CJEU - C-205/25 - Bayerisches Landesamt fur Datenschutzaufsicht
CJEU rules Data Protection Authorities are controllers when handling complaints under GDPR.
The Court of Justice of the European Union (CJEU) has ruled that Data Protection Authorities (DPAs) act as controllers of personal data when handling complaints lodged under Article 77 of the GDPR. This classification ensures DPAs are subject to data processing principles and data subjects retain their rights. The court also addressed restrictions on the right of access under Article 15 GDPR, stating that while restrictions are permissible for general interest objectives, they must respect the essence of fundamental rights and be necessary and proportionate.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe CJEU clarified that Data Protection Authorities themselves are subject to GDPR obligations as data controllers when they process personal data during complaint handling under Article 77. This matters because DPAs cannot claim special exemption from the very rules they are mandated to enforce. Access restrictions under Article 15 must be narrowly tailored, proportionate, and preserve the essence of fundamental rights — vague or overly broad restrictions are unlawful. Organizations and public bodies alike should recognize that no entity, including regulators, is above GDPR accountability.