Article 15(1) of the GDPR must be interpreted as meaning that the data subject’s right of access to the personal data concerning him or her, provided for by that provision, entails, where those data have been or will be disclosed to recipients, an obligation on the part of the controller to provide the data subject with the actual identity of those recipients, unless it is impossible to identify those recipients or the controller demonstrates that the data subject’s requests for access are manifestly unfounded or excessive within the meaning of Article 12(5) of the GDPR, in which cases the controller may indicate to the data subject only the categories of recipient in question.

Although the mere wording of Article 15(1)(c) is opaque in this respect, the ECJ concludes that only this interpretation is consistent with the fundamental principle of fairness and transparency, and that a data subject can only effectively exercise its other rights under the GDPR (e.g. correction, deletion) if he or she were informed about the actual identity of data recipients. The ECJ has left some back doors, though, that controllers may consider when responding to a data subject’s request.

Check in with our privacy team to learn more! Alexander Tribess Natalie Dessauer Sven Schilf