Court of Justice of the European Union in its Press release No. 4/23 on 12th January, 2023 ruled that as per Article 15 of GDPR , a person has the right to know the actual identity of the recipient with whom his/her data has been shared. The controller is obliged to give the details upon the request of the data subject as per article 15 GDPR. The court further ruled that it is only where it is not (yet) possible to identify those recipients then only the controller may provide the category of recipient in question otherwise individual recipients name has to be provided to the data subject. Also, if the controller successfully demonstrates that the request made by the data subject is manifestly unfounded or excessive ,the controller may claim such an exemption .
Data subject’s right to access data is the foundation of other data subject rights such as right to object,right to erasure ,right to rectification etc.
Judgment of the court case C- 154/21 (Osterreichische Post, information regarding recipients of personal data)