[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1XhJgNRdFzVZ14O4NpdC1FmU2fFm4gKKlHqdgB17zVQ":3},{"article":4,"iocs":37,"watch_terms":38,"solutions":39,"lesson":42},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"5ea99ce8-9877-415c-a79e-92dce8a8dcad","CJEU - C-205\u002F25 - Bayerisches Landesamt für Datenschutzaufsicht","cjeu-c-205-25-bayerisches-landesamt-fur-datenschutzaufsicht-9b52f0","← Older revision Revision as of 11:20, 11 November 2026 Line 106: Line 106: }} }} The CJEU decided that a DPA can simultaneously act as a supervisory authority and a controller, when it comes to providing a data subject access to the personal data held by it stemming from an [[Article 77 GDPR|Article 77 GDPR]] complaint. Additionally, [[Article 23 GDPR|Article 23 GDPR]] precludes national law which completely restricts data subjects’ access right. The CJEU decided that a DPA acts as a controller when it handles data subjects’ complaints under [[Article 77 GDPR]]. Additionally, the CJEU held that [[Article 23 GDPR]] precludes national law which completely restricts data subjects’ access right. ==English Summary== ==English Summary==","The CJEU decided that a Data Protection Authority (DPA) can simultaneously act as a supervisory authority and a controller when handling data subject complaints under Article 77 GDPR. Additionally, the court held that Article 23 GDPR precludes national laws that completely restrict data subjects' access rights.","CJEU rules DPAs can be controllers and national laws cannot restrict data subject access rights.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-205\u002F25_-_Bayerisches_Landesamt_f%C3%BCr_Datenschutzaufsicht&diff=53686&oldid=53673","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-11-11T11:20:47+00:00","2026-11-11T12:00:42.785267+00:00",7,[17],{"name":18,"type":19},"GDPR","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,30,35],{"category":27},{"id":28,"icon":22,"name":18,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":31},{"id":32,"icon":22,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":20,"icon":22,"name":23,"slug":24},[],[],{"controls":40,"vendors":41},[],[],{"slug":43,"title":44,"body":45,"framework_refs":46,"framework_notes":50},"cjeu-rules-dpas-cannot-blanket-restrict-data-subject-access-rights-under-gdpr","CJEU Rules DPAs Cannot Blanket-Restrict Data Subject Access Rights Under GDPR","The Court of Justice of the EU clarified that a Data Protection Authority simultaneously holding the roles of supervisory authority and data controller does not create an inherent conflict that invalidates its oversight function. More critically, the Court struck down national laws that completely restrict data subjects' rights of access under Article 23 GDPR, reinforcing that any restriction must be proportionate and necessary rather than absolute. This matters because national legislators and organisations processing personal data under government mandates cannot use Article 23 as a blanket shield against transparency. Organisations and public authorities that have relied on overly broad national derogations to deny access requests must revisit their legal basis and data subject rights procedures immediately.",[47,48,49],"GDPR Article 77","GDPR Article 23","GDPR Article 15",{"GDPR Article 15":51,"GDPR Article 23":52,"GDPR Article 77":53},"Article 15 enshrines the data subject's right of access, which national derogations under Article 23 were found to impermissibly extinguish in this case.","The Court held that Article 23 precludes national laws that completely restrict data subjects' access rights, meaning any restriction must be proportionate and limited to what is strictly necessary.","This article governs the right to lodge a complaint with a supervisory authority, which the CJEU examined to confirm a DPA can act as both supervisory authority and controller when processing such complaints."]