Not named in the source

What happened

The Spanish DPA decided that, in light of an access request, the controller needs to inform the data subject about whether it has transferred their data to third parties and to whom, even if the controller does not hold any data itself.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 13Information to be provided where personal data are collected from the data subjectRead →
• Art. 15Right of access by the data subjectRead →

• Data subject rights
• Transparency