CJEU case C-154/21 Österreichische Post (Information regarding the recipients of personal data) – CJEU Judgment (Austria, 2023)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The Court of Justice of the European Union ruled that people have the right to know exactly who received their personal data, not just the type of recipients. This decision came after Austrian Post only provided vague information about data sharing, leading to a legal challenge. The ruling emphasizes transparency and could impact how companies handle data requests.
What happened
Austrian Post provided only general information about who received personal data, not specific identities, leading to a legal challenge.
Who was affected
Individuals who requested to know exactly which third parties received their personal data from Austrian Post.
What the authority found
The Court of Justice ruled that people must be informed about the specific recipients of their personal data, not just categories.
Why this matters
This decision highlights the importance of transparency in data sharing practices. Companies should be prepared to disclose specific recipient details when requested, reinforcing the right to access personal data under GDPR.
GDPR Articles Cited
A data subject sent an access request to the Austrian Post (the controller) to obtain information about what personal data about him was processed as well as whether it was disclosed to third parties, and if yes, who these recipients were. The controller provided a generic response regarding the recipients of personal data, only referring to a general website naming activities of the recipients, such as telephone directories or marketing actors. The controller did not inform the data subject about the specific identity of the recipients. Consequently, the data subject took action before Austrian courts in order to obtain information about specific recipients. Both the court of first instance and appeal dismissed the action by stating that Article 15(1)(c) GDPR gives the controller disrection to choose whether they wish to provide information about 'recipients' or 'categories of recipients' only. In the meantime, the controller provided information with regards to the categories of recipients, which included charities, NGOs and political parties, but refused to reveal their identity. The Austrian Supreme Court decided to refer the matter to the Court of Justice of the European Union (CJEU, the Court) in order to obtain clarification on the interpretation of Article 15 GDPR. The Supreme Court asked the following preliminary question: 'Is Article 15(1)(c) of the GDPR to be interpreted as meaning that the claim is limited to information on categories of recipients if specific recipients have not yet been determined in the case of planned disclosures, but the right to information must necessarily also extend to recipients of these disclosures if data have already been disclosed?' Advocate General Pitruzzella noted that provisions of EU law must be interpreted in a way as to ensure their effectiveness. Since Article 15 GDPR provides a genuine right of access, it is a necessary pre-condition for the exercise of other data subject rights under the GDPR. Moreover, it fol
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for CJEU case C-154/21 Österreichische Post (Information regarding the recipients of personal data) in AT
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
12 January 2023
Authority
Court of Justice of the European Union
GDPRhub ID
gdprhub-cjeu-5590About this data
Cite as: Cookie Fines. CJEU case C-154/21 Österreichische Post (Information regarding the recipients of personal data) - Austria (2023). Retrieved from cookiefines.eu
Last updated: