In the first half of January this year, the Court of Justice of the European Union published its decision (C-154/21 Österreichische Post) on certain aspects of article 15 of GDPR. The Court clarifies how specific is the obligation of the data controller to communicate to data subjects the identity of the recipients of their personal data (art. 15 (1) (c)).
The Court has ruled that mere categories of the recipients is not specific enough to satisfy the purpose of the art. 15. Rather, data controller shall list the recipients specifically so data subjects could know their true identity. However, this should not concern art. 13 and 14 of GDPR. For more information please click here.