A controller’s access-request response discloses the personal data but omits recipients or categories of recipients. What Article 15 element is missing?
Select an answer to reveal the explanation.
Short Explanation
Access is not just a data dump of fields—it is also the story of who else got a copy. Recipients or categories of recipients belong in that story. Leaving them out short-changes the transparency Article 15 expects.
Full Explanation
Article 15 access includes not only a copy of personal data but also information elements such as the recipients or categories of recipients to whom personal data have been or will be disclosed, among other listed items (purposes, categories of data, retention, rights, and more). An access response that discloses the personal data yet omits recipients or categories of recipients is incomplete against that transparency design.
Only the DPO’s personal mobile number is not the mandatory access element at issue. Recipients need not always be listed by precise name—categories may suffice in some cases—but omitting both recipients and categories fails the information duty. Access responses may not be reduced to a binary yes/no that data exist without the substantive picture Article 15 requires.
Exam caveat: remember the Article 15 information catalogue beyond the raw data copy. Operational check: template responses to include purposes, categories of data, recipients or categories of recipients, retention periods, rights information, and source information where applicable; quality-check before release. Municipal access packs should tell residents who else saw their data—an accountability story people can understand—rather than a silent dump without the sharing narrative that civic transparency demands.