Opinion of Advocate General Pitruzzella delivered on 9 June 2022.

• Jurisdiction: European Union
• ECLI: ECLI:EU:C:2022:452
• Date: 09 June 2022
• Celex Number: 62021CC0154
• Court: Court of Justice (European Union)

Provisional text

OPINION OF ADVOCATE GENERAL

PITRUZZELLA

delivered on 9 June 2022 (1)

Case C‑154/21

RW

v

Österreichische Post AG

(Request for a preliminary ruling from the Oberster Gerichtshof (Supreme Court, Austria))

(Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(1)(c) – Right of access of the data subject – Information regarding the specific recipient or the categories of recipient to whom the data have been disclosed)

1. When an individual whose personal data are processed seeks to obtain from the data controller information regarding the third parties to whom the data are disclosed, does that person’s right of access necessarily imply that he or she should receive information regarding the specific recipients to whom his or her personal data are disclosed, or may the data controller confine itself to providing information solely regarding the categories of recipients of such disclosures?

2. That, in essence, is the question put to the Court of Justice in the present reference for a preliminary ruling, made by the Oberster Gerichtshof (Supreme Court, Austria), concerning the interpretation of Article 15(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2) (‘the GDPR’).

3. The question referred by the referring court arose in the context of a dispute between RW, a natural person, and Österreichische Post, the principal operator of postal and logistical services in Austria, which, in response to a request for access that RW made concerning his personal data, did not communicate to him information regarding the specific recipients to whom his personal data are disclosed.

I. Legal framework

4. Article 15 of the GDPR, entitled ‘Right of access by the data subject’, provides, in paragraph 1(c) thereof:

‘1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

…

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

…’

II. The facts, the main proceedings and the question referred for a preliminary ruling

5. On 15 January 2019, RW, the appellant in the proceedings before the referring court, contacted Österreichische Post in order to obtain access, pursuant to Article 15 of the GDPR, inter alia, to the personal data relating to him which Österreichische Post was keeping or had kept in the past and, in the event that those data had been or would be disclosed to third parties, the identities of the recipients of such disclosures.

6. In its reply, Österreichische Post stated that it used data, to the extent permitted by law, in the context of its activity as a publisher of telephone directories, and that it provided data to business customers for marketing purposes. It then referred to a website from which could be gleaned some general information on the purposes of the processing of RW’s data and which itself referred to another website. That second website in turn contained general notices about data protection and gave some general indications of certain categories of recipient to which Österreichische Post disclosed personal data. However, at no time did Österreichische Post reveal to RW the specific recipients to whom his personal data are disclosed.

7. RW initiated legal proceedings, seeking an order requiring Österreichische Post to provide him with further information, pursuant to Article 15 of the GDPR, concerning potential transfers of his personal data to third parties and, in the event that his personal data had actually been transferred, concerning the specific recipient or recipients to whom his personal data had been or would be disclosed. RW claims that the information provided by Österreichische Post does not satisfy the legal requirements of Article 15 of the GDPR because it fails to clarify whether or not Österreichische Post has actually transferred his personal data to third parties and, if it has done so, who the specific recipients of those disclosures were.

8. Both the court of first instance and the appellate court dismissed RW’s application, holding, in essence, that, since Article 15(1)(c) of the GDPR referred to recipients or categories of recipient, that provision allowed the data controller to confine itself to communicating to the data subject the categories of recipient, without having to give the names of specific recipients to whom the personal data of the data subject are disclosed.

9. RW pursued his claim in an appeal on a point of law before the referring court.

10. In the course of those appeal proceedings, Österreichische Post informed RW that his data had been processed for marketing purposes in the context of the publication of telephone directories and that they had been transferred to business customers, including advertisers active in the mail order and traditional commerce sectors, IT companies, telephone directory publishers and associations such as charities, NGOs and political parties. It did not, however, reveal the identities of the specific recipients to whom RW’s data had been disclosed.

11. In that context, the referring court, being in doubt as to the interpretation of Article 15 of the GDPR that had been adopted by the courts ruling on the substance, decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:

‘Is Article 15(1)(c) of [the GDPR] to be interpreted as meaning that the data subject’s right of access is limited to information concerning categories of recipient where specific recipients have not yet been determined in the case of planned disclosures, but that right must necessarily also cover recipients of those disclosures in cases where data has already been disclosed?’

III. Legal analysis

12. By the question referred, the referring court seeks from the Court of Justice a preliminary ruling on the interpretation of Article 15(1)(c) of the GDPR regarding the scope of the data subject’s right, provided for in that provision, to obtain information from the data controller regarding the recipients or categories of recipient to whom the data subject’s personal data have been or will be disclosed.

13. The referring court seeks to ascertain whether that provision is to be interpreted as meaning that the scope of the data subject’s right of access must be distinguished according to whether data have already been disclosed, in which case the right should extend to the specific recipients of such disclosures, or whether the specific recipients of future disclosures have not yet been identified, in which case the right should be regarded as limited to information regarding categories of recipient.

14. In that regard, it should first of all be noted that Article 15 of the GDPR governs the rights of data subjects, exercisable against data controllers, to access personal data concerning them which are being processed, as well as a range of information relating, in particular, to the processing of such data. Article 15 gives specific expression to the right of every individual to access data concerning him or her, enshrined in the second sentence of Article 8(2) of the Charter of...