CJUE, rw împotriva Österreichische Post ag, C-154/21, ecli:eu:C:2023:3

Extrasele exacte din hotărâre la care trimit ghidurile.

1. par. 17–27, 36–43 și 47–51; dispozitiv · limba originalului: en

   In the light of all the foregoing considerations, the answer to the question referred for a preliminary ruling is that Article 15(1)(c) of the GDPR must be interpreted as meaning that the data subject’s right of access to personal data concerning him or her, provided for by that provision, entails, where those data have been or will be disclosed to recipients, an obligation on the part of the controller to provide the data subject with the actual identity of those recipients, unless it is impossible to identify those recipients or the controller demonstrates that the data subject’s requests for access are manifestly unfounded or excessive within the meaning of Article 12(5) of the GDPR, in which cases the controller may indicate to the data subject only the categories of recipient in question.

   Textul în documentul-sursă ↗

2. par. 17–27, 36–43 și 47–51; dispozitiv · limba originalului: en

   17 On 15 January 2019, RW asked Österreichische Post for access under Article 15 of the GDPR to the personal data concerning him which were being stored or had previously been stored by Österreichische Post and, if the data had been disclosed to third parties, for information as to the identity of the recipients. 18 In response to that request, Österreichische Post merely stated that it uses data, to the extent permissible by law, in the course of its activities as a publisher of telephone directories and that it offers those personal data to trading partners for marketing purposes. It also referred to a website that set out more information and further data processing purposes. It did not disclose to RW the identity of the specific recipients of the data. 19 RW brought proceedings against Österreichische Post before the Austrian courts, seeking an order that Österreichische Post provide him with, inter alia, the identity of the recipient(s) of the personal data disclosed. 20 During the judicial proceedings thus initiated, Österreichische Post informed RW that his personal data had been processed for marketing purposes and forwarded to customers, including advertisers trading via mail order and stationary outlets, IT companies, mailing list providers and associations such as charitable organisations, non-governmental organisations (NGOs) or political parties. 21 The courts at first instance and on appeal dismissed RW’s action on the ground that Article 15(1)(c) of the GDPR, by referring to ‘recipients or categories of recipient’, gives the controller the option of informing the data subject only of the categories of recipient, without having to identify by name the specific recipients to whom personal data are transferred. 22 RW brought an appeal on a point of law ( Revision ) before the Oberster Gerichtshof (Supreme Court, Austria), the referring court. 23 That court is uncertain as to the interpretation of Article 15(1)(c) of the GDPR, in so far as it is not clear from the wording of that provision whether it grants the data subject the right of access to information relating to the specific recipients of the disclosed data, or whether the controller has discretion as to how it proposes to respond to a request for access to information about the recipients. 24 The referring court nevertheless observes that the underlying objective of that provision supports the interpretation that it is the data subject who has the option of requesting information about the categories of recipient or requesting information about the specific recipients of his or her personal data. In the referring court’s view, any contrary interpretation would seriously undermine the effectiveness of the legal remedies available to the data subject for the protection of his or her data. If controllers had the option of informing data subjects of the specific recipients or only of the categories of recipient, the fear would be that, in practice, almost no controller would provide information about specific recipients. 25 In addition, unlike Article 13(1)(e) and Article 14(1)(e) of the GDPR, which lay down an obligation on the part of the controller to provide the information set out in those articles, Article 15(1) of that regulation focuses on the scope of the data subject’s right of access, a fact which, according to the referring court, also tends to indicate that the data subject has the right to choose between requesting information about the specific recipients or about categories of recipient. 26 Lastly, the referring court adds that the right of access provided for in Article 15(1) of the GDPR covers not only personal data currently being processed but also all data processed previously. In that regard, it states that the considerations set out in the judgment of 7 May 2009, Rijkeboer (C‑553/07, EU:C:2009:293), based on the purpose of the right of access provided for by Directive 95/46, may be transferred to the right of access under Article 15 of the GDPR, especially since it can be deduced from recitals 9 and 10 of the GDPR that the EU legislature did not intend to reduce the level of protection as compared to that directive. 27 In those circumstances, the Oberster Gerichtshof (Supreme Court) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling: ‘Is Article 15(1)(c) of [the GDPR] to be interpreted as meaning that the right of access is limited to information concerning categories of recipient where specific recipients have not yet been determined in the case of planned disclosures, but that right must necessarily also cover recipients of those disclosures in cases where data [have] already been disclosed?’ Consideration of the question referred

