CJEU - C‑414/24 - Datenschutzbehörde (Articulation des recours)

Summary

The Court of Justice of the European Union (CJEU) has ruled that data protection authorities (DPAs) cannot dismiss a complaint simply because judicial proceedings on the same matter are already underway. The court clarified that the right to lodge a complaint with a DPA is independent of the right to seek a judicial remedy against a controller or processor under GDPR.

Full text

Help CJEU - C‑414/24 - Datenschutzbehörde (Articulation des recours): Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 12:51, 19 June 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators30 editsmTag: Visual edit← Older edit Latest revision as of 06:39, 22 June 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators30 editsTag: Visual edit Line 45: Line 45: }}}} The AG opined that the DPA may not reject a complaint solely on the basis that there are pending judicial proceedings on the same subject matter before a court. According to the AG, the DPA must suspend its investigations until the ongoing proceedings are complete. The CJEU held that a supervisory authority cannot reject a complaint on the sole ground that judicial proceedings under Article 79(1) GDPR have already been brought concerning the same matter. ==English Summary====English Summary== Latest revision as of 06:39, 22 June 2026 CJEU - C‑414/24 Datenschutzbehörde (Articulation des recours) Court: CJEU Jurisdiction: European Union Relevant Law: Article 77(1) GDPR Article 78(1) GDPR Article 79(1) GDPR Decided: 04.09.2025 Parties: Case Number/Name: C‑414/24 Datenschutzbehörde (Articulation des recours) European Case Law Identifier: ECLI:EU:C:2025:656 Reference from: VwGH (Austria) Language: 24 EU Languages Original Source: AG OpinionJudgement Initial Contributor: ap The CJEU held that a supervisory authority cannot reject a complaint on the sole ground that judicial proceedings under Article 79(1) GDPR have already been brought concerning the same matter. Contents 1 English Summary 1.1 Facts 1.2 Advocate General Opinion 1.3 Holding 2 Comment 3 Further Resources English Summary Facts In 2017 (before the GDPR entered into force), a data subject requested an online physician search platform (the controller) to erase their data. The controller refused, and the data subject brought a claim before a civil court. The data subject requested the controller to erase their data again after the GDPR had entered into force. This request was refused, and the data subject filed a complaint with the Austrian DPA. The DPA dismissed the complaint, on the grounds that they had previously brought the same matter before a court. According to the DPA, filing parallel or consecutive claims with a supervisory authority and a court was incompatible with the remedial mechanism under the GDPR. At the time, the civil court had not reached a final decision. The data subject appealed the decision to the Federal Administrative Court (Bundesverwaltungsgericht, or BVwG), who dismissed the appeal. The BVwG stated that the one-year limitation period under Austrian law had passed, and therefore, the data subject did not have the right to file a complaint with the DPA. The fact that the GDPR had entered into force did not interrupt the limitation period. Both the data subject and the DPA appealed the decision of the Court to the Supreme Administrative Court (Verwaltungsgerichtshof, or VwGH). The VwGH disagreed with the reasoning of the BVwG; the limitation period only started after the controller rejected the data subject’s second erasure request, after the GDPR had entered into force. The VwGH stayed proceedings and requested a preliminary ruling from the CJEU. The question was based on the Case C-132/21, in which the CJEU held that the right to lodge a complaint with a supervisory authority (Articles 77(1) and 78(1) GDPR) may be exercised independently from the right to a judicial remedy against a controller or processor (Article 79(1) GDPR). The VwGH requested the CJEU to clarify the relationship between the remedies, and specifically, whether a DPA can reject a complaint on the grounds that the data subject has initiated judicial proceedings on the same subject. The Court referred the following questions: 1. Are Articles 77 and 79 of [the GDPR] to be interpreted, in the light of the findings of the Court in the judgments [in Nemzeti Adatvédelmi és Információszabadság Hatóság] and [SCHUFA Holding], as meaning that the possibility provided by national law for the rejection of a complaint lodged with a supervisory authority under Article 77 of the GDPR on the ground that a judicial remedy has already been sought in the same case under Article 79 of the GDPR and that the action is pending before the court [in question] constitutes a permissible arrangement for regulating the relationship between those remedies within the meaning of the abovementioned case-law of the Court? 2. If the answer to the first question is in the negative, are Articles 77 and 79 of [the GDPR] to be interpreted, in the light of the findings of the Court in the judgments [in Nemzeti Adatvédelmi és Információszabadság Hatóság] and [SCHUFA Holding], as meaning that the possibility provided by national law for the rejection of a complaint lodged with a supervisory authority under Article 77 of the GDPR on the ground that a substantive judgment (even if not yet final) has already been made in the pending proceedings in the same case on the judicial remedy under Article 79 of the GDPR constitutes a permissible arrangement for regulating the relationship between those remedies within the meaning of the abovementioned case-law of the Court?’ Advocate General Opinion AG De la Tour examined both questions together. The AG first considered the wording of the GDPR provisions: both Articles 77(1) and 78(1) GDPR, as well as 79(1) GDPR offer different remedies without prejudice to the other remedies. The remedies coexist independently, because the EU legislator intended to provide data subjects with a high level of protection regarding their right to data protection, and guarantee access to an effective judicial remedy. The AG referred to his previous opinion in C-132/21, where he stated that allowing a DPA to reject a complaint on the basis that judicial proceedings on the same matter had already been brought would undermine the right of data subjects to bring parallel actions on the same processing of personal data. However, the AG also pointed out the risk of legal uncertainty caused by two contradictory decisions within a Member State; while contradictory decisions between Member States were regulated by the GDPR, the AG concluded that it was the responsibility of each member State to ensure there are no contradictory decisions within a Member State regarding the same processing of personal data. These procedural rules, however, must be implemented in line with the principles of equivalence and effectiveness. According to the AG, a possible solution for Member States is to provide the option or obligation of DPAs and courts to stay proceedings pending before it until a decision has been taken by another DPA or court. In this case, the DPA should be allowed to suspend the investigation of the data subject’s complaint until the decision of the civil court is final. The AG noted that the decision of the DPA to reject the complaint may not necessarily be an appropriate measure to avoid contradictory decisions. The DPA cannot be certain that the court will decide on the merits in its proceedings as it may dismiss the claim on procedural grounds. Finally, the AG highlighted the importance of supervisory authorities’ role in safeguarding data subjects’ right to protection of their personal data. Rejecting a complaint automatically on the basis that there are ongoing judicial proceedings on the same matter would be contrary to its duty of diligence. The AG concluded that both questions should be answered in the negative, meaning the DPA may not reject a complaint on the grounds that judicial proceedings concerning the same matter have already been brought if said proceedings are not yet final. Holding The CJEU examined the two questions together and answered both of them in the negative. The Cour

Entities