CJEU - C-205/25 - Bayerisches Landesamt für Datenschutzaufsicht
CJEU rules DPAs are simultaneously supervisory authorities and controllers under GDPR.
The Court of Justice of the EU (CJEU) in case C-205/25 ruled that data protection authorities (DPAs) must be regarded as controllers under Article 4(7) GDPR when processing personal data during complaint handling under Article 77 GDPR. The court emphasized that DPAs determine the purposes and means of processing complaints, and must therefore be subject to data subject rights and lawful processing principles to ensure effective protection. The decision addresses whether Article 23 GDPR precludes national legislation providing blanket exclusions to the right of access for DPA processing.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Bayerisches Landesamt für Datenschutzaufsicht?
Get an email when a new story names Bayerisches Landesamt für Datenschutzaufsicht, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CJEU clarified in case C-205/25 that data protection authorities (DPAs) are themselves 'controllers' under GDPR Article 4(7) when they process personal data during complaint handling, meaning they must comply with the same lawful processing principles they enforce on others. The ruling specifically challenges national legislation that creates blanket exemptions excluding data subjects' right of access to their own complaint-related data held by DPAs. This matters because it closes a governance loophole where oversight bodies could operate outside the very rules they are mandated to enforce, undermining public trust and the coherence of EU data protection law. Organizations and public bodies alike should take note: no entity — including regulators — is exempt from GDPR obligations without a lawful, proportionate basis.