Two data subjects complained to the DPA about Ceska televize and B.B
(the controller), about the unlawful processing of their personal data.
Status Not cited by any decision here yet
Holding
The Supreme Administrative Court clarified that data subjects do not have the right to challenge a DPA’s decision to discontinue administrative proceedings against a third parties. The court restated that the case concerned the relationship between the State and the accused, not the data subject’s individual rights. Furthermore, the court clarified that whilst Articles 77 and 78 GDPR allow data subjects to challenge decisions regarding their own complaints, and the potential failure of the DPA to respond. However, emphasised that his does not give data subjects the right to demand a third party to be prosecuted. Therefore, the court dismissed the appeal by the data subjects as they lack legal standing to challenge the decision, upholding the decision of the Municipal Court. However, the court also emphasised that the data subjects retained the right to challenge the decision made by the DPA, regarding their complaint.
From GDPRhub’s case note — a summary of the decision, not its own words. Read it in the text ↓
Particularly, the processing operations concerned adults and minors with autism spectrum disorder who had been filmed using a hidden camera for a television programme called Obchod nadeji. Administrative proceedings were initiated against the controllers by the DPA in 2023, and discontinued by 2025. The data subjects challenged the discontinuation of the proceedings in the Municipal Court in Prague. The Municipal court dismissed the case as a result of a lack of standing, specifically, that the data subjects were not parties to the administrative proceedings and had no right to require a third party to be penalised. The data subjects argued that Article 78 GDPR gave them the right to effective judicial protection especially since the infringements concerned their personal data. They further emphasised that in denying their request to challenge the discontinuation, breached Article 47 of the European Union Charter of Fundamental Rights and the Czech Charter of Fundamental Rights and Freedoms. The DPA in return, argued that the proceedings under administrative law, concerned the relationship between the State and the controllers. Furthermore, the DPA emphasised that Czech procedural law governs the standing to challenge decisions in administrative proceedings. The case made it to the Supreme Administrative Court, to consider whether the data subjects had the right to challenge the decision to discontinue the proceedings concerning third parties.
Full text
Machine translation of the decision, via GDPRhub — not the official text. Read the original
Data Protection: The Data Subject’s Right to Effective Judicial Protection; the Data Subject’s Standing to Bring an Action Against a Decision to Dismiss Subsequent Administrative Offense Proceedings Regarding Articles 77 and 78 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR”) Regarding Section 46(1)(d), Section 68(e), and Section 70(a) of the Code of Administrative Procedure A data subject who has lodged a complaint pursuant to Article 77 of Regulation (EU) (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data has the right to effective judicial protection against a decision by the supervisory authority regarding that complaint or, where applicable, against its failure to act pursuant to Article 78 of that Regulation. However, the data subject does not have standing to file a lawsuit against a decision by the Office for Personal Data Protection to discontinue the subsequent administrative offense proceedings. The court shall dismiss an action against such a decision pursuant to Section 46(1)(d) in conjunction with Section 68(e) and Section 70(a) of the Code of Administrative Procedure. (According to the judgment of the Supreme Administrative Court dated June 17, 2026, Ref. No. 6 As 25/2026-35) Case law: No. 625/2005 Coll. NSS and No. 4178/2021 Coll. NSS; Constitutional Court Ruling No. 71/2024 Coll. ÚS (Case No. I. ÚS 1958/23); Judgments of the Court of Justice dated October 6, 1982, Cilfit et al. (C-283/81), dated December 14, 1995, Peterbroeck, Van Compenhout & Cie v. the Belgian State (C-312/93), dated January 7, 2004, Wells (C-201/02), dated October 21, 2008, Padawan (C-467/08), dated January 12, 2023; Budapesti Elektromos Művek (C-132/21), dated December 7, 2023, (C-26/22 and C-64/22), and dated September 26, 2024, Land Hessen (C-768/21). Case: a) Š. V. and b) M. K. v. the Office for Personal Data Protection regarding the commission of an administrative offense. By a ruling dated May 20, 2025, the defendant discontinued, pursuant to Section 86(1)(a) and (c) of Act No. 250/2016 Coll., on Liability for Administrative Offenses and Proceedings Therefor (hereinafter the “Administrative Offenses Act”), the administrative offense proceedings against Czech Television and B. B. on suspicion of committing administrative offenses under Section 62(1) of Act No. 110/2019 Coll., on the Processing of Personal Data. In the aforementioned proceedings, the defendant assessed the processing of personal data of adults and minors with autism spectrum disorder, who were captured in audiovisual recordings made with a hidden camera in connection with the production of the Czech Television program Obchod s nadějí (Trade in Hope) from the Infiltrace series. The plaintiffs, together with other individuals, filed a complaint with the defendant alleging a violation of