CJEU - C-205/25 - Bayerisches Landesamt für Datenschutzaufsicht
CJEU rules DPAs can be controllers and national laws cannot restrict data subject access rights.
The CJEU decided that a Data Protection Authority (DPA) can simultaneously act as a supervisory authority and a controller when handling data subject complaints under Article 77 GDPR. Additionally, the court held that Article 23 GDPR precludes national laws that completely restrict data subjects' access rights.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe Court of Justice of the EU clarified that a Data Protection Authority simultaneously holding the roles of supervisory authority and data controller does not create an inherent conflict that invalidates its oversight function. More critically, the Court struck down national laws that completely restrict data subjects' rights of access under Article 23 GDPR, reinforcing that any restriction must be proportionate and necessary rather than absolute. This matters because national legislators and organisations processing personal data under government mandates cannot use Article 23 as a blanket shield against transparency. Organisations and public authorities that have relied on overly broad national derogations to deny access requests must revisit their legal basis and data subject rights procedures immediately.