[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fX_qFyVJS5SDM_CxANiCmIBYxgyIp5zqzmrONoPNToY0":3},{"article":4,"iocs":37,"watch_terms":38,"solutions":39,"lesson":42},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"29898de4-8ec7-4292-9f34-f2be57803054","CJEU - C-205\u002F25 - Bayerisches Landesamt fur Datenschutzaufsicht","cjeu-c-205-25-bayerisches-landesamt-fur-datenschutzaufsicht-715f32","← Older revision Revision as of 11:20, 11 November 2026 Line 81: Line 81: === Holding === === Holding === TBD. ==== First Question: ==== The court underlined the obligation under [[Article 57 GDPR|Article 57(1)(f) GDPR]] requiring DPA’s to handle complaints lodged pursuant to [[Article 77 GDPR]]. Apparent from this obligation is the fact that DPA’s with which a complaint is lodged must process the personal data of the data subject. Therefore, that data is recorded, consulted, stored and used by the DPA. Evidently, the powers afforded to DPA’s by EU law also implicitly affords them to determine the purposes and means of processing in regards to the handling of the complaint. The court establishes therefore that a DPA must be regarded as a controller of the personal data of the data subject within the meaning of [[Article 4 GDPR|Article 4(7) GDPR]]. The court further emphasised the broad definition of ‘controller’ the purpose to ensure the effective and complete protection of data subjects and the processing of their personal data. In that regard, if a DPA was not classified as a controller concerning the personal data processing by the DPA during complaint handling, data subjects would be deprived of their data subject rights (Chapter III GDPR), and DPA’s would not be subject to the principles of lawful processing within [[Article 5 GDPR]]. Finally, the court clarified that whilst [[Article 15 GDPR|Article 15(1) GDPR]] establishes a right of access to the personal data concerning a data subject. The article does not establish a general right of access to procedure files, nor a right to inspect the documents held by an authority such as the DPA, in its capacity as a controller. ==== Second Question: ==== The court stated that [[Article 23 GDPR|Article 23(1) GDPR]] allows for the restriction of obligations and rights as enshrined in [[Article 15 GDPR]], in order to safeguard objectives in the general interest. Nonetheless, the court also clarified that such restrictions must respect the essence of the fundamental rights and freedoms and must be necessary and proportionate. The court expressed that whilst the referring court references [[Article 23 GDPR|Article 23(1) GDPR]] as the legal basis for the national law restriction, the referring court does not address any of the objectives listed in the provision. Namely as the two objectives pursued by the referring court through the national law provision were the preservation of the confidentiality of third parties’ personal data and the proper functioning and independent of DPA’s. The referring court also addressed the intention to protect public security, and thus deemed the objectives to be covered by [[Article 23 GDPR#1c|Article 23(1)(c)]], [[Article 23 GDPR#1e|(e)]], [[Article 23 GDPR#1h|(h)]] and [[Article 23 GDPR#1i|(i)]] GDPR. ===== First objective: preservation of confidentiality of personal data concerning third parties ===== The court expressed that to pursue the preservation of confidentiality, [[Article 23 GDPR|Article 23(1)(i) GDPR]] allows for the restriction on the right to access to protect the rights and freedoms of others, however that such restriction must not have adverse effects on such. This means that the essence of fundamental rights and freedoms must be must be respected and necessary and proportionate in a democratic society. In that regard, the court maintained that a restriction may not allow for an outright refusal, as provided for by the national law provision relied upon, to provide all information. The court further emphasised that where there is a conflict between exercising the full and complete right to access with the rights or freedoms of others, a balance must be struck. The court addressed measures such as redaction or anonymisation of personal data concerning third parties, and deemed them sufficient to reconcile the interests at stake without the complete removal of the right to access. ===== Second objective: preservation of the proper functioning of the DPA’s ===== Furthermore, the court mentioned [[Article 52 GDPR]] which guarantees the full independence of DPA’s and requires each member state to ensure that each supervisory authority is provided with the human, technical and financial resources necessary for the effective performance of its tasks and exercise of its powers. The court found that this objective is legitimate under [[Article 23 GDPR|Article 23(1)(h) GDPR]]. Nonetheless following the AG’s opinion, the exercise of the right to access should