A method of controlling transmission of data over a data network , the method comprising: authenticating a first user of a client system with a server system ; sending (S204) to the server system, a request message comprising data corresponding to a first group (314, G1) of user identifiers corresponding to a plurality of proposed recipients; determining (S208) one or more updates to the first group of user identifiers based at least in part on: a group score based on a similarity measure indicative of a degree of overlap between the first group of user identifiers and a second group (G2) of user identifiers corresponding to at least one or more recipients of a historical data package , the second group of user identifiers comprising a user identifier corresponding to the first user; and a user score for a second user identifier in the second group based on the group score and access data indicative of a time at which the second user accessed a payload associated with the historical data package; wherein the one or more updates indicate that the second user identifier should be removed from the first group of user identifiers when the user score satisfies a removal condition, and the first group of user identifiers includes the second user identifier; transmitting (S210) a control message to the client system, the control message comprising data indicative of the one or more updates to the group of user identifiers; generating an updated group of user identifiers based on the data of the control message; constructing (S214) a data package comprising a set of recipients based on the updated group of user identifiers; and transmitting the data package to the set of recipients. authenticating a first user of a client system with a server system ; sending (S204) to the server system, a request message comprising data corresponding to a first group (314, G1) of user identifiers corresponding to a plurality of proposed recipients; determining (S208) one or more updates to the first group of user identifiers based at least in part on: a group score based on a similarity measure indicative of a degree of overlap between the first group of user identifiers and a second group (G2) of user identifiers corresponding to at least one or more recipients of a historical data package , the second group of user identifiers comprising a user identifier corresponding to the first user; and a user score for a second user identifier in the second group based on the group score and access data indicative of a time at which the second user accessed a payload associated with the historical data package; a group score based on a similarity measure indicative of a degree of overlap between the first group of user identifiers and a second group (G2) of user identifiers corresponding to at least one or more recipients of a historical data package , the second group of user identifiers comprising a user identifier corresponding to the first user; and a user score for a second user identifier in the second group based on the group score and access data indicative of a time at which the second user accessed a payload associated with the historical data package; wherein the one or more updates indicate that the second user identifier should be removed from the first group of user identifiers when the user score satisfies a removal condition, and the first group of user identifiers includes the second user identifier; transmitting (S210) a control message to the client system, the control message comprising data indicative of the one or more updates to the group of user identifiers; generating an updated group of user identifiers based on the data of the control message; constructing (S214) a data package comprising a set of recipients based on the updated group of user identifiers; and transmitting the data package to the set of recipients. <EOS>