Must a corporate controller reveal employee identities to data subjects?

That was fast – less than a week after a CJEU judgment stating that it may be necessary for a controller to reveal the identity of the persons (e.g. employees) who processed personal data (C-579/21), the Belgian DPA applies that reasoning (in a separate case from the one handled by the CJEU) and orders a controller to carry out an assessment to determine what level of information needs to be provided. [Not an order to reveal the identity, therefore, but an order to assess what was the purpose of very specific processing and whether it is in that context necessary to reveal the identity of the relevant persons.]
Looks like the Belgian DPA was waiting for the judgment!

Here are the key excerpts, in which the Litigation Chamber of the Belgian DPA explains the main teachings of C-579/21:

“First of all, a data subject cannot, prima facie, have access to the identity of employees who have consulted his/her data under the authority of their employer and by following those instructions. However, the employer must provide the data subject with relevant information to enable him/her to verify the lawfulness of the processing. If the information provided is insufficient for this purpose, the data subject may turn to the supervisory authority, which will be able to carry out the necessary verifications.

[…] the Litigation Chamber understands from this ruling that when employees who consulted the data subject’s data did so for their own purposes (i.e. which do not comply with the employer’s instructions and are not under its authority), then the data subject must be able to access the identity of [the employees in question], unless the rights and freedoms of employees prevail. It is indeed clear from the Court’s judgment that the protection of the identity of employee who has acted under the authority of his employer is greater than that of an employee who has consulted the data for his or her own purposes.

Decision (in French): https://lnkd.in/e-pDb8jq
CJEU judgment in C-579/21: https://lnkd.in/e_5Y4UBq

gdpr data protection privacy