Individuals Are Entitled To Know The Specific Recipients Of Their Personal Data

Published date28 March 2023
Subject MatterPrivacy, Data Protection
Law FirmArthur Cox
AuthorMr Colin Rooney and Aoife Coll

The Court of Justice of the European Union (the "CJEU") has held that controllers must inform data subjects of the actual identities of the recipients of data subjects' personal data when responding to a data subject access request.

Article 15(1)(c) GDPR states that the controller must provide information on the recipients or the categories of recipient to whom personal data have been or will be disclosed.

The CJEU held in Case C-154/21 that the actual identities of recipients should be disclosed except where the data subject elects to request information concerning the categories of recipients only or where the controller can demonstrate that:

  • it is impossible to provide the identities of recipients (for example, if the recipients are not yet known); or
  • the request is manifestly unfounded or excessive (in particular due to the repetitive nature of the...

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT