ECJ (Austri­an Post): Right to infor­ma­ti­on inclu­des, if pos­si­ble, the indi­vi­du­al reci­pi­en­ts (not only categories)

The ECJ has ruled in the Judgment C‑154/21 of Janu­ary 12, 2023 in the case of Austri­an Post deci­de that the con­trol­ler, when pro­vi­ding infor­ma­ti­on pur­su­ant to Art. 15 DSGVO. Iden­ti­fy the indi­vi­du­al reci­pi­en­ts and not only cate­go­ries of reci­pi­en­ts has.

In respon­se to a request for infor­ma­ti­on, Swiss Post had sta­ted, among other things, that the data of the data sub­ject had been dis­c­lo­sed to cus­to­mers that inclu­ded adver­ti­sing com­pa­nies in the mail order and sta­tio­na­ry trade, IT com­pa­nies (etc.); the names of the reci­pi­en­ts were not dis­c­lo­sed. The court of first instance and the court of appeal had dis­missed the fol­lo­wing cla­im becau­se Art. 15(1)(c) GDPR lea­ves the choice to the con­trol­ler to indi­ca­te only the cate­go­ries or the indi­vi­du­al reci­pi­en­ts. The Supre­me Court (OGH) had refer­red this que­sti­on to the ECJ.

The ECJ justi­fi­es its opi­ni­on as follows:

  • Accor­ding to Reci­tal 63 the data sub­ject should be able to know, among other things, “who the reci­pi­en­ts of the per­so­nal data are”.
  • The Advo­ca­te Gene­ral had Art. 15 GDPR in its Opi­ni­on the duty to inform accor­ding to Art. 13 f. DSGVO con­tra­stedIn the case of the duty to inform, the per­son respon­si­ble is obli­ged, which is why the choice can at best be left to him; in the case of the right to infor­ma­ti­on, howe­ver, it is a que­sti­on of a right of the data sub­ject, which “logi­cal­ly pre­sup­po­ses” that the choice (reci­pi­en­ts vs. cate­go­ries) lies with the data sub­ject (a peti­tio prin­ci­pii: the scope of the right is up for dis­cus­sion and is not the premise):

    It must also be sta­ted, in any event, in accordance with the obser­va­tions of the refer­ring court, that the struc­tu­re of Artic­le 15(1) of the GDPR argues, in my view, in favor of giving pre­fe­rence to an inter­pre­ta­ti­on of the pro­vi­si­on in que­sti­on, accor­ding to which it is up to the data sub­ject (and thus, con­tra­ry to the fin­dings of the two courts of fact in this case, not up to the con­trol­ler) toto make a choice bet­ween the two alter­na­ti­ves pro­vi­ded for the­r­ein. In con­trast to other pro­vi­si­ons of the GDPR, such as Artic­les 13 and 14(7), which are struc­tu­red in such a way as to pro­vi­de for an infor­ma­ti­on obli­ga­ti­on on the part of the con­trol­ler, the pro­vi­si­on in que­sti­on pro­vi­des for an actu­al right of access in favor of the data sub­ject. The exer­cise of this right of access by the data sub­ject logi­cal­ly pre­sup­po­ses that the hol­der of this right is given the choice ofwhe­ther he/she wis­hes to obtain infor­ma­ti­on con­cer­ning, as far as pos­si­ble, the spe­ci­fic reci­pi­en­ts to whom the data have alre­a­dy been dis­c­lo­sed or will be dis­c­lo­sed or, alter­na­tively, whe­ther he/she is satis­fied with reque­st­ing infor­ma­ti­on on cate­go­ries of recipients.

  • The right to infor­ma­ti­on should not only enable the accu­ra­cy of the data to be veri­fi­ed, but also the Per­mis­si­bi­li­ty of pro­ce­s­sing, in par­ti­cu­lar also of the announcement.
  • The Prac­ti­cal effec­ti­ve­ness of the rights of data sub­jects requi­res that the data sub­ject be infor­med of the iden­ti­ty of the spe­ci­fic recipients.
  • Art. 19 para. 2 DSGVO pro­vi­des that the con­trol­ler shall noti­fy reci­pi­en­ts of rec­ti­fi­ca­ti­on or era­su­re or rest­ric­tion of pro­ce­s­sing and “inform the data sub­ject of tho­se reci­pi­en­ts” upon request.

The ECJ for­mu­la­tes the result as follows:

Con­se­quent­ly, it can be assu­med that the Infor­ma­ti­onpro­vi­ded to the data sub­ject pur­su­ant to the right of access pro­vi­ded for in Artic­le 15(1)(c) of the GDPR. c of the GDPR, must be as accu­ra­te as pos­si­ble. In par­ti­cu­lar, this right of access inclu­des the pos­si­bi­li­ty for the data sub­ject to obtain from the con­trol­ler Obtain infor­ma­ti­on about spe­ci­fic reci­pi­en­tsto whom data have been or will be dis­c­lo­sed, or alter­na­tively to deci­de to request infor­ma­ti­on only about the cate­go­ries of recipients.

After all, the ECJ lea­ves a nar­row escape rou­te becau­se the data protection

must be view­ed in light of its social func­tion and weig­hed against other fun­da­men­tal rights in com­pli­ance with the prin­ci­ple of proportionality.
Con­se­quent­ly, it is conceiva­ble that in cer­tain cir­cum­stances it may not be pos­si­ble to pro­vi­de infor­ma­ti­on about spe­ci­fic reci­pi­en­ts. The­r­e­fo­re, the right of access may be limi­t­ed to infor­ma­ti­on on the cate­go­ries of reci­pi­en­ts if it is not pos­si­ble to, to com­mu­ni­ca­te the iden­ti­ty of the spe­ci­fic reci­pi­en­ts, espe­ci­al­ly if they are not yet known.




Rela­ted articles