The Court of Justice of the European Union (CJEU) ruled this Thursday that a person has the right to know to whom their personal data has been communicated, to request its rectification, the right to be forgotten or to complain about possible harm.
In this way, the judges answered the question posed by the Austrian Supreme Court whether the EU’s General Data Protection Regulation obliges the person responsible for the processing of personal data to inform the affected party what they have used the information for.
In a court case in Austria, a national postal company informed a concerned citizen that it had transferred his personal data to advertisers in the mail order and physical trade sectors, IT companies, directory publishers and associations such as charities and non-governmental organizations or political parties.
In today’s ruling, the CJEU stated that “if this data is or is intended to be provided to recipients, the person responsible for the treatment is obliged to provide the interested party, upon request, with the identity of those persons. receivers”.
And if the recipients of personal data can be identified or the person responsible for them “shows that the request is clearly unfounded or excessive”, their categories can be indicated “only”.
According to the Luxembourg-based court, the right to know to whom the data has been transferred “is necessary for them to be able to enjoy other rights recognized by the regulation”, such as the right to rectification, the right to be forgotten, the right to restriction. Treatment, the right to object to treatment and the right to appeal damages.
Source: El Diario