their rights under the GDPR. By a notice dated May 5, 2023, the defendant initiated joint proceedings for administrative offenses against Czech Television and B. B. The plaintiffs challenged the defendant’s decision by filing a lawsuit with the Municipal Court in Prague, which, by an order dated December 19, 2025, Ref. No. 3 A 93/2025-23, dismissed the action pursuant to Section 46(1)(c) of the Code of Administrative Procedure on the grounds that the plaintiffs lacked standing to sue. According to the Municipal Court, only a person who alleges an infringement of their legal sphere has standing to sue, and such an infringement must be at least conceivable given the nature of the contested decision. The subject matter of administrative offense proceedings is the assessment of the accused’s guilt and the possible imposition of a sanction; thus, it is a purely public-law relationship that takes place between the state and the accused. A third party has no subjective right to seek the initiation of administrative offense proceedings against another party or to demand a finding of guilt against that party. Therefore, the plaintiffs’ legal sphere could not have been affected by the defendant’s assessment of the liability of the persons accused of the administrative offense. The Municipal Court also found that the plaintiffs lacked standing under Section 65(2) of the Code of Administrative Procedure. The plaintiffs do not fall into any of the categories of participants in administrative offense proceedings defined in Section 68 of the Administrative Offenses Act. They were not the accused, the owners of property that may be or was seized, nor the injured parties in the part of the proceedings concerning a claim for damages or the return of unjust enrichment. The Municipal Court deemed the fact that the administrative offense proceedings were initiated on the basis of the plaintiffs’ complaint to be irrelevant. Such a complaint must be regarded solely as a basis for initiating proceedings. The mere filing of the complaint does not confer procedural rights in the subsequent administrative offense proceedings. Regarding the reference to Article 78(1) of the GDPR, the Municipal Court noted that this provision enshrines the right of every natural or legal person to effective judicial protection against a legally binding decision by a supervisory authority that concerns the data subject. In the Czech legal system, such judicial protection is realized, among other things, through an action under Section 65 of the Code of Administrative Procedure. However, the contested decision did not concern the legal sphere of the plaintiffs, as it determined the administrative liability of other persons. Therefore, standing to sue cannot be derived from Article 78(1) of the GDPR. At the same time, the Municipal Court noted that the subject of judicial review in the present case is not the manner in which the plaintiffs’ complaint dated April 6, 2021, was handled; the plaintiffs are challenging exclusively the decision issued in the administrative offense proceedings. The plaintiffs (“complainants” or, individually, “complainant” and “complainant”) filed appeals against the Municipal Court’s ruling, arguing that the Municipal Court had impermissibly narrowed the scope of their legal arguments. The complainants did not base their standing to sue solely on the fact that they had filed a complaint that led to the initiation of the administrative offense proceedings, but primarily on their substantive connection to the matter at hand. The administrative proceedings conducted by the defendant concerned the processing of their personal data and the alleged infringement of their rights guaranteed by the GDPR. The defendant’s decision therefore directly affected them. According to the complainants, the contested ruling of the municipal court resulted in a denial of access to the courts and was contrary to Article 36(1) of the Charter of Fundamental Rights and Freedoms as well as Article 47 of the Charter of Fundamental Rights of the European Union. The complainants argued that the Municipal Court incorrectly interpreted the relationship between Section 65 of the Code of Administrative Procedure and Article 78(1) of the GDPR. It erred simply by assessing the issue of the complainants’ standing to sue under Section 65 of the Code of Administrative Procedure, thereby subjecting the scope of judicial protection guaranteed by Article 78(1) of the GDPR to domestic procedural rules. The complainants pointed to the direct effect of EU regulations and the principle of the primacy of EU law. In their view, these principles imply that Article 78(1) of the GDPR is, in and of itself, sufficient to establish standing to bring an action. Any national provision that would limit such standing must yield to EU law. At the same time, the complainants were convinced that the Municipal Court had interpreted the term “a decision of the supervisory authority concerning the complainant” in an impermissibly restrictive manner. The complainants referred to the judgment of the Court of Justice dated December 7, 2023, C-26/22 and C-64/22, from which it follows that, in order to preserve data subjects’ right to judicial protection, decisions of the supervisory authority are subject to judicial review in full jurisdiction. The requirement for full review of all factual and legal issues would be meaningless if the data subject did not have standing to bring an action. The complainants referred to the judgment of the Court of Justice dated January 12, 2023, Budapesti