High Court clarifies scope of data subject’s right to know specific recipients of their personal data

On 7 June 2024, in the case of Harrison v Cameron & Another, the High Court ruled that, in the context of a data subject access request under Article 15 UK GDPR, data subjects are entitled in principle to know the specific identities of the recipients of their personal data and not just the categories of recipients. The decision clarifies Article 15(1)(c) UK GDPR, which requires a controller to provide the data subject (following a data subject access request) with details of “the recipients or…
By: A&O Shearman