An individual submitted a subject access request to their former employer. This individual then raised a concern with the DPC querying whether the company was obliged to provide them with the names of all of the employees who had been involved in compiling the response to the subject access request.

The DPC assessed the legal framework surrounding this question and responded to the query with reference to paragraph 73 of judgement C-579/21 of the Court of Justice of the European Union (CJEU) and article 15(4) of the GDPR. In this regard, the CJEU judgement had clarified that ‘the employees of the controller cannot be regard as being ‘recipients’, within the meaning of Article 15(1)(c) of the GDPR [...] when they process personal data under the authority of that controller and in accordance with its instructions’.

Consequently, the DPC advised the individual that they were not entitled to a list of the names of the employees who had been involved in preparing their subject access request response under the category of ‘recipients’ as provided for in the GDPR under Article 15(1)(c) and Article 15(4) of the GDPR.