CJEU Rules DPAs Must Handle Complaints Regardless of Parallel Court Proceedings
The Court of Justice of the European Union clarified that data protection authorities (DPAs) cannot dismiss a GDPR complaint solely because judicial proceedings on the same matter are already in progress. This ruling reinforces that the right to complain to a DPA is an independent and autonomous remedy under GDPR, separate from any judicial route a data subject may pursue. Organizations must recognize that they can face simultaneous regulatory investigations and civil litigation for the same data protection violation, compounding liability and reputational risk. This matters because companies that assume an ongoing lawsuit 'shields' them from regulatory scrutiny are now on notice that this assumption is legally incorrect across the EU.
Tactical Insight
Immediate actions
- Review all open GDPR complaints with your DPA to ensure no parallel judicial proceedings are being used as a basis to delay or dismiss regulatory engagement.
- Brief your legal and compliance teams on the CJEU ruling to align litigation and regulatory response strategies accordingly.
Organizational & Compliance improvements
- Establish a unified incident and complaint tracking register that flags when both judicial and DPA proceedings are active on the same matter.
- Implement a dual-track response protocol that independently manages regulatory (DPA) and judicial obligations without assuming one forecloses the other.
- Engage external Data Protection Officers or legal counsel experienced in multi-forum GDPR disputes to coordinate responses.
Long-term governance measures
- Conduct annual GDPR compliance training that includes updates on landmark CJEU rulings and their operational implications.
- Develop a formal regulatory engagement policy that defines how the organization interacts with DPAs regardless of concurrent litigation status.