Diese Website verwendet Cookies, damit wir dir die bestmögliche Benutzererfahrung bieten können. Cookie-Informationen werden in deinem Browser gespeichert und führen Funktionen aus, wie das Wiedererkennen von dir, wenn du auf unsere Website zurückkehrst, und hilft unserem Team zu verstehen, welche Abschnitte der Website für dich am interessantesten und nützlichsten sind.
ECJ: Information on Actual Identity of Data Recipients
The Court of Justice of the European Union (ECJ) has clarified an important detail of the GDPR (judgment of 12 January 2023 – C-154/21; https://lnkd.in/ef7Z5_jc)
Article 15(1) of the GDPR must be interpreted as meaning that the data subject’s right of access to the personal data concerning him or her, provided for by that provision, entails, where those data have been or will be disclosed to recipients, an obligation on the part of the controller to provide the data subject with the actual identity of those recipients, unless it is impossible to identify those recipients or the controller demonstrates that the data subject’s requests for access are manifestly unfounded or excessive within the meaning of Article 12(5) of the GDPR, in which cases the controller may indicate to the data subject only the categories of recipient in question.
Although the mere wording of Article 15(1)(c) is opaque in this respect, the ECJ concludes that only this interpretation is consistent with the fundamental principle of fairness and transparency, and that a data subject can only effectively exercise its other rights under the GDPR (e.g. correction, deletion) if he or she were informed about the actual identity of data recipients. The ECJ has left some back doors, though, that controllers may consider when responding to a data subject’s request.