Unsolicited advertising brochures in the mail and annoying calls from call centers: many consumers have had to experience this and wonder how they can prevent their data from being passed on, especially to professional mail order companies.
So far, despite the EU General Data Protection Regulation (GDPR), companies have rarely disclosed to whom the customer's address or telephone number has been passed on.
Marcus Young
Editor in Business.
Follow I follow
With a recent decision, the European Court of Justice (ECJ) has immensely strengthened the rights of those affected.
Accordingly, everyone has a right to information under Art. 15 GDPR to whom personal data has been passed on.
The Luxembourg judges require companies to provide specific information about the recipients upon request.
This is the only way to enforce claims such as the deletion of data and liability claims.
Fines and damages are threatened
According to Anna Lena Füllsack, a lawyer at the commercial law firm CMS Germany, the ECJ has once again tightened the data protection obligations for companies.
“Responsible persons must now disclose each individual recipient when responding to a request for information.
If companies do not comply with this specific obligation to provide information, in addition to fines from the supervisory authorities, there is a risk of claims for damages from those affected.”
The judgment allows exceptions only within narrow limits.
As before, the recipient's industry affiliation should only be stated if this simply cannot be identified or the consumer's request for information is clearly unfounded or too excessive.
However, there should not be a larger time buffer for the application review for the companies.
IT and data protection lawyers emphasize that you should therefore act with foresight in business transactions with your third-party and advertising partners.
"Since requests for information have to be answered within four weeks, it is advisable not to obtain the necessary information on the recipients when a specific request for information is made," says attorney Füllsack.
Those responsible in companies should be very aware of the individual recipients of personal data.
"A detailed processing index can be a great help," says Füllsack.
The initial case concerns the transfer of personal data by Austrian Post to its business partners.
The latter admitted to the transfer, but did not want to give any detailed information about the recipients.
Now the supreme court in Vienna, before which the lawsuit is pending, has to pass a judgment according to the specifications from Luxembourg (Case C-154/2).