Data subjects have a number of specific rights under the UK GDPR, including the right to obtain information about ‘the recipients or categories of recipient’ to whom their personal data have been, or will be, disclosed (article 15(1)(c)). There is currently a pending application before the ECJ, which seeks to clarify the scope and extent of this right of access. 

As a preliminary stage, before the full ECJ hearing, an Advocate General (AG) has given his non-binding opinion. In the AG’s opinion, under article 15(1)(c):

• A data subject’s right of access extends, where a data subject requests this, to the identification of the specific recipients to whom their personal data has or will be disclosed;
• The data subject has the choice of requesting information as to the ‘recipients’ or ‘categories of recipient’ to whom their personal data have been (or will be) disclosed; it is not for the controller to choose between these options; and
• The information provided to the data subject must be as precise as possible because the purpose of article 15(1)(c) is to enable the data subject to be aware of the processing of their data, verify its lawfulness and confirm the recipients are authorised.

(RW -v- Österreichische Post AG (Case C‑154/21) EU:C:2022:452)