The Court of Justice of the European Union (CJEU) has clarified the status of supervisory authorities under data protection law when handling a complaint. According to the CJEU judgment of 5 November 2026 – C-205/25 (case number), a supervisory authority is also a controller within the meaning of Article 4(7) GDPR in this respect. It must therefore generally provide the data subject with access to their personal data and the information specified in Article 15 GDPR.
Request for Access Submitted to the Bavarian State Office
The decision arose from a legal dispute between a journalist and the Bayerisches Landesamt für Datenschutzaufsicht (Bavarian State Office for Data Protection Supervision). The journalist operates a blog that addresses data protection matters, among other topics, and had initiated several complaint proceedings before the authority since 2021.
On 13 May 2022, he lodged another data protection complaint. The State Office subsequently opened supervisory complaint proceedings against a third party. In October 2022, the authority informed the complainant that it had identified data protection infringements by the third party; if further infringements occurred after the expiry of the implementation period, a warning subject to a fee would be issued.
The complainant then requested more detailed information about the measures taken by the authority. After he did not receive this information, he submitted a request for full access under Article 15(1) and (3) GDPR.
State Office Relied on the Bavarian Data Protection Act
The State Office rejected the request for access by reference to Article 20(2) of the Bayerisches Datenschutzgesetz (BayDSG, Bavarian Data Protection Act). Under this provision, there are no rights of access to or inspection of the supervisory authorities’ files and records.
The complainant subsequently brought an action before the Bayerisches Verwaltungsgericht Ansbach (Bavarian Administrative Court of Ansbach). He initially sought an order requiring the State Office to provide a copy of all data concerning him contained in the complaint file.
In February 2024, the authority granted electronic access to the file, but did not acknowledge any corresponding legal obligation. The complainant therefore maintained his request for a declaration that the decision rejecting his request was unlawful.
Questions Referred by the Verwaltungsgericht Ansbach
The Verwaltungsgericht Ansbach had to determine whether, when handling a complaint, a data protection supervisory authority acts exclusively in its supervisory capacity or must also be regarded as a controller in relation to the complainant’s data.
A further question was whether Article 23 GDPR permits a national provision that excludes rights of access to and inspection of all files and records of a supervisory authority without an assessment of the individual case.
The State Office took the view that a supervisory authority could not simultaneously be a controller vis-à-vis the complainant within the meaning of Article 4(7) GDPR. By contrast, according to the Administrative Court’s preliminary assessment, the two capacities could coexist.
Supervisory Authority Processes Data on Its Own Responsibility
The CJEU began by examining the definitions in the GDPR. Under Article 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person. The concept of processing in Article 4(2) GDPR includes, in particular, the collection, recording, storage, retrieval and use of such data.
Under Article 4(7) GDPR, a controller is a natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing. Where those purposes and means are determined by EU or Member State law, the controller or the specific criteria for its nomination may also be provided for by law.
Purposes and Means Derive from EU Law
Under Article 57(1)(f) GDPR, supervisory authorities must handle complaints lodged by data subjects and investigate their subject matter to the extent appropriate. In doing so, they routinely collect, store, use and examine the complainant’s personal data.
In the CJEU’s view, the purposes and means of this processing essentially derive from the provisions of EU law governing the supervisory authority’s tasks and powers. This is sufficient for classification as a controller. The authority is not required to determine the purposes and means entirely on its own.
The broad definition of controller is intended to ensure effective and comprehensive protection of data subjects. If the supervisory authority were not treated as a controller, its processing operations would, among other things, be exempt from the following requirements:
- The data subject would be unable to exercise against the authority their rights to information, access, rectification, erasure and restriction of processing.
- With respect to this processing, the authority would not be bound by the principles of lawfulness, transparency, purpose limitation, data minimisation and accuracy under Article 5 GDPR.
- The requirements concerning the security of personal data in Chapter IV, Section 2 GDPR would not apply to the processing in question.
Such an outcome would be incompatible with the level of protection sought by the GDPR.
Authority May Perform a Dual Role
The Court did not accept the argument that the GDPR necessarily distinguishes between a supervisory authority and a controller. Although the provisions addressing the two roles separately generally assume that they are performed by different bodies, they do not preclude a supervisory authority from simultaneously meeting the requirements applicable to a controller in certain circumstances.
According to the judgment, the authority may organise its internal structure so that the processing of the complainant’s personal data is subject to independent oversight by another unit within the same authority.
Scope of the Right of Access Under Article 15 GDPR
If the supervisory authority is the controller in relation to the complainant’s data, the complainant is generally entitled to exercise the right of access under Article 15 GDPR. In particular, the data subject may request confirmation as to whether personal data concerning them is being processed.
