ECJ Rules Data Subjects Entitled To Know Of Recipients

The decision clarifies the scope of the Data Subject Access Request under the GDPR.

The ECJ decided the previously open question of how much detail the employer must provide about the recipients or groups of recipients of the personal data upon request.

The right to information under data protection law

Under Article 15 of the GDPR, the data controller (in the employment context, usually the employer) must provide the data subject (the employee), at the employee's request, with certain specified information about the personal data it processes. This Data Subject Access Request (DSAR) is a popular instrument for employees. It is often asserted in an employment dispute, especially in connection with termination, to increase the pressure on the employer to settle a case.