A method of controlling transmission of data over a data network, the method comprising: authenticating a first user of a client system with a server system; sending to the server system, a request message comprising data corresponding to a first group (314, G1) of user identifiers corresponding to a plurality of proposed recipients; determining one or more updates to the first group of user identifiers based at least in part on: a group score based on a similarity measure indicative of a degree of overlap between the first group of user identifiers and a second group of user identifiers corresponding to at least one or more recipients of a historical data package, the second group of user identifiers comprising a user identifier corresponding to the first user; and a user score for a second user identifier in the second group based on the group score and access data indicative of a time at which the second user accessed a payload associated with the historical data package; wherein the one or more updates indicate that the second user identifier should be removed from the first group of user identifiers when the user score satisfies a removal condition, and the first group of user identifiers includes the second user identifier; transmitting a control message to the client system, the control message comprising data indicative of the one or more updates to the group of user identifiers; generating an updated group of user identifiers based on the data of the control message; constructing a data package comprising a set of recipients based on the updated group of user identifiers; and transmitting the data package to the set of recipients. authenticating a first user of a client system with a server system; sending to the server system, a request message comprising data corresponding to a first group (314, G1) of user identifiers corresponding to a plurality of proposed recipients; determining one or more updates to the first group of user identifiers based at least in part on: a group score based on a similarity measure indicative of a degree of overlap between the first group of user identifiers and a second group of user identifiers corresponding to at least one or more recipients of a historical data package, the second group of user identifiers comprising a user identifier corresponding to the first user; and a user score for a second user identifier in the second group based on the group score and access data indicative of a time at which the second user accessed a payload associated with the historical data package; a group score based on a similarity measure indicative of a degree of overlap between the first group of user identifiers and a second group of user identifiers corresponding to at least one or more recipients of a historical data package, the second group of user identifiers comprising a user identifier corresponding to the first user; and a user score for a second user identifier in the second group based on the group score and access data indicative of a time at which the second user accessed a payload associated with the historical data package; wherein the one or more updates indicate that the second user identifier should be removed from the first group of user identifiers when the user score satisfies a removal condition, and the first group of user identifiers includes the second user identifier; transmitting a control message to the client system, the control message comprising data indicative of the one or more updates to the group of user identifiers; generating an updated group of user identifiers based on the data of the control message; constructing a data package comprising a set of recipients based on the updated group of user identifiers; and transmitting the data package to the set of recipients.