OGH to ECJ: Right to information: categories of recipients under GDPR

Apr 21, 2021 Benn-Ibler Rechtsanwälte

The Austrian Supreme Court (OGH) has referred a question to the European Court of Justice (ECJ) for a preliminary ruling regarding Art 15 (1) (c) of the General Data Protection Regulation (GDPR). The question is whether the data controller has the right to choose whether to disclose recipients or only categories of recipients.

With reference to Art. 15 of the GDPR, the plaintiff requested information about which personal data are stored or have been stored as well as information about the storage of these data. In the event that the data were passed on to third parties, the plaintiff requested information as to who the specific recipient was.

The defendant replied in writing that personal data would be used to the extent legally permissible in the context of its activities as an address publisher and that it offered this data to business customers for marketing purposes. For further information, reference was made to a website, which, however, only contained general information on processing purposes.

In the context of the present proceedings, the defendant also informed the court that personal data of the plaintiff had been processed for marketing purposes in the context of address publishing and had been passed on to business customers. Business customers in this context include IT companies, NGOs, associations and political parties. At no time did the defendant disclose specific recipients of the personal data. It is now a question of whether the defendant had to name the specific recipients in order to comply with the obligation to provide information pursuant to Article 15 of the GDPR.

The OGH has referred the question to the ECJ as to whether Art 5 (1) (c) of the GDPR is to be interpreted in such a way that the claim is limited to information on categories of recipients if specific recipients have not yet been determined in the case of planned disclosures, but the right to information must also necessarily extend to recipients of this disclosure if data have already been disclosed.

OGH 6 Ob 159/20f (18.02.2021)