CJEU Rules DPAs Cannot Blanket-Restrict Data Subject Access Rights Under GDPR
Written by AI from the linked story. Not reviewed by an editor. How this works
The Court of Justice of the EU clarified that a Data Protection Authority simultaneously holding the roles of supervisory authority and data controller does not create an inherent conflict that invalidates its oversight function. More critically, the Court struck down national laws that completely restrict data subjects' rights of access under Article 23 GDPR, reinforcing that any restriction must be proportionate and necessary rather than absolute. This matters because national legislators and organisations processing personal data under government mandates cannot use Article 23 as a blanket shield against transparency. Organisations and public authorities that have relied on overly broad national derogations to deny access requests must revisit their legal basis and data subject rights procedures immediately.
Tactical Insight
Immediate actions
- Audit all current data subject access request (DSAR) procedures to confirm they do not rely on blanket national restrictions invalidated by this ruling.
- Identify any national legislative derogations under Article 23 GDPR your organisation uses and obtain updated legal counsel on their proportionality and validity.
Long-term improvements
- Embed a periodic legal review cycle (at least annually) to track CJEU and national court rulings that affect your GDPR compliance posture.
- Document the specific, necessity-tested justification for any Article 23 restriction applied to individual access requests rather than applying categorical denials.
- Train legal, compliance, and DPO staff on the limits of Article 23 derogations and the proportionality test required by this judgment.
Detection & accountability measures
- Implement a DSAR tracking register that flags any denial citing Article 23 for mandatory secondary review against current case law.
- Establish a feedback loop between your DPO and legal team so that regulator decisions and CJEU rulings are reflected in updated internal policies within 30 days of publication.