[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fL-olIsc5xV5h2Mo0MemRjgsK9jgptnpjwDt9eBuvHRg":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"dab51b7c-0b7d-4d29-95bb-6f10c4e0aa29","CJEU - C-205\u002F25 - Bayerisches Landesamt für Datenschutzaufsicht","cjeu-c-205-25-bayerisches-landesamt-fur-datenschutzaufsicht-bab015","← Older revision Revision as of 14:16, 10 November 2026 (2 intermediate revisions by the same user not shown) Line 127: Line 127: # Whether a supervisory authority, as is the DPA in the case at hand, can simultaneously be considered a supervisory authority within the meaning of [[Article 4 GDPR|Article 4(21) GDPR]] and a controller within the meaning of [[Article 15 GDPR|Article 15]] in conjunction to [[Article 4 GDPR#(7) Controller|4(7) GDPR]]. # Whether a supervisory authority, as is the DPA in the case at hand, can simultaneously be considered a supervisory authority within the meaning of [[Article 4 GDPR|Article 4(21) GDPR]] and a controller within the meaning of [[Article 15 GDPR|Article 15]] in conjunction to [[Article 4 GDPR#(7) Controller|4(7) GDPR]]. # If the above is answered in the affirmative, whether [[Article 23 GDPR]] precludes national legislation which in the case at hand provides a blanket exclusion to the right of access. # If the above is answered in the affirmative, whether [[Article 23 GDPR]] precludes national legislation which in the case at hand provides a blanket exclusion to the right of access. === Holding === === Holding === ==== First Question: ==== ==== First Question: ==== The court underlined the obligation under [[Article 57 GDPR|Article 57(1)(f) GDPR]] requiring DPA’s to handle complaints lodged pursuant to [[Article 77 GDPR]]. Apparent from this obligation is the fact that DPA’s with which a complaint is lodged must process the personal data of the data subject. Therefore, that data is recorded, consulted, stored and used by the DPA. Evidently, the powers afforded to DPA’s by EU law also affords them to determine the purposes and means of processing in regards to the handling of the complaint within the remits of the definition of a controller. The court establishes therefore that a DPA must be regarded as a controller of the personal data of the data subject within the meaning of [[Article 4 GDPR|Article 4(7) GDPR]]. The court underlined the obligation under [[Article 57 GDPR|Article 57(1)(f) GDPR]] requiring DPA’s to handle complaints lodged pursuant to [[Article 77 GDPR]]. Apparent from this obligation is the fact that DPA’s with which a complaint is lodged must process the personal data of the data subject. Therefore, that data is recorded, consulted, stored and used by the DPA. Evidently, the powers afforded to DPA’s by EU law also implicitly affords them to determine the purposes and means of processing in regards to the handling of the complaint. The court establishes therefore that a DPA must be regarded as a controller of the personal data of the data subject within the meaning of [[Article 4 GDPR|Article 4(7) GDPR]]. The court further emphasised the broad definition of ‘controller’ the purpose to ensure the effective and complete protection of data subjects and the processing of their personal data. In that regard, if a DPA was not classified as a controller concerning the personal data processing by the DPA during complaint handling, data subjects would be deprived of their data subject rights (Chapter III GDPR), and DPA’s would not be subject to the principles of lawful processing within [[Article 5 GDPR|Article 5 GDPR]]. The court further emphasised the broad definition of ‘controller’ the purpose to ensure the effective and complete protection of data subjects and the processing of their personal data. In that regard, if a DPA was not classified as a controller concerning the personal data processing by the DPA during complaint handling, data subjects would be deprived of their data subject rights (Chapter III GDPR), and DPA’s would not be subject to the principles of lawful processing within [[Article 5 GDPR|Article 5 GDPR]]. Line 142: Line 139: The court stated that [[Article 23 GDPR|Article 23(1) GDPR]] allows for the restriction of obligations and rights as enshrined in [[Article 15 GDPR]], in order to safeguard objectives in the general interest. Nonetheless, the court also clarified that such restrictions must respect the essence of the fundamental rights and freedoms and must be necessary and proportionate. The court stated that [[Article 23 GDPR|Article 23(1) GDPR]] allows for the restriction of obligations and rights as enshrined in [[Article 15 GDPR]], in order to safeguard objectives in the general interest. Nonetheless, the court also clarified that such restrictions must respect the essence of the fundamental rights and freedoms and must be