## Facts

- A Rotterdam municipal authority maintained a population register containing residents’ personal data.
- Under national rules, the authority could disclose register data to third parties.
- An individual requested access to information identifying which third parties had received his personal data, including disclosures made in prior years.
- The authority kept the underlying personal data for a long period but retained records identifying recipients (and the content disclosed) for only one year.
- The authority provided disclosure information for the preceding year and refused earlier information because it no longer stored those records.
- The dispute reached a national supreme administrative court, which referred questions to the Court of Justice of the European Union on the meaning of the access right in Directive 95/46/EC.

## Issues

1. Whether the access right to information about “recipients or categories of recipient” requires disclosure information covering past recipients, not only present or ongoing disclosures.
2. Whether a Member State may impose time limits on retaining disclosure-recipient information and thereby limit the effective scope of the access right, and what standard governs such limits.

## Decision

- The court held that the access right covers information about recipients (or categories of recipients) and the content of disclosed data both for the present and for the past.
- The court held that Member States may set time limits for retaining and providing access to disclosure-recipient information only if the limit reflects a fair balance between the data subject’s privacy interests (including the ability to object and to sue) and the controller’s storage burden.
- The court indicated that retaining disclosure-recipient information for only one year, while retaining the underlying personal data for much longer, fails that fair-balance requirement unless the controller can show that longer retention would impose an excessive burden.

## Legal Principles

- The right of access to personal data processing includes access to information about recipients or categories of recipients of disclosed personal data, including historical disclosures.
- Access rights must be effective; meaningful exercise of rectification/erasure rights and the ability to object or pursue legal remedies may require knowledge of past disclosures.
- Retention limits affecting access to disclosure-recipient information are permissible only if proportionate, requiring a fair balance between data-subject interests and controller burdens.
- A very short retention period for disclosure logs is generally incompatible with the access right when the core personal data are retained much longer, absent proof of excessive burden.

## Conclusion

The court required that access rights under Directive 95/46/EC extend to past disclosures of personal data and limited national discretion to curtail that access through short log-retention periods, permitting restrictions only where justified by a proportional fair-balance assessment grounded in controller burden and the data subject’s ability to protect privacy and seek remedies.


Coll. of Mayor & Aldermen of Rotterdam v. Rijkeboer, Case C-553/07 (C.J.E.U. 2009)