Art. 15 GDPR - RIGHT OF ACCESS – Plaintiff RW vs ÖSTERREICHISCHE POST

In the past few months DP-Dock has received a considerable number of inquiries from its customers regarding how to properly handle a data subject’s requested on access to the processing of their personal data (Art. 15 GDPR). This topic has become more relevant than ever after the decision C-154/21 of the European Court of Justice (ECJ) came into light by January 2023.

The answer “so precisely as possible” is reflected on what the ECJ had to say about the case of RW, a data subject who requested information from Österreichische Post (“Postal Service in Austria”) about third party data recipients who acquired their data previously processed by the Austrian postal service. Österreichische Post answered the data subject by listing the categories of recipients their data might have been transferred to (i.e., advertisers trading via mail order and stationary outlets, IT companies, mailing list providers and associations such as charitable organizations, non-governmental organizations (NGOs) or political parties). A lack of concrete answer was justified by Österreichische Post by citing Art. 15 (1)(c) GDPR which gives the data controller the choice to either disclose information referring to “recipients or categories of recipients”.

The ECJ, however, decided that the right of the data subjects to know the exact identity of the third parties that have access to and process the data is tightly connected with their right to verify if their data is processed by a lawful manner by every recipient. Furthermore, it is intertwined with the ability of the recipient to attest to the accuracy of the data subject`s personal information. Thus, a detailed disclosure of the identity of each recipient was deemed mandatory. It remains to be seen how this decision will be implemented from now on.

For the decision, please see here.