Elektromos Művek, C-132/21, according to which the remedies under Articles 77 through 79 of the GDPR are complementary and must be interpreted in a manner that ensures effective judicial protection for data subjects. A generally broad interpretation of standing to sue and the right to judicial protection is also supported by the judgments of the Court of Justice dated April 28, 2022, Meta Platforms Ireland, C-319/20, and dated January 19, 2023, Lindenapotheke, C-21/23. In its response to the cassation appeal, the defendant emphasized the principle of procedural autonomy of Member States, the significance of which in connection with the exercise of the rights guaranteed by Articles 77 and 78 of the GDPR was also confirmed by the Supreme Administrative Court in its judgment dated September 16, 2024, Ref. No. 1 As 71/2024-53. According to the defendant, the case at hand required reliance on the Czech legal framework governing administrative offense proceedings and the statutory definition of the parties to such proceedings. The defendant emphasized the specific nature of administrative offense proceedings, the subject matter of which is not the complainants’ subjective rights, but rather the assessment of the accused’s guilt regarding the offense. This assessment takes place exclusively between the state and the accused and is purely a matter of public law. There is no public subjective right to the initiation of administrative offense proceedings conducted ex officio, a point which was, moreover, confirmed by the Court of Justice in its judgment of September 26, 2024, Land Hessen, C-768/21. The Supreme Administrative Court dismissed the cassation appeal filed by Plaintiff B) due to non-payment of the court fee and dismissed the cassation appeal filed by Plaintiff A). From the reasoning: (…) III.2 On the complainant’s standing to sue [18] At the outset of its substantive review of the contested ruling of the municipal court, the Supreme Administrative Court emphasizes that, upon dismissal of the action, only the ground for cassation under Section 103(1)(e) of the Code of Administrative Procedure as a special provision in relation to the other grounds under Section 103(1) of the Code of Administrative Procedure (see the judgment of the Supreme Administrative Court dated April 21, 2005, Ref. No. 3 Azs 33/2004-98, No. 625/2005 Coll. of the Supreme Administrative Court). The Supreme Administrative Court may thus only consider whether the order dismissing the action is lawful or not. [19] The core of the dispute is the question of whether the complainant has standing to file an action against the defendant’s decision to discontinue administrative offense proceedings conducted against third parties. In his cassation complaint, the complainant bases his argument primarily on the wording of Article 78(1) of the GDPR and on the case law of the Court of Justice concerning judicial protection against decisions of a supervisory authority. [20] Under Article 77(1) of the GDPR, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, the place of employment, or the place where the alleged infringement occurred, if the data subject considers that the processing of his or her personal data infringes this Regulation. [21] Under Article 78(1) of the GDPR, any natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning that person. [22] Under Article 78(2) of the GDPR, every data subject has the right to an effective judicial remedy if a supervisory authority that is competent under Articles 55 and 56 fails to address the complaint or fails to inform the data subject within three months of the progress made in resolving the complaint lodged under Article 77 or of its outcome. [23] The interpretation of Article Article 78 of the GDPR is supported by Recital 143 of the GDPR: “Without prejudice to the right under Article 263 of the Treaty on the Functioning of the European Union, every natural or legal person should have the right to effective judicial protection before a competent national court against decisions of a supervisory authority that produce legal effects vis-à-vis that person. Such decisions relate, in particular, to the exercise of investigative, corrective, and authorizing powers by the supervisory authority or to the rejection or dismissal of complaints. […] Proceedings against a supervisory authority should be brought before the courts of the Member State in which that supervisory authority is established and should be conducted in accordance with the procedural law of that Member State. Those courts should exercise full judicial jurisdiction, which should include the power to rule on all factual and legal issues relevant to the dispute before them. If the supervisory authority has rejected or dismissed a complaint, the complainant may bring the matter before the courts in the same Member State.” [24] The Supreme Administrative Court notes at the outset that there is no dispute among the parties that Article 78(1) of the GDPR is a directly applicable provision of the EU regulation and that the terms contained therein are terms of EU law, which, in accordance with the case law of the Court of Justice, must be interpreted autonomously and uniformly (see the judgments of the Court of Justice of October 6, 1982, Cilfit and Others, C-283/81, para. 19, or of October 21, 2008, Padawan, C-467/08, para. 33). However, this does not in itself mean that this provision precludes the application of national rules governing the procedural conditions for judicial protection. According to the settled case law of