CJEU: GDPR authorities owe Article 15 access to complainants

By Amara Osei

On Thursday, 5 November 2026, in Luxembourg, the Court of Justice of the European Union held in Case C-205/25 that GDPR supervisory authorities must be classified as controllers in data-subject complaint proceedings and, in principle, must grant complainants access to their personal data. National laws cannot remove that right in this setting.

How did the dispute reach the CJEU?

The case, captioned Bayerisches Landesamt für Datenschutzaufsicht (Bavarian State Office for Data Protection Supervision), came from the Bavarian Administrative Court in Ansbach. It asks whether the Bavarian State Office for Data Protection Supervision is a GDPR controller when handling a complaint and whether German law may withhold a complainant’s Article 15 access rights.

The instrument at issue is Regulation (EU) 2016/679, the General Data Protection Regulation, adopted on 27 April 2016, which repealed Directive 95/46/EC. The first question concerned Article 4(7), read with Article 15; the second concerned Article 23(1)(c), (h) and (i).

Mr Lindenberg is a journalist who runs a blog covering data protection issues and other topics. After filing a data protection complaint with the Bavarian authority and receiving notice of the measures taken, he requested further details. The authority initially refused to supply that information and rejected his request for access.

It later granted him electronic access to the complaint case file, but did so without acknowledging any legal obligation to do so. Access came. Recognition did not. Mr Lindenberg now seeks a declaration that the initial refusal was unlawful.

The Bavarian Administrative Court referred the questions to the CJEU. The court’s answers cover the authority’s status in complaint proceedings and the effect of national law on access. The referral did not end the national case; it defined the legal route the national court must use. The framework is settled, but the individual claim is not.

What did the CJEU decide?

The court answered the referred questions in two parts.

• Controller status: A supervisory authority within Article 4(21) must be classified as a controller when handling an Article 77 complaint.
• National restrictions: A domestic provision that removes a complainant’s Article 15 right to access personal data held by that authority is precluded.

On controller status, the court stated:

“must, in the context of proceedings concerning a complaint lodged by a data subject pursuant to Article 77 of that regulation, be classified as a ‘controller’ and is therefore, in principle, obliged to grant that person access to the personal data concerning him or her and to the information listed in Article 15.”

The judgment addresses complaint proceedings under Article 77; it does not classify every supervisory-authority activity for every purpose. That is the ruling’s boundary.

On national law, the court held:

“It precludes a national provision under which a complainant has no right of access, as provided for in Article 15 of the GDPR, to personal data concerning him or her that are held by a supervisory authority within the meaning of Article 4(21) of that regulation.”

The practical rule is categorical in form. The access right survives a domestic exclusion. In plain terms, national law cannot outrank the GDPR access right in this complaint setting.

What access must the authority provide?

The CJEU said the authority must, in principle, grant the complainant access to personal data concerning him or her and to the information listed in Article 15. The right is personal: it concerns data about the complainant, not a general entitlement to inspect every file held by a supervisory authority.

The phrase “in principle” matters. The judgment establishes the GDPR obligation and removes a national-law defence based on the absence of any access right. It does not supply a detailed answer to every request for information, nor does the reported judgment announce an unconditional release of complete files.

For complainants, the GDPR now supplies the access route; domestic exclusion is no longer the final word.

What changes for practitioners?

Authorities must treat Article 77 complaint handling as a controller function for access purposes. They should document requests, identify personal data concerning the complainant and required Article 15 information, and assess limits. National exclusions are no longer a safe refusal. For lawyers, the ruling strengthens challenges to access denials, while the Bavarian court must still decide Mr Lindenberg’s individual claim.

What remains for the Bavarian court?

The CJEU did not dispose of Mr Lindenberg’s individual claim. The Bavarian Administrative Court in Ansbach must apply the answers and determine whether the authority’s initial refusal was unlawful. His later electronic access does not, by itself, resolve that historical question.

The accompanying English report describes itself as a non-binding, e-translated summary and states that the German full text alone is legally binding. Practitioners quoting the judgment should check the original wording where precision matters. The EU court has settled the legal framework; the Bavarian court must apply it.