Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
RW v Osterreichische Post AG (C-154/21) [2023] 1 WLUK 41
Article 15(1)(c) GDPR gives a data subject the right to know “the recipients or categories of recipient to whom the personal data have been or will be disclosed”. The Austrian Court asked for a preliminary ruling from the ECJ as to whether this requires a data controller to identify with specificity the recipients of personal data, or whether it is sufficient for a data controller to identify those recipients by category. The answer is the former, but with caveats.
The Court noted that in interpreting EU law, there is a requirement to take account not only of its wording but also of its context and objectives, as well as the purpose pursued by the act of which it forms part. Where there is ambiguity, preference must be given to an interpretation which retains the legislation’s effectiveness.
In analysing Article 15(1)(c), the ECJ highlighted that “recipients” and “categories of recipient” are used in succession without any order of priority being discernible between them. There is ambiguity in what the legislation requires. In contrast, recital 63 is more clear, and does not state that the right of a data subject may be restricted solely to categories of recipient. The Court also put weight on the fact that Article 5 requires transparency in the execution of data processing activity, and that one of the purposes of Article 15 is to enable a data subject to determine that his or her data are being processed in a lawful manner.
The ECJ accordingly concluded that “in order to ensure the effectiveness of all the rights [in Articles 16, 17 and 18] the data subject must have, in particular, the right to be informed of the identity of the specific recipients where his or her personal data have already been disclosed”.
Information provided pursuant to Article 15(1)(c) by a data controller must therefore be “as precise as possible”. The data subject may choose whether he or she seeks information about the specific recipients or instead about the categories of recipient. However, it is not an absolute right. Therefore “it may be accepted that, in specific circumstances, it is not possible to provide information about specific recipients. Therefore, the right of access may be restricted to information about categories of recipient if it is impossible to disclose the identity of specific recipients, in particular where they are not yet known.” For good reason, the extent of the right may be different depending on whether the processing has occurred or is yet to occur.
ECJ Decision: click here
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
