On 9 June 2022, the Advocate General at the CJEU in his Opinion (docket no. C 154/21) specified the scope of the right of access under article 15(1)(c) of the GDPR. In the initial Austrian case, an individual had requested information from the postal service about the disclosure of his data and its recipients. In the response, he only received information about possible categories of recipients. According to the Advocate General, the right of access should include information about the specific recipients of disclosed data.
Conclusion: This right of access should only be limited to the indication of categories of recipients if a more detailed determination is impossible for factual reasons or if the controller proves that the data subject's request is manifestly unfounded or excessive. Should the CJEU rule accordingly, this also presupposes that the data processing entity indeed also knows all recipients.
IT and Data Protection Newsletter – Germany Summer 2022 edition | Perspectives | Reed Smith LLP
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.