The ECJ has ruled in the Judgment C‑154/21 of January 12, 2023 in the case of Austrian Post decide that the controller, when providing information pursuant to Art. 15 DSGVO. Identify the individual recipients and not only categories of recipients has.
In response to a request for information, Swiss Post had stated, among other things, that the data of the data subject had been disclosed to customers that included advertising companies in the mail order and stationary trade, IT companies (etc.); the names of the recipients were not disclosed. The court of first instance and the court of appeal had dismissed the following claim because Art. 15(1)(c) GDPR leaves the choice to the controller to indicate only the categories or the individual recipients. The Supreme Court (OGH) had referred this question to the ECJ.
The ECJ justifies its opinion as follows:
- According to Recital 63 the data subject should be able to know, among other things, “who the recipients of the personal data are”.
- The Advocate General had Art. 15 GDPR in its Opinion the duty to inform according to Art. 13 f. DSGVO contrastedIn the case of the duty to inform, the person responsible is obliged, which is why the choice can at best be left to him; in the case of the right to information, however, it is a question of a right of the data subject, which “logically presupposes” that the choice (recipients vs. categories) lies with the data subject (a petitio principii: the scope of the right is up for discussion and is not the premise):
It must also be stated, in any event, in accordance with the observations of the referring court, that the structure of Article 15(1) of the GDPR argues, in my view, in favor of giving preference to an interpretation of the provision in question, according to which it is up to the data subject (and thus, contrary to the findings of the two courts of fact in this case, not up to the controller) toto make a choice between the two alternatives provided for therein. In contrast to other provisions of the GDPR, such as Articles 13 and 14(7), which are structured in such a way as to provide for an information obligation on the part of the controller, the provision in question provides for an actual right of access in favor of the data subject. The exercise of this right of access by the data subject logically presupposes that the holder of this right is given the choice ofwhether he/she wishes to obtain information concerning, as far as possible, the specific recipients to whom the data have already been disclosed or will be disclosed or, alternatively, whether he/she is satisfied with requesting information on categories of recipients.
- The right to information should not only enable the accuracy of the data to be verified, but also the Permissibility of processing, in particular also of the announcement.
- The Practical effectiveness of the rights of data subjects requires that the data subject be informed of the identity of the specific recipients.
- Art. 19 para. 2 DSGVO provides that the controller shall notify recipients of rectification or erasure or restriction of processing and “inform the data subject of those recipients” upon request.
The ECJ formulates the result as follows:
Consequently, it can be assumed that the Informationprovided to the data subject pursuant to the right of access provided for in Article 15(1)(c) of the GDPR. c of the GDPR, must be as accurate as possible. In particular, this right of access includes the possibility for the data subject to obtain from the controller Obtain information about specific recipientsto whom data have been or will be disclosed, or alternatively to decide to request information only about the categories of recipients.
After all, the ECJ leaves a narrow escape route because the data protection
must be viewed in light of its social function and weighed against other fundamental rights in compliance with the principle of proportionality.
Consequently, it is conceivable that in certain circumstances it may not be possible to provide information about specific recipients. Therefore, the right of access may be limited to information on the categories of recipients if it is not possible to, to communicate the identity of the specific recipients, especially if they are not yet known.