CJEU - C-205/25 - Bayerisches Landesamt fur Datenschutzaufsicht
CJEU rules DPAs are controllers when handling complaints and cannot completely restrict access rights.
The Court of Justice of the European Union (CJEU) ruled that a Data Protection Authority (DPA) acts as a controller when handling data subjects' complaints under Article 77 GDPR. The court also held that Article 23 GDPR precludes national laws that completely restrict data subjects' access rights, even for objectives like preserving confidentiality or the proper functioning of DPAs.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Bayerisches Landesamt fur Datenschutzaufsicht?
Get an email when a new story names Bayerisches Landesamt fur Datenschutzaufsicht, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CJEU clarified that Data Protection Authorities act as data controllers when processing complainants' personal data under Article 77 GDPR, meaning they are themselves bound by GDPR obligations. National laws that impose blanket restrictions on data subjects' access rights — even under the pretext of protecting DPA confidentiality or operational integrity — violate Article 23 GDPR, which only permits narrowly tailored and proportionate restrictions. This matters because public authorities cannot claim special exemptions that effectively nullify the fundamental rights GDPR was designed to protect. Organizations and regulators alike must ensure that any limitation on data subject rights is specific, necessary, and proportionate rather than absolute.