necessary and proportionate. The court expressed that whilst the referring court references [[Article 23 GDPR|Article 23(1) GDPR]] as the legal basis for the national law restriction, the referring court does not address any of the objectives listed in the provision. Namely as the two objectives pursued by the referring court through the national law provision were the preservation of the confidentiality of third parties’ personal data and the proper functioning and independent of DPA’s. The referring court also addressed the intention to protect public security, and thus deemed the objectives to be covered by Article 23(1)(c), (e), (h) and (i) GDPR. The court expressed that whilst the referring court references [[Article 23 GDPR|Article 23(1) GDPR]] as the legal basis for the national law restriction, the referring court does not address any of the objectives listed in the provision. Namely as the two objectives pursued by the referring court through the national law provision were the preservation of the confidentiality of third parties’ personal data and the proper functioning and independent of DPA’s. The referring court also addressed the intention to protect public security, and thus deemed the objectives to be covered by [[Article 23 GDPR#1c|Article 23(1)(c)]], [[Article 23 GDPR#1e|(e)]], [[Article 23 GDPR#1h|(h)]] and [[Article 23 GDPR#1i|(i)]] GDPR. ===== First objective: preservation of confidentiality of personal data concerning third parties ===== ===== First objective: preservation of confidentiality of personal data concerning third parties =====","The Court of Justice of the EU (CJEU) in case C-205\u002F25 ruled that data protection authorities (DPAs) must be regarded as controllers under Article 4(7) GDPR when processing personal data during complaint handling under Article 77 GDPR. The court emphasized that DPAs determine the purposes and means of processing complaints, and must therefore be subject to data subject rights and lawful processing principles to ensure effective protection. The decision addresses whether Article 23 GDPR precludes national legislation providing blanket exclusions to the right of access for DPA processing.","CJEU rules DPAs are simultaneously supervisory authorities and controllers under GDPR.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-205\u002F25_-_Bayerisches_Landesamt_f%C3%BCr_Datenschutzaufsicht&diff=53673&oldid=53646","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-11-10T14:16:45+00:00","2026-11-10T15:00:33.13093+00:00",7,[17],{"name":18,"type":19},"Bayerisches Landesamt für Datenschutzaufsicht","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":20,"icon":22,"name":23,"slug":24},null,"GDPR","gdpr",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18],{"controls":44,"vendors":45},[],[],{"slug":47,"title":48,"body":49,"framework_refs":50,"framework_notes":55},"cjeu-rules-dpas-are-gdpr-controllers-when-handling-complaints","CJEU Rules DPAs Are GDPR Controllers When Handling Complaints","The CJEU clarified in case C-205\u002F25 that data protection authorities (DPAs) are themselves 'controllers' under GDPR Article 4(7) when they process personal data during complaint handling, meaning they must comply with the same lawful processing principles they enforce on others. The ruling specifically challenges national legislation that creates blanket exemptions excluding data subjects' right of access to their own complaint-related data held by DPAs. This matters because it closes a governance loophole where oversight bodies could operate outside the very rules they are mandated to enforce, undermining public trust and the coherence of EU data protection law. Organizations and public bodies alike should take note: no entity — including regulators — is exempt from GDPR obligations without a lawful, proportionate basis.",[51,52,53,54],"GDPR Article 4","GDPR Article 23","GDPR Article 15","GDPR Article 5",{"GDPR Article 4":56,"GDPR Article 5":57,"GDPR Article 15":58,"GDPR Article 23":59},"The ruling turned on the definition of 'controller' in Article 4(7), confirming that DPAs determining the purposes and means of complaint-handling processing meet this definition.","Article 5 sets out core data processing principles — including lawfulness, fairness, and transparency — which the court confirmed apply to DPAs processing complaint data just as they do to any other controller.","Article 15 grants data subjects the right of access to their personal data, which the ruling confirms cannot be categorically excluded when a DPA acts as a controller during complaint handling.","The court examined whether Article 23 permits national legislation to impose blanket restrictions on the right of access for DPA-held complaint data, finding such restrictions must be necessary and proportionate."]