The GDPR

Article 19 sets up a notification obligation of the data controller that requires them to communicate to each data recipient any rectification, erasure or restriction of processing on the basis of Articles 16, 17 (1) and Article 18 of the Regulation.

The controller, however, can avoid this obligation if they prove that such communications is impossible or involves disproportionate effort.

The final compromise on the future Regulation supplements Article 18 with an obligation to inform the data subject of the identity of recipients when the data subject so requests.

The Directive

The Directive already required the states to guarantee to data subjects the right to obtain notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking, unless this proves impossible or involves a disproportionate effort (see Article 12 c)).

Potential issues

This right is difficult to manage. It requires a perfect management of data transfers to third parties and strongly depends on the sustainability of those third parties (transformation, bankruptcy, etc.). The inability to escape it must however be objective and can not be confused with the lack of implementation of a transmission monitoring procedure.