Summary Of 2023's Key CJEU Data Protection Judgments

This briefing provides an overview and summary of several of the key data protection judgments from the Court of Justice of the European Union in 2023. The judgments consider issues including compensation under the GDPR, the right of access to personal data and independence of data protection officers.

Information about the recipients or categories of recipients to whom the personal data have been or will be disclosed pursuant to Article 15 GDPR

The judgment in Case C-154/21 (RW v Österreichische Post AG) was delivered by the Court of Justice of the European Union ("CJEU") on 12 January 2023. Significantly, the CJEU found that data subjects are entitled to obtain either: (a) information about the specific recipients to whom their personal data have been or will be disclosed, where possible; or (b) information about the categories of the recipient. The information provided to the data subject pursuant to the right of access contained in Article 15(1)(c) must be