Disclosing recipients of personal data

Every individual has the right to know to whom his or her personal data have been disclosed, the Court of Justice recently affirmed. It is only in exceptional circumstances that it is permissible for the controller of such data to indicate only the categories of recipients, rather than identify the actual recipients themselves.

Among other rights enjoyed by a data subject in terms of the General Data Protection Regulation (GDPR) is the right of access to one’s personal data. In terms of this right, the data subject is entitled to obtain from the controller not only a confirmation as to whether or not personal data concerning him or her are being processed, but also access to any such

personal data, as well as other specific information. The latter includes information on the recipients or categories of recipient to whom the personal data have been or will be disclosed.

The facts of this case were briefly as follows.

An individual requested the principal operator of postal and logistical services in Austria to disclose to him the identity of the recipients to whom it had disclosed his personal data, quoting his right to do so in terms of the GDPR. The postal operator merely...