CJEU Rules DPAs Cannot Blanket-Restrict Data Subject Access Rights in Complaint Handling
Written by AI from the linked story. Not reviewed by an editor. How this works
The CJEU clarified that Data Protection Authorities act as data controllers when processing complainants' personal data under Article 77 GDPR, meaning they are themselves bound by GDPR obligations. National laws that impose blanket restrictions on data subjects' access rights — even under the pretext of protecting DPA confidentiality or operational integrity — violate Article 23 GDPR, which only permits narrowly tailored and proportionate restrictions. This matters because public authorities cannot claim special exemptions that effectively nullify the fundamental rights GDPR was designed to protect. Organizations and regulators alike must ensure that any limitation on data subject rights is specific, necessary, and proportionate rather than absolute.
Tactical Insight
Immediate actions
- Audit any internal policies that restrict data subject access rights to ensure they are narrowly scoped, documented, and legally justified under Article 23 GDPR.
- Review complaint-handling workflows to confirm that personal data processed during regulatory or oversight activities is handled with the same GDPR obligations as any other controller.
Long-term improvements
- Establish a legal review process for national or internal implementing measures that limit GDPR rights, ensuring each restriction is proportionate and time-limited.
- Train legal, compliance, and DPA staff on the controller obligations that arise when handling data subjects' personal data in regulatory proceedings.
- Embed periodic GDPR compliance assessments specifically covering the authority's own data processing activities, not only those of regulated entities.
Detection & accountability measures
- Implement internal logging and review mechanisms to track how data subject requests are handled within complaint processes.
- Create a formal escalation path for data subjects to challenge access restrictions, ensuring the DPA's own decisions remain subject to judicial oversight.