Administrative Court of Berlin (VG Berlin), Judgment of 28 May 2026 – VG 42 K 98/26
Any controller that discloses personal data to third parties on the basis of consent must identify the recipients within the consent declaration. The question is how specific this identification must be: is a reference to a category of recipients, such as “partners” or “regional providers”, sufficient, or must the actual recipient be named? The Administrative Court of Berlin has now clarified this issue, which is relevant to countless sales and marketing processes.
The Core Holding
In the court’s view, merely stating a category of recipients is not sufficient where the actual recipient is already known to, or identifiable by, the controller at the time consent is obtained. In such cases, the specific recipient must be named. Consent is only “informed” where the data subject knows who will receive their personal data – at least where that recipient has already been determined.
Basis: The Transparency Provisions of the GDPR
The court relies on Articles 13(1)(e) and 15(1)(c) GDPR, which expressly distinguish between “the recipients” and “the categories of recipients” of personal data. From these transparency requirements, the court derives an obligation to identify the actual recipient whenever that recipient is already known to the controller.
No Reliance on Legitimate Interests
Nor can Article 6(1)(f) GDPR (the balancing of legitimate interests) be invoked as a fallback in this scenario. Where the data subject has not been adequately informed of the controller’s interests and cannot reasonably anticipate disclosure to an unknown recipient, the transfer cannot be justified on the basis of legitimate interests.
Practical Guidance:
Controllers should review the consent language used for lead sharing, dealer and franchise networks, referral programmes and other third-party data transfers. Where the recipient has already been determined, naming a mere category will generally not suffice.
Recommended immediate steps:
- Take stock: Identify the processes in which personal data is disclosed to third parties on the basis of consent.
- Specify recipients: Name determined recipients explicitly or make them readily available, rather than referring generically to “partners”.
- Revise consent wording: Amend existing forms so that the relevant information is provided transparently and intelligibly at the point of consent.
We would be glad to assist you in reviewing and structuring your consent processes in a legally compliant manner.
Full text of the decision (german): https://gesetze.berlin.de/bsbe/document/NJRE001646740
Contact:
Jens Borchardt