If that is the case, the right of access covers the personal data and, among other things, information concerning:
- the purposes of the processing,
- the categories of personal data concerned,
- the recipients or categories of recipients,
- the envisaged retention period or the criteria used to determine that period,
- existing rights to rectification, erasure, restriction or objection,
- the source of the data where it was not collected from the data subject,
- and, where applicable, the existence of automated decision-making, including profiling.
Article 15(3) GDPR also requires a copy of the personal data undergoing processing to be provided.
No General Right to Inspect the Entire File
The CJEU expressly limited the scope of its decision. Article 15 GDPR does not confer a general right of access to the complete administrative file. Nor does it provide a right to inspect all documents held by a public authority.
The request covers only the data subject’s personal data and the information specified in Article 15 GDPR. Whether intelligible and complete access also requires extracts from documents or entire documents to be provided depends on what is necessary to reproduce the personal data being processed. Under Article 15(4) GDPR, the copy must not adversely affect the rights and freedoms of others.
Blanket Exclusion Under Article 20(2) BayDSG
In the second part of its decision, the CJEU examined whether Article 23 GDPR permits the complete statutory exclusion of the right of access vis-à-vis supervisory authorities.
Article 23(1) GDPR permits certain data subject rights to be restricted by legislative measures. Such a restriction must respect the essence of fundamental rights and freedoms and be necessary and proportionate in a democratic society. It must also serve one of the objectives listed in Article 23(1) GDPR.
In the main proceedings, the following protective objectives were cited in particular:
- the protection of personal data and other rights of third parties,
- the proper functioning and independence of supervisory authorities,
- and the safeguarding of public security.
The Court acknowledged that these considerations could, in principle, constitute possible grounds for restrictions. However, they do not justify a general and abstract exclusion of the right of access.
Third-Party Rights Require a Balancing Exercise
The protection of the rights and freedoms of others may justify restricting the right of access. Complaint files, in particular, may contain third parties’ personal data or other protected information.
According to the CJEU, however, such protection must not result in the data subject being denied all access to their own data. Where rights conflict, the rights concerned must be balanced against one another. Wherever possible, methods of disclosure must be chosen that protect third-party rights without eliminating the right of access entirely.
The Court identified the redaction or anonymisation of third parties’ personal data as possible methods in particular. A provision that does not allow the authority to conduct such a balancing exercise and requires it to reject the request in full is incompatible with Article 23(1)(i) GDPR.
Proper Functioning and Independence Are Insufficient
The effective and independent performance of a data protection supervisory authority’s tasks is a legitimate objective. At the same time, Article 52 GDPR requires Member States to provide supervisory authorities with the human, technical and financial resources necessary to perform their tasks.
The CJEU could not identify how the exercise of the right of access as such would impair the authority’s independent activities. Even a potentially significant administrative burden does not justify a general exclusion.
Article 12(5) GDPR already contains a specific rule for requests that are manifestly unfounded or excessive. Subject to the conditions set out therein, the controller may charge a reasonable fee or refuse to act on the request. A complete exclusion of all access requests is therefore not proportionate as a means of safeguarding the authority’s proper functioning and independence.
No Established Threat to Public Security
The protection of public security may also, in principle, justify a restriction of the right of access under Article 23(1)(c) GDPR. This requires an actual and sufficiently serious threat affecting one of the fundamental interests of society.
According to the CJEU’s findings, no such threat was apparent from the case file. Public security could therefore not justify the blanket exclusion in the specific context.
Key Findings of the CJEU
In conclusion, the Court answered the questions referred by the Verwaltungsgericht Ansbach as follows:
A supervisory authority that handles a complaint under Article 77 GDPR is a controller under Article 4(7) GDPR in relation to the complainant’s personal data processed in that context. It is therefore generally required to provide the data subject with access to that data and the information listed in Article 15 GDPR.
Article 23(1)(c), (h) and (i) GDPR precludes a national provision that completely denies the complainant the right of access to their personal data held by the supervisory authority. Article 20(2) BayDSG therefore cannot support such a general exclusion.
Continuation of the Main Proceedings
The proceedings before the Verwaltungsgericht Ansbach must be continued and concluded on the basis of the CJEU’s binding interpretation of EU law. The Administrative Court will rule on the costs of the main proceedings. The costs incurred by the other parties that submitted observations to the CJEU are not recoverable.
The decision also illustrates the distinction between access under data protection law and general inspection of files: Article 15 GDPR provides access to one’s own personal data and the supplementary information specified by law, but does not automatically provide access to the authority’s entire file. Companies, investors and private individuals with questions concerning the scope of data subject rights or requests for access submitted to public- or private-sector controllers may contact MTR Legal. Further information is available under Legal advice on data protection law.
