.svg)
Every person has the right to know with whom their personal data has been disclosed, a new EU ruling concludes.
When it comes to consumer data protection, the EU undoubtedly leads the way.
Although some have criticised the burdensome requirements that come with laws such as the General Data Protection Regulation (GDPR), it has become a form of soft power for the EU geopolitically. For example, many other jurisdictions have followed developments and implemented similar laws, such as Brazil and Thailand.
The development of the EU's data privacy rules has also evolved in part through key decisions and interpretations of the law made at the Court of Justice of the European Union (CJEU), often brought about through challenges made by private citizens and pressure groups.
In a case announced on January 12, the CJEU has declared that “where personal data have been or will be disclosed to recipients, there is an obligation on the part of the controller to provide the data subject, on request, with the actual identity of those recipients”.
“It is only where it is not (yet) possible to identify those recipients that the controller may indicate only the categories of recipient in question,” the ruling says.
This is also the case where the controller demonstrates that the request is “manifestly unfounded or excessive”.
Despite the caveat, this landmark decision could have a huge impact on companies operating in the EU, including those offering payments and financial services.
In the ruling, the CJEU points out that the data subject’s right of access is necessary to enable them to exercise other rights conferred by the GDPR, namely the right to rectification, right to erasure (known better as the right to be forgotten), the right to restriction of processing, right to object to processing and the right of action where he or she suffers damage.
The case was brought forth by an EU citizen who requested Österreichische Post, the principal operator of postal and delivery services in Austria, disclose to them the identity of the recipients to whom it had shared their personal data.
The person in question relied on the GDPR for this, and argued that it provides them with the right to obtain this information about the recipients or categories of recipients that the postal service could disclose to.
In response to the citizen's request, Österreichische Post merely stated that it uses personal data, to the extent permissible by law, in the course of its activities as a publisher of telephone directories and that it offers those personal data to trading partners for marketing purposes.
The citizen then brought proceedings against Österreichische Post before the Austrian courts.
During the judicial proceedings, Österreichische Post further informed the citizen that their data had been forwarded to customers, including advertisers trading via mail order and stationary outlets, IT companies, mailing list providers and associations such as charitable organisations, non-governmental organisations (NGOs) and political parties.
Austria’s Supreme Court, Oberster Gerichtshof, referred the case to the CJEU, wishing to know whether the GDPR leaves the data controller (who determines the purposes for processing the data) the choice to disclose either the actual recipients or only the categories of recipient, or whether it gives the data subject the right to know their specific identity.
In November, the CJEU issued an opinion that public beneficial ownership databases do not comply with the right to privacy, following a complaint from a Luxembourg company.
Since then, the repercussions of the ruling have meant that beneficial ownership registers throughout the member states, such as in the Netherlands and Luxembourg, have been of limited access to the public.
