Germany Update: The right to information Art. 15 GDPR Part 1 – Controllers must name specific recipients.

The right to information pursuant to Article 15 GDPR is one of the most important rights of data subjects in the General Data Protection Regulation. It grants data subjects a right to information regarding the type and scope of the processing of their personal data. The controller must indicate whether data of the data subject are processed and, if so, to what extent. Art. 15 para. 1 lit. a) – h) GDPR specify the scope of the information. Among other things, the purposes of processing and retention periods as well as any “recipients or categories of recipients” must be communicated. In practice, the scope of a right to information is often interpreted differently by the parties involved, which is why there are now a large number of court decisions on Art. 15 GDPR. In its judgment of 12 January 2023 ( C-154/21), the European Court of Justice has now clarified with regard to the scope of the provision of information that it is not sufficient to name categories of recipients. The specific recipients of the data must be named. Only if the specific recipients of the personal data are not (yet) known, the controller may limit himself to naming categories of recipients.

Background

The plaintiff in the proceedings is a customer of the defendant Austrian Post. In his request for information pursuant to Article 15 GDPR, he also requested information about the recipients to whom his personal data was disclosed. In the course of the proceedings, Austrian Post stated that it had passed on the applicant’s data to customers, including mail-order and brick-and-mortar advertising companies, IT companies, address publishers and associations such as charitable organisations, non-governmental organisations or political parties. However, specific recipients were not named. In providing information, Swiss Post referred to the wording of Art. 15 (1) (c) GDPR, according to which “recipients or categories of recipients” must be named. The plaintiff appealed against this decision and appealed to the Austrian Supreme Court (OGH). He had doubts about the extent to which it is sufficient to limit himself to the naming of categories of recipients or whether the person responsible must communicate the concrete identity of the recipients, so that the Supreme Court has now referred the question to the European Court of Justice.

The decision

The ECJ has clarified that the variants “recipients” and “categories of recipients” are to be read equally. However, the right to information must also be interpreted in the light of the other rights of data subjects, such as .dem right to erasure pursuant to Article 17 GDPR. This leads to the fact that it is necessary to name the specific recipients. Otherwise, the data subject would not be able to exercise his rights effectively. Only if the data subject receives complete information as to which data the responsible company processes and for what purposes, can it also be checked whether the data is processed correctly. The explanations in recital 63 also support this interpretation, according to which every data subject ‘should have a right to know and to know (…) who the recipients of the personal data are, (…)’. Exceptionally, it does not apply if the person responsible cannot identify a specific recipient.

And the practice?

The decision of the ECJ is not surprising and provides clarity. The protection of those affected is strengthened, but leads to more effort for the responsible companies in answering requests for information. A clean processing directory can be a great advantage here.

It is also discussed whether the decision of the ECJ has an influence on the scope of mandatory information under Articles 13 and 14 GDPR. This is because Art. 13 para. 1 lit. e) and Art. 14 para. 1 lit. e) GDPR oblige the naming of “recipients or categories of recipients” of the personal data. However, the obligation to provide information pursuant to Art. 13/14 GDPR takes place at a different time than the right to information. It should inform the data subject about the processing itself at the beginning of the processing, even if the specific recipients have not yet been determined in case of doubt. If a transfer of personal data actually takes place in the further course, the data subject is free to request information about the specific recipients of his data. This does not affect the assertion of the rights of data subjects.

The responsible companies are free to inform the data subjects about the specific recipients of the data at the beginning of the data processing, as far as they are known. However, there is currently no obligation (yet). If, on the other hand, a data subject asserts his or her right of access pursuant to Article 15 GDPR, the controller must name the specific recipients of the personal data and cannot limit himself to naming categories of recipients.

Part 2 will follow shortly.

By MELCHERS, Germany, a Transatlantic Law International Affiliated Firm.  

For further information or for any assistance please contact germany@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.