RW had, pursuant to Article 15 of the GDPR, asked Österreichische Post AG, which publishes telephone directories, for access to the personal data relating to him that it was keeping or had kept in the past. RW also asked for disclosure of the identities of any third parties to whom his personal data had been or would be disclosed.

Österreichische Post provided RW with information as to how it used personal data but declined to reveal the specific recipients of it.

RW issue proceedings in the Austrian courts against Österreichische Post arguing that the information provided by Österreichische Post did not satisfy Article 15 because it failed to clarify whether Österreichische Post had actually transferred his personal data to third parties and, if it had done, who the specific recipients were.

Both the court of first instance and the appellate court dismissed RW’s claim, holding that, since Article 15(1)(c) referred to “recipients” or “categories of recipient”, the data controller could confine itself to communicating only the categories of recipient, rather than the names of the specific recipients.

RW appealed to the Supreme Court of Austria, which asked the CJEU whether Article 15(1)(c) should be interpreted as meaning that the data subject’s right of access is limited to information concerning categories of recipient where the specific recipients have not yet been determined, but includes the names of specific recipients where the personal data has already been disclosed.

The CJEU found that where personal data has been or will be disclosed to recipients, the controller is obliged to provide the data subject, on request, with the actual identity of the recipients. Only where it is not (yet) possible to identify the recipients or the controller demonstrates that the request is manifestly unfounded or excessive can the controller disclose just the categories of recipient in question.

The CJEU stressed that the data subject’s right of access under Article 15 of the GDPR is there to enable the data subject to exercise other rights under the GDPR, namely his or her right to rectification, the right to erasure (“right to be forgotten”), the right to restriction of processing, the right to object to processing or the right to bring proceedings where he or she suffers damage. (Case C-154/21 RW v Österreichische Post AG EU:C:2023:3 (12 January 2023) — to read the judgment in full, click here).