CJEU - C‑414/24 - Datenschutzbehörde (Articulation des recours)
CJEU rules supervisory authorities cannot reject GDPR complaints solely due to pending court proceedings.
The Court of Justice of the European Union (CJEU) has ruled that data protection authorities (DPAs) cannot dismiss a complaint simply because judicial proceedings on the same matter are already underway. The court clarified that the right to lodge a complaint with a DPA is independent of the right to seek a judicial remedy against a controller or processor under GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Court of Justice of the European Union clarified that data protection authorities (DPAs) cannot dismiss a GDPR complaint solely because judicial proceedings on the same matter are already in progress. This ruling reinforces that the right to complain to a DPA is an independent and autonomous remedy under GDPR, separate from any judicial route a data subject may pursue. Organizations must recognize that they can face simultaneous regulatory investigations and civil litigation for the same data protection violation, compounding liability and reputational risk. This matters because companies that assume an ongoing lawsuit 'shields' them from regulatory scrutiny are now on notice that this assumption is legally incorrect across the EU.