   Textul în documentul-sursă ↗

3. par. 17–27, 36–43 și 47–51; dispozitiv · limba originalului: en

   36 In the third place, it should be noted, as the Advocate General stated in point 21 of his Opinion, that, unlike Articles 13 and 14 of the GDPR, which lay down an obligation on the part of the controller to provide the data subject with information relating to the categories of recipient or the specific recipients of the personal data concerning him or her where personal data are collected from the data subject and where personal data have not been obtained from the data subject, Article 15 of the GDPR lays down a genuine right of access for the data subject, with the result that the data subject must have the option of obtaining either information about the specific recipients to whom the data have been or will be disclosed, where possible, or information about the categories of recipient. 37 In the fourth place, the Court has previously held that the exercise of that right of access must enable the data subject to verify not only that the data concerning him or her are correct, but also that they are processed in a lawful manner (see, by analogy, judgments of 17 July 2014, YS and Others , C‑141/12 and C‑372/12, EU:C:2014:2081, paragraph 44, and of 20 December 2017, Nowak , C‑434/16, EU:C:2017:994, paragraph 57), and in particular that they have been disclosed to authorised recipients (see, by analogy, judgment of 7 May 2009, Rijkeboer , C‑553/07, EU:C:2009:293, paragraph 49). 38 In particular, that right of access is necessary to enable the data subject to exercise, depending on the circumstances, his or her right to rectification, right to erasure (‘right to be forgotten’) or right to restriction of processing, conferred, respectively, by Articles 16, 17 and 18 of the GDPR (see, by analogy, judgments of 17 July 2014, YS and Others , C‑141/12 and C‑372/12, EU:C:2014:2081, paragraph 44, and of 20 December 2017, Nowak , C‑434/16, EU:C:2017:994, paragraph 57), and the data subject’s right to object to his or her personal data being processed, laid down in Article 21 of the GDPR, and right of action where he or she suffers damage, laid down in Articles 79 and 82 of the GDPR (see, by analogy, judgment of 7 May 2009, Rijkeboer , C‑553/07, EU:C:2009:293, paragraph 52). 39 Thus, in order to ensure the effectiveness of all of the rights referred to in the preceding paragraph of the present judgment, the data subject must have, in particular, the right to be informed of the identity of the specific recipients where his or her personal data have already been disclosed. 40 Such an interpretation is confirmed, in the fifth and last place, by a reading of Article 19 of the GDPR, which provides, in its first sentence, that the controller is, in principle, to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed and, in its second sentence, that the controller is to inform the data subject about those recipients if the data subject requests it. 41 Thus, the second sentence of Article 19 of the GDPR expressly confers on the data subject the right to be informed of the specific recipients of the data concerning him or her by the controller, in the context of the controller’s obligation to inform all the recipients of the exercise of the data subject’s rights under Article 16, Article 17(1) and Article 18 of the GDPR. 42 It follows from the above contextual analysis that Article 15(1)(c) of the GDPR is one of the provisions intended to ensure transparency vis-à-vis the data subject of the manner in which personal data are processed and enables that person, as the Advocate General observed in point 33 of his Opinion, to exercise the rights laid down, inter alia, in Articles 16 to 19, 21, 79 and 82 of the GDPR. 43 Accordingly, the information provided to the data subject pursuant to the right of access provided for in Article 15(1)(c) of the GDPR must be as precise as possible. In particular, that right of access entails the ability of the data subject to obtain from the controller information about the specific recipients to whom the data have been or will be disclosed or, alternatively, to elect merely to request information concerning the categories of recipient.

   Textul în documentul-sursă ↗

4. par. 17–27, 36–43 și 47–51; dispozitiv · limba originalului: en

   47 That said, it must, lastly, be emphasised that, as is apparent from recital 4 of the GDPR, the right to the protection of personal data is not an absolute right. That right must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality, as the Court reaffirmed, in essence, in paragraph 172 of the judgment of 16 July 2020, Facebook Ireland and Schrems (C‑311/18, EU:C:2020:559). 48 Accordingly, it may be accepted that, in specific circumstances, it is not possible to provide information about specific recipients. Therefore, the right of access may be restricted to information about categories of recipient if it is impossible to disclose the identity of specific recipients, in particular where they are not yet known. 49 In addition, it should be borne in mind that, under Article 12(5)(b) of the GDPR, the controller may, pursuant to the principle of responsibility referred to in Article 5(2) and recital 74 of that regulation, refuse to act on requests from a data subject where those requests are manifestly unfounded or excessive, it being specified that it is for the controller to demonstrate that those requests are unfounded or excessive. 50 In the present case, it is apparent from the request for a preliminary ruling that Österreichische Post refused the request made by RW under Article 15(1) of the GDPR to be informed of the identity of the recipients to whom Österreichische Post had disclosed the personal data concerning him. It will be for the referring court to determine whether, in the light of the circumstances of the main proceedings, Österreichische Post has demonstrated that that request is manifestly unfounded or excessive.

   Textul în documentul-sursă ↗