Individuals Are Entitled To Know The Specific Recipients Of Their Personal Data

• Jurisdiction: European Union
• Law Firm: Arthur Cox
• Subject Matter: Privacy, Data Protection
• Author: Mr Colin Rooney and Aoife Coll
• Published date: 28 March 2023

The Court of Justice of the European Union (the "CJEU") has held that controllers must inform data subjects of the actual identities of the recipients of data subjects' personal data when responding to a data subject access request.

Article 15(1)(c) GDPR states that the controller must provide information on the recipients or the categories of recipient to whom personal data have been or will be disclosed.

The CJEU held in Case C-154/21 that the actual identities of recipients should be disclosed except where the data subject elects to request information concerning the categories of recipients only or where the controller can demonstrate that:

• it is impossible to provide the identities of recipients (for example, if the recipients are not yet known); or
• the request is manifestly unfounded or excessive (in particular due to the repetitive nature of the...