Co-author Jeannette Kengne Kengne
In its preliminary ruling, the Court of justice clarified the scope of the obligations of the data controller following a request for access to personal data made by a data subject: the data controller must disclose the identity of specific recipients to whom the personal data have been or will be disclosed, unless the request is manifestly unfounded or excessive (case C-154/21).
On 12 January 2023, the EU Court of Justice (“the ECJ”) ruled on the request for a preliminary ruling raised in proceedings between a natural person (RW) and Österreichische Post AG (Austria’s principal logistics and postal service operator). The proceedings related to a dispute concerning a request for access to personal data pursuant to Article 15(1)(c) of the General Data Protection Regulation (“the GDPR”) (Case C-154/21).
The dispute in the main proceedings and the question referred for a preliminary ruling
RW requested Österreichische Post AG (“OPA”) to access his personal data which were being stored or had been stored in the past by OPA. The request was made under Article 15 of the GDPR. RW also asked OPA to reveal the identity of the recipients to whom his data had been disclosed. OPA refused to provide the actual identity of the recipients, referring only to the categories of recipients of his personal data.
The Oberster Gerichtshof (Austrian Supreme Court) raised the issue of the lack of clarity as to whether Article 15 of the GDPR requires the data controller to indicate the actual identity of the recipients or whether this provision provides the data controller with a discretionary power as to how it intends to implement the data subject’s right of access to information about the recipients of his or her personal data.
In this context, the Austrian Supreme Court referred the following question to the ECJ: “Is Article 15(1)(c) of [the GDPR] to be interpreted as meaning that the right of access is limited to information concerning categories of recipients where specific recipients have not yet been determined in the case of planned disclosures, but that right must necessarily also cover recipients of those disclosures in cases where data [have] already been disclosed?”
Consideration of the question referred
The ECJ noted that the use in succession of the terms “recipients” and “categories of recipients” in the text of Article 15 of the GDPR has no bearing on the priority between them.
However, according to the ECJ, it follows from a contextual analysis that Article 15 of the GDPR intends to ensure transparency of the data processing methods and to enable the data subject to exercise several rights laid down in the GDPR.
Firstly, in order to respect the right of access, all processing of personal data of natural persons must comply with the principle of transparency (information about the processing must be easily accessible and easy to understand) set out in article 5(1)(a) of the GDPR.
Secondly, Article 15 of the GDPR lays down a genuine right of access for the data subject, with the result that he or she must have the choice of obtaining either information about the specific recipients to whom his or her data have been or will be disclosed, where possible, or information about the categories of recipients.
Thirdly, this right of access constitutes a central pivot. Indeed, the exercise of that right must enable the data subject to verify whether the data concerning him or her are accurate and whether they are processed lawfully.
As such, the data subject’s right for access is also necessary to enable to exercise of other rights conferred by the GDPR such as the right to rectification (Art. 16), the right to erasure (Art. 17), the right to restriction of processing (Art. 18) and the right to object to his or her personal data being processed (Art. 21). In order to ensure the effectiveness of these rights, the data subject should have the right to be informed of the identity of the specific recipients to whom his or her personal data have already been disclosed.
Fourthly, Article 19 of the GDPR provides (i) that the data controller is to communicate any rectification or erasure of personal data to each recipient to whom the personal data have been disclosed and (ii) that the controller is to inform the data subject about those recipients if the data subject requests it. This last clarification explicitly confers on the data subject the right to be informed of the identity of the specific recipients of the data concerning him or her.
Regarding the purpose of the GDPR, the ECJ also recalled that this regulation is intended to ensure a high level of protection of natural persons and to implement the requirements arising from the fundamental right to the protection of personal data under Article 8 of the EU Charter of fundamental rights. Therefore, it also follows from the objective pursued by the GDPR that the data controller must provide the data subject, on request, with information about the specific recipients to whom the personal data concerning him or her have been or will be disclosed.
Nevertheless, since the right to the protection of personal data is not an absolute right, the data controller may, in specific circumstances, (i) refuse to act on a request from a data subject where the request is manifestly unfounded or excessive, and (ii) restrict the response to information about categories of recipients if it is impossible to disclose the identity of specific recipients, in particular where they are not yet known.
For further information about this case and/or for general legal advice relating to Privacy & Data Protection, please contact Karel Janssens.