EU court rules that companies must reveal with whom they share data

An Austrian case could have a wide-ranging impact on how the GDPR is enforced.

The Court of Justice of the European Union has issued a decision that forces personal data collectors to identify the entities they sold data to when requested under the EU GDPR.

The decision is in response to a court case in Austria, where a man sought to discover the companies his personal data was sold to by the country’s national postal service, the Österreichische Post.

‘Data subjects’ have a right to know

In pursuing his request, the Austrian citizen relied on the GDPR, the EU’s main privacy law. The regulation provides that the so-called ‘ data subject‘, in this case the Austrian citizen, has the right to obtain information from the ‘data controller‘ (the postal service) about the recipients or categories of recipients to whom his or her personal data have been or will be disclosed.

The citizen could not get the information he wanted and brought proceedings against Österreichische Post before the Austrian courts.

Österreichische Post then informed the citizen of the categories of entities with which it had shared his data. These included customers, advertisers, IT companies, mailing list providers and associations such as charitable organisations, non-governmental organisations (NGOs) and political parties.

The Oberster Gerichtshof (Austrian Supreme Court) petitioned the CJEU to inform whether the GDPR gives the data subject the actual right to know the specific identity of an entity or whether knowing the categories is sufficient.

Transparency comes first

On January 12, the court replied that where personal data have been or will be disclosed to recipients, there is an obligation on the part of the controller to provide the data subject with the actual identity of those recipients on request.

It is only where it is not (yet) possible to identify those recipients that the controller may indicate only the categories of the recipients in question. That is also the case where the controller demonstrates that the request is manifestly unfounded or excessive, the court ruled.