The appellant, RW, had, pursuant to Article 15 of the GDPR, asked Österreichische Post AG, which publishes telephone directories, for access to the personal data relating to him that it was keeping or had kept in the past. RW also asked for disclosure of the identities of any third parties to whom his personal data had been or would be disclosed. Österreichische Post provided RW with information as to how it used personal data but declined to reveal the specific recipients of it.

RW issue proceedings in the Austrian courts against Österreichische Post arguing that the information provided by Österreichische Post did not satisfy Article 15 because it failed to clarify whether Österreichische Post had actually transferred his personal data to third parties and, if it had done, who the specific recipients were.

Both the court of first instance and the appellate court dismissed RW’s claim, holding that, since Article 15(1)(c) referred to “recipients” or “categories of recipient”, the data controller could confine itself to communicating only the categories of recipient, rather than the names of the specific recipients.

RW appealed to the Supreme Court of Austria, which has asked the CJEU whether Article 15(1)(c) should be interpreted as meaning that the data subject’s right of access is limited to information concerning categories of recipient where the specific recipients have not yet been determined, but includes the names of specific recipients where the personal data has already been disclosed.

Advocate General Pitruzzella noted that there is no definitive answer to the question in Article 15, as it uses the terms “recipients” and “categories of recipient” in succession without any order of priority between them. Article 15(1)(c) does not expressly specify whether a choice can be made between the two terms or who (the data subject or the data controller) can decide on the type of information to which access should be granted. In the AG’s view, Article 15(1) leans towards it being the data subject (not the data controller) who can choose between the two alternatives.

Further, the AG said, any processing of data must comply with Article 5, which makes it clear that processing must be transparent in relation to the data subject. In that context, Article 15 is fundamental to ensuring that the way data is processed is transparent.

Recital 63 also makes it clear that the purpose of the right of access is first, to enable the data subject to be informed of the processing of their data if they so wish and to verify its lawfulness. Exercising the right of access must enable the data subject to be able to check not only that the data concerning them is accurate, but also that it is disclosed to authorised recipients. That implies that the information provided must be as precise as possible. Restricting it to categories of recipient prevents the data subject from being able fully to exercise their rights.

The right of access is also necessary to enable data subjects to exercise the right to rectification, the “right to be forgotten” and the right to restrict processing under Articles 16, 17 and 18 respectively, the AG said. The right of access is also necessary to enable data subjects to object to the processing of their personal data under Article 21 and to take legal action if they suffer harm and to obtain compensation under Articles 79 and 82. Not allowing data subjects to obtain information on specific recipients of their personal data would mean that data subjects would not be able to exercise these rights either.

Therefore, the AG opined, Article 15(1)(c) plays a functional and instrumental role in the exercise of the other rights that the GDPR confers on data subjects and must be interpreted as meaning that the right of access under that provision must, in principle, necessarily include the right to obtain from the data controller information regarding the specific recipients to whom the data subject’s personal data is disclosed.

However, the AG said, this extension of the right of access under Article 15(1)(c) is restricted by at least two factors:

1. where it is materially impossible to provide information about specific recipients, e.g., they have not yet been identified; and
2. it must be fair and proportionate and not be manifestly unfounded or excessive.

Therefore, the AG concluded, Article 15(1)(c) must be interpreted as meaning that the data subject’s right of access must necessarily extend, where the data subject so requests, to the identification of the specific recipients to whom his or her personal data are disclosed. That right of access may be restricted to an indication of the categories of recipient where it is materially impossible to identify the specific recipients or where the data controller demonstrates that the data subject’s requests are manifestly unfounded or excessive, within the meaning of Article 12(5). (Case C-154/21 RW v Österreichische Post AG EU:C:2022:452 (Opinion of Advocate General) (9 June 2022) — to read the Opinion in full, click here).