CJEU - C‑414/24 - Datenschutzbehörde (Articulation des recours)
CJEU rules supervisory authorities cannot reject GDPR complaints solely due to ongoing judicial proceedings.
The Court of Justice of the European Union (CJEU) has ruled that a data protection supervisory authority cannot reject a complaint solely because the data subject has already initiated judicial proceedings on the same matter. This decision clarifies that the right to lodge a complaint with a supervisory authority under GDPR is independent of the right to a judicial remedy against a controller or processor.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CJEU clarified that data subjects retain the right to file complaints with supervisory authorities (such as a Data Protection Authority) even when they have already pursued judicial remedies against a controller or processor. Organizations that assumed parallel proceedings would neutralize regulatory scrutiny were operating under a flawed legal assumption. This ruling reinforces that GDPR provides layered, independent enforcement pathways — supervisory, judicial, and civil — that cannot be used to obstruct one another. Failing to recognize this distinction exposes organizations to simultaneous regulatory investigations and court actions, compounding legal and reputational risk.