The Court of Justice of the EU Thursday ruled in a preliminary ruling that where personal data has been disclosed to a third party, every person has the right to know to whom his or her personal data have been disclosed on request unless the demand is “manifestly unfounded or excessive.”

Considering the context, objectives and purpose of the EU General Data Protection Regulation (GDPR), the court ruled that in order to protect an individual’s right to rectification, right to erasure, or right to restriction of processing as conferred by Articles 16, 17 and 18 respectively, the right of access is essential under this circumstance. Article 19 of GDPR confirms this reading, which protects the data subject’s right to data portability.

The court recognised the purpose of GDPR in ensuring a high level of protection of natural persons within the EU. Yet, it maintained that the right to protection of personal data is not absolute. It should adhere to the “principle of proportionality” by considering the exercising of that right is balanced against other fundamental rights and their function in society. Requests that are “manifestly unfounded or excessive” or impossible to provide would be limited as such.

The dispute arose from the request of RW on January 15, 2019, who demanded the Österreichische Post (Post), an operator of postal and logistical services in Austria, for access to information under Article 15(1)(c) of GDPR. He argued that he should have the right to obtain information regarding “the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations.” In response, the Post stated the data was given to “trading partners for marketing purposes” without revealing the specifics and that it was only used to the extent permissible by law.

Lower courts dismissed the action and a later appeal on the grounds that the section gives the Post the option to inform RW of the “categories of recipient” without any specifications. On an appeal, RW raised a point of law before Oberster Gerichtshof, the Supreme Court of Austria (the referring court), which decided on a stay in proceedings and referred the question to the Court of Justice for a preliminary ruling on the extent of the right of access for the data subject under GDPR.

The matter will return to the referring court to determine whether the Post could sufficiently demonstrate RW’s request is manifestly unfounded or excessive.