CJEU: Individuals are entitled to request the identity of each data recipient

The Court of Justice of the European Union (CJEU) decision of 12 January confirms that when making a GDPR access request, data subjects can request either the identity of each data recipient to whom the controller will or has disclosed the data subject’s personal data, or only the categories of data recipients.

The Court says that where it is not (yet) possible to identify those recipients, the controller may indicate only the categories of recipients in question. That is also the case where the controller demonstrates that the request is manifestly unfounded or excessive.

GDPR Recital 63 specifies that every data subject should have the right to know and obtain communication regarding the recipients of their personal data.

See the Court’s decision in Case C-154/21 Österreichische Post of 12 January 2023