[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fud1dDS7nOMp9SqihrH2NNlENI3qgZixS4IB7FESUDcg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":15,"status":19,"created_at":20,"published_at":21,"article":22,"tags":26,"podcasts":39,"controls":40},"6c460a6c-0d71-47fb-9b26-81aa1be1fa66","cjeu-rules-dpas-cannot-blanket-restrict-data-subject-access-rights-under-gdpr","5ea99ce8-9877-415c-a79e-92dce8a8dcad","CJEU Rules DPAs Cannot Blanket-Restrict Data Subject Access Rights Under GDPR","The Court of Justice of the EU clarified that a Data Protection Authority simultaneously holding the roles of supervisory authority and data controller does not create an inherent conflict that invalidates its oversight function. More critically, the Court struck down national laws that completely restrict data subjects' rights of access under Article 23 GDPR, reinforcing that any restriction must be proportionate and necessary rather than absolute. This matters because national legislators and organisations processing personal data under government mandates cannot use Article 23 as a blanket shield against transparency. Organisations and public authorities that have relied on overly broad national derogations to deny access requests must revisit their legal basis and data subject rights procedures immediately.","**Immediate actions:**\n- Audit all current data subject access request (DSAR) procedures to confirm they do not rely on blanket national restrictions invalidated by this ruling.\n- Identify any national legislative derogations under Article 23 GDPR your organisation uses and obtain updated legal counsel on their proportionality and validity.\n\n**Long-term improvements:**\n- Embed a periodic legal review cycle (at least annually) to track CJEU and national court rulings that affect your GDPR compliance posture.\n- Document the specific, necessity-tested justification for any Article 23 restriction applied to individual access requests rather than applying categorical denials.\n- Train legal, compliance, and DPO staff on the limits of Article 23 derogations and the proportionality test required by this judgment.\n\n**Detection & accountability measures:**\n- Implement a DSAR tracking register that flags any denial citing Article 23 for mandatory secondary review against current case law.\n- Establish a feedback loop between your DPO and legal team so that regulator decisions and CJEU rulings are reflected in updated internal policies within 30 days of publication.",[12,13,14],"GDPR Article 77","GDPR Article 23","GDPR Article 15",{"GDPR Article 15":16,"GDPR Article 23":17,"GDPR Article 77":18},"Article 15 enshrines the data subject's right of access, which national derogations under Article 23 were found to impermissibly extinguish in this case.","The Court held that Article 23 precludes national laws that completely restrict data subjects' access rights, meaning any restriction must be proportionate and limited to what is strictly necessary.","This article governs the right to lodge a complaint with a supervisory authority, which the CJEU examined to confirm a DPA can act as both supervisory authority and controller when processing such complaints.","published","2026-11-11T12:21:35.489104+00:00","2026-11-11T12:21:35.459+00:00",{"id":7,"url":23,"slug":24,"title":25},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-205\u002F25_-_Bayerisches_Landesamt_f%C3%BCr_Datenschutzaufsicht&diff=53686&oldid=53673","cjeu-c-205-25-bayerisches-landesamt-fur-datenschutzaufsicht-9b52f0","CJEU - C-205\u002F25 - Bayerisches Landesamt für Datenschutzaufsicht",[27,33],{"id":28,"name":29,"slug":30,"description":31,"color":32},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":34,"name":35,"slug":36,"description":37,"color":38},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]