not be capable of undermining the guarantee of independence by DPA’s to perform their supervisory tasks. With the same logic, the supervisory functions shall be performed effectively, and therefore a national law provision which enshrines a general and abstract prohibition to access does not pursue the objective in a proportionate manner. Ultimately, the right to access cannot be precluded in a general manner for the purpose of preserving the proper functioning and independence of DPA’s. ===== Third objective: protection of public security ===== Finally, the court clarified that in accordance to [[Article 23 GDPR|Article 23(1)(c) GDPR]] a restriction may be relied upon only where there is a genuine and sufficiently serious threat which affects the fundamental interest of society. In the present case, the court deemed this requirement of genuine and sufficiently serious threat not satisfied. ==== Ruling: ==== In light of the foregoing, the court answered the first question in the affirmative. Namely that the provisions must be interpreted to mean that in an [[Article 77 GDPR]] complaint procedure, the DPA (defined by [[Article 4 GDPR|Article 4(21) GDPR]]) must be classified as a controller and thus in principle must be required to grant data subject their access request made pursuant to [[Article 15 GDPR]]. As a result of the affirmative response to the first question, the court provided a response to the second. In particular, that [[Article 23 GDPR#1c|Article 23(1)(c)]], [[Article 23 GDPR#1h|(h)]] and [[Article 23 GDPR#1i|(i) GDPR]] must be interpreted as precluding a national law provision where a data subject has no right of access to personal data held by the DPA. == Comment == == Comment ==","The Court of Justice of the European Union (CJEU) has ruled that Data Protection Authorities (DPAs) act as controllers of personal data when handling complaints lodged under Article 77 of the GDPR. This classification ensures DPAs are subject to data processing principles and data subjects retain their rights. The court also addressed restrictions on the right of access under Article 15 GDPR, stating that while restrictions are permissible for general interest objectives, they must respect the essence of fundamental rights and be necessary and proportionate.","CJEU rules Data Protection Authorities are controllers when handling complaints under GDPR.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-205\u002F25_-_Bayerisches_Landesamt_fur_Datenschutzaufsicht&diff=53685&oldid=51457","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-11-11T11:20:34+00:00","2026-11-11T12:00:42.785267+00:00",7,[17],{"name":18,"type":19},"GDPR","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,30,35],{"category":27},{"id":28,"icon":22,"name":18,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":31},{"id":32,"icon":22,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":20,"icon":22,"name":23,"slug":24},[],[],{"controls":40,"vendors":41},[],[],{"slug":43,"title":44,"body":45,"framework_refs":46,"framework_notes":51},"cjeu-rules-dpas-are-gdpr-controllers-when-handling-complaints-1794399709398","CJEU Rules DPAs Are GDPR Controllers When Handling Complaints","The CJEU clarified that Data Protection Authorities themselves are subject to GDPR obligations as data controllers when they process personal data during complaint handling under Article 77. This matters because DPAs cannot claim special exemption from the very rules they are mandated to enforce. Access restrictions under Article 15 must be narrowly tailored, proportionate, and preserve the essence of fundamental rights — vague or overly broad restrictions are unlawful. Organizations and public bodies alike should recognize that no entity, including regulators, is above GDPR accountability.",[47,48,49,50],"GDPR Article 4","GDPR Article 15","GDPR Article 77","ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of personally identifiable information",{"GDPR Article 4":52,"GDPR Article 15":53,"GDPR Article 77":54,"ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of personally identifiable information":55},"The definition of 'controller' in Article 4(7) is at the heart of this ruling, as the CJEU applied it to determine that DPAs bear controller obligations when processing complainants' personal data.","The ruling directly addressed the limits of permissible restrictions on the right of access under Article 15, requiring any restriction to be necessary, proportionate, and respectful of fundamental rights.","The personal data processed during Article 77 complaint procedures was the specific context in which the CJEU determined DPAs assume controller status and corresponding obligations.","This control requires organizations to identify and comply with applicable privacy and data protection requirements, which now explicitly extends to regulatory bodies processing complaint data as controllers."]