Individuals Are Entitled To Know The Specific Recipients Of Their Personal Data

• Published date: 28 March 2023
• Subject Matter: Privacy, Data Protection
• Law Firm: Arthur Cox
• Author: Mr Colin Rooney and Aoife Coll

The Court of Justice of the European Union (the "CJEU") has held that controllers must inform data subjects of the actual identities of the recipients of data subjects' personal data when responding to a data subject access request.

Article 15(1)(c) GDPR states that the controller must provide information on the recipients or the categories of recipient to whom personal data have been or will be disclosed.

The CJEU held in Case C-154/21 that the actual identities of recipients should be disclosed except where the data subject elects to request information concerning the categories of recipients only or where the controller can demonstrate that:

• it is impossible to provide the identities of recipients (for example, if the recipients are not yet known); or
• the request is manifestly unfounded or excessive (in particular due to the repetitive nature of the...