[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2F8v2iDVotkkah-nWsomt2x86u2QTH5xfmQ9S6XAbMw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":15,"status":19,"created_at":20,"published_at":21,"article":22,"tags":26,"podcasts":39,"controls":40},"7ad83029-011e-4024-9851-056ee0d46b05","cjeu-rules-dpas-cannot-blanket-restrict-data-subject-access-rights-in-complaint-handling","a3a7f77f-b865-4cf2-badd-414b4531cf38","CJEU Rules DPAs Cannot Blanket-Restrict Data Subject Access Rights in Complaint Handling","The CJEU clarified that Data Protection Authorities act as data controllers when processing complainants' personal data under Article 77 GDPR, meaning they are themselves bound by GDPR obligations. National laws that impose blanket restrictions on data subjects' access rights — even under the pretext of protecting DPA confidentiality or operational integrity — violate Article 23 GDPR, which only permits narrowly tailored and proportionate restrictions. This matters because public authorities cannot claim special exemptions that effectively nullify the fundamental rights GDPR was designed to protect. Organizations and regulators alike must ensure that any limitation on data subject rights is specific, necessary, and proportionate rather than absolute.","**Immediate actions:**\n- Audit any internal policies that restrict data subject access rights to ensure they are narrowly scoped, documented, and legally justified under Article 23 GDPR.\n- Review complaint-handling workflows to confirm that personal data processed during regulatory or oversight activities is handled with the same GDPR obligations as any other controller.\n\n**Long-term improvements:**\n- Establish a legal review process for national or internal implementing measures that limit GDPR rights, ensuring each restriction is proportionate and time-limited.\n- Train legal, compliance, and DPA staff on the controller obligations that arise when handling data subjects' personal data in regulatory proceedings.\n- Embed periodic GDPR compliance assessments specifically covering the authority's own data processing activities, not only those of regulated entities.\n\n**Detection & accountability measures:**\n- Implement internal logging and review mechanisms to track how data subject requests are handled within complaint processes.\n- Create a formal escalation path for data subjects to challenge access restrictions, ensuring the DPA's own decisions remain subject to judicial oversight.",[12,13,14],"GDPR Article 77","GDPR Article 23","GDPR Article 15",{"GDPR Article 15":16,"GDPR Article 23":17,"GDPR Article 77":18},"This article grants data subjects the right of access to their personal data, which the court confirmed cannot be wholly negated even by DPAs invoking operational confidentiality.","This article defines the strict conditions under which GDPR rights may be restricted, and the court found national laws imposing blanket access restrictions exceed what Article 23 permits.","This article establishes the right to lodge complaints with a DPA, and the ruling confirms that DPAs act as controllers when processing those complaints, triggering full GDPR obligations.","published","2026-11-11T14:21:02.257689+00:00","2026-11-11T14:21:02.217+00:00",{"id":7,"url":23,"slug":24,"title":25},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-205\u002F25_-_Bayerisches_Landesamt_fur_Datenschutzaufsicht&diff=53691&oldid=53685","cjeu-c-205-25-bayerisches-landesamt-fur-datenschutzaufsicht-bcf63e","CJEU - C-205\u002F25 - Bayerisches Landesamt fur Datenschutzaufsicht",[27,33],{"id":28,"name":29,"slug":30,"description":31,"color":32},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":34,"name":35,"slug":36,"description":37,"color":38},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]