Every European citizen has the right to know who has their data and with whom their personal data is shared. Such was the verdict of the European Court of Justice last Thursday.
The reason was a question from Austria's highest court about the General Data Protection Regulation (AVG). A citizen's case against Österreichische Post was pending in that country. He wanted to know with whom the postal company had shared his personal data. The only answer he got was that it would be used "for marketing purposes."
At trial, the postal company said it had forwarded the man's data to customers including IT companies, mailing list providers, charitable organizations and political parties. However, the court did not find that answer specific enough. If a person wants to know which companies and agencies his personal data was shared with, that person should be informed of the specific names of the receiving parties.
Only if the request for that information is unfounded or excessive, or it is impossible to identify the recipient, according to the court, may a company suffice to explain that the sharing of data is being used "for marketing purposes."
