible to identify the recipients, or
- the controller proves that the data subject’s requests for access are manifestly unfounded or excessive within the meaning of article 12 (5) of the GDPR.
According to CJEU, if the controller falls within any of the aforesaid two exceptions, it would be sufficient to inform the data subject only of the categories of recipients concerned, and not also on their concrete identity.
It is worthy to mention that previously, on 9 June 2022, Advocate General Giovanni Pitruzzella issued his opinion in the same case, having the same optic, with the nuance that in his view, the right of access “must necessarily extend, where the data subject so requests, to the identification of the specific recipients to whom his or her personal data are disclosed.” CJUE has not taken over this nuance from the opinion of the Advocate General, so that it seems that the controller must provide, as a rule, the concrete names of recipients, even if the data subject did not request this degree of detail.
The CJEU’s press release mentions the detail that the concrete names of recipients must be provided if the data subjects request so. However, given the fact that the press release is only an unofficial document for media use (as it is expressly mentioned therein), the text of the CJEU ruling would be prevailing.
