On Thursday 12 January, the Court of Justice of the EU (CJEU) delivered a judgment (Case C-154/21), in which it considers that every individual has the right to know to whom their personal data has been disclosed.
The CJEU had been asked by the Austrian Supreme Court, which had itself had a dispute referred to it between the main operator of postal and logistics services in Austria, Österreichische Post, and an Austrian citizen. On the basis of the General Data Protection Regulation (GDPR), the latter had asked the Austrian postal operator to communicate the identity of the recipients to whom it had transmitted his personal data.
The Österreichische Post had initially only stated that it uses personal data, to the extent permitted by law, in the context of its business as a telephone directory publisher and that it offers this data to commercial partners for marketing purposes.
Later, in the course of the legal proceedings, the Austrian postal service completed its response and informed the citizen that his data had been passed on to its customers, including advertisers in the mail order and in-person retail sector, IT companies, charities, non-governmental organisations and political parties.
In its judgment, the CJEU considers that the controller is obliged to provide the data subject, upon request and where personal data has been or will be disclosed, with the identity of those recipients.
However, it points out that this communication may be limited to indicating only the categories of addressees in certain situations. This is the case, for example, when it is not - or not yet - possible to identify the recipients or when the controller demonstrates that the request for information is manifestly unfounded or excessive.
See the judgment: https://aeur.eu/f/4v8 (Original version in French by Thomas Mangin)