[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2hyVQdbKIzk2g5PQQWTmsYcMDNxq-MHej3y_-BxXaYs":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":43},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"a3a7f77f-b865-4cf2-badd-414b4531cf38","CJEU - C-205\u002F25 - Bayerisches Landesamt fur Datenschutzaufsicht","cjeu-c-205-25-bayerisches-landesamt-fur-datenschutzaufsicht-bcf63e","← Older revision Revision as of 13:46, 11 November 2026 (One intermediate revision by the same user not shown) Line 5: Line 5: |Opinion_Link=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:62025CC0205 |Opinion_Link=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:62025CC0205 |Judgement_Link= |Judgement_Link=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:62025CJ0205 |Date_Decided= |Date_Decided= Line 43: Line 43: }} }} The AG opined that a DPA can be considered a controller when investigating a complaint, and therefore must also provide data subjects with access in accordance with Article 15 GDPR. The AG also considered national law provisions that generally exclude right to access obligations for supervisory authorities incompatible with EU law. The CJEU decided that a DPA acts as a controller when it handles data subjects’ complaints under [[Article 77 GDPR]]. Additionally, the CJEU held that [[Article 23 GDPR]] precludes national law which completely restricts data subjects’ access right. ==English Summary== ==English Summary==","The Court of Justice of the European Union (CJEU) ruled that a Data Protection Authority (DPA) acts as a controller when handling data subjects' complaints under Article 77 GDPR. The court also held that Article 23 GDPR precludes national laws that completely restrict data subjects' access rights, even for objectives like preserving confidentiality or the proper functioning of DPAs.","CJEU rules DPAs are controllers when handling complaints and cannot completely restrict access rights.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-205\u002F25_-_Bayerisches_Landesamt_fur_Datenschutzaufsicht&diff=53691&oldid=53685","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-11-11T13:46:08+00:00","2026-11-11T14:00:27.379733+00:00",7,[17],{"name":18,"type":19},"Bayerisches Landesamt fur Datenschutzaufsicht","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":41,"vendors":42},[],[],{"slug":44,"title":45,"body":46,"framework_refs":47,"framework_notes":51},"cjeu-rules-dpas-cannot-blanket-restrict-data-subject-access-rights-in-complaint-handling","CJEU Rules DPAs Cannot Blanket-Restrict Data Subject Access Rights in Complaint Handling","The CJEU clarified that Data Protection Authorities act as data controllers when processing complainants' personal data under Article 77 GDPR, meaning they are themselves bound by GDPR obligations. National laws that impose blanket restrictions on data subjects' access rights — even under the pretext of protecting DPA confidentiality or operational integrity — violate Article 23 GDPR, which only permits narrowly tailored and proportionate restrictions. This matters because public authorities cannot claim special exemptions that effectively nullify the fundamental rights GDPR was designed to protect. Organizations and regulators alike must ensure that any limitation on data subject rights is specific, necessary, and proportionate rather than absolute.",[48,49,50],"GDPR Article 77","GDPR Article 23","GDPR Article 15",{"GDPR Article 15":52,"GDPR Article 23":53,"GDPR Article 77":54},"This article grants data subjects the right of access to their personal data, which the court confirmed cannot be wholly negated even by DPAs invoking operational confidentiality.","This article defines the strict conditions under which GDPR rights may be restricted, and the court found national laws imposing blanket access restrictions exceed what Article 23 permits.","This article establishes the right to lodge complaints with a DPA, and the ruling confirms that DPAs act as controllers when processing those complaints, triggering full GDPR obligations."]