In relation to personal data, any authorized person to whom the data are disclosed other than the data subject, the data controller, and persons who are in charge of processing the data. Those legally constituted authorities which are entitled to ask the data controller to send them the personal data are not to be regarded as data recipients.