the Court of Justice, in areas not governed by Union law, it is for each Member State, on the basis of the principle of procedural autonomy, to lay down the procedural rules designed to safeguard the rights arising from EU law (see the judgments of the Court of Justice of January 7, 2004, Wells, C-201/02, para. 67, or of December 14, 1995, Peterbroeck, Van Compenhout & Cie v. the Belgian State, C-312/93, para. 12). In the context of the exercise of rights under Articles 77 and 78 of the GDPR, the Court of Justice confirmed in the aforementioned Budapesti Elektromos Művek judgment (paragraph 45) that: “In the absence of EU legislation in this area, it is for each Member State, on the basis of the principle of procedural autonomy of the Member States, to lay down the rules governing the administrative and judicial procedures designed to ensure a high level of protection of the rights which individuals derive from Union law.” [25] The Supreme Administrative Court also applied the principle of procedural autonomy in relation to the exercise of the rights guaranteed by Articles 77 and 78 of the GDPR in the aforementioned judgment No. 1 As 71/2024-53, in which it stated: “One of the fundamental principles of the domestic application of EU law is the procedural autonomy of a Member State. This, of course, also applies to the domestic implementation of procedural or other institutions not regulated by the EU regulation itself, such as the specific circumstances surrounding the exercise of the substantive rights guaranteed under Articles 77 and 78 of the GDPR. […] It is therefore a matter for Czech law to subordinate proceedings conducted before a Czech administrative authority—the substantive legal basis of which lies in a directly applicable EU regulation—to the corresponding provisions of Czech law.” [26] The relationship between Article 78(1) of the GDPR and the Code of Administrative Procedure must therefore be understood to mean that EU law defines the data subject’s right to seek judicial protection against a legally binding decision by a supervisory authority or its failure to act, while national law establishes the procedural framework for its exercise (i.e., the applicable type of action, time limits, formal requirements, etc.). The Municipal Court’s conclusion that the right to effective judicial protection under Article 78(1) of the GDPR is “exercised, inter alia, through Section 65 of the Code of Administrative Procedure” can therefore generally be considered correct. The task of the national court is merely to ensure that these rules are not less favorable than those governing similar domestic remedies and do not, in practice, render the exercise of rights conferred by Union law impossible or unduly difficult (see the judgment of the Court of Justice in Budapesti Elektromos Művek, paragraphs 46, 48, and 57). However, it is a matter for Czech law to bring proceedings—in which an entitled person exercises their right to effective judicial protection against a legally binding decision of a supervisory authority—under the relevant provisions of Czech law and to establish the procedural conditions for the exercise of such rights. [27] The statutory provisions contained in the Code of Administrative Procedure are therefore relevant for assessing the standing of a plaintiff seeking protection under the GDPR. Although the Supreme Administrative Court does not deny that every data subject has the right to effective judicial protection against inaction or a decision by a supervisory authority—which procedural rules cannot unreasonably impede— on the other hand, it cannot be asserted that data subjects may challenge any decision by a supervisory authority that relates to the protection of their rights. The decisive factor is always the nature of the contested act—in this case, the nature of the supervisory authority’s decision. [28] In his complaint, the complainant did not challenge the defendant’s decision regarding his complaint under Article 77 of the GDPR, but rather the decision issued in the administrative offense proceedings conducted against those accused of the offense. Indeed, the Municipal Court correctly identified this and explicitly stated that the subject of judicial review is precisely this decision, not the manner in which the complainant’s complaint was handled. The complainant does not dispute this conclusion in any way in his cassation appeal. It follows from the established case law of the Supreme Administrative Court that, in matters of administrative penalties, third parties generally do not have a public subjective right to have administrative proceedings for an administrative offense initiated against another entity, to have that entity found guilty, or to have a sanction imposed upon them (see the judgment of the Enlarged Panel of the Supreme Administrative Court dated March 26, 2021, Ref. No. 6 As 108/2019-39, Žaves, No. 4178/2021 Coll. of the Supreme Administrative Court, para. 84, or the judgments of the Supreme Administrative Court dated April 4, 2019, Ref. No. 1 As 74/2018-40, point 53, dated January 29, 2015, Ref. No. 8 Afs 25/2012-351, paragraphs 208 and 209, or dated March 11, 2008, Ref. No. 8 As 46/2007-98). Furthermore, in the aforementioned Land Hessen judgment, the Court of Justice expressly stated that a data subject whose rights have been violated does not have a subjective right to demand a specific outcome of administrative offense proceedings (paragraph 41). In this regard, the Municipal Court aptly noted that decisions on guilt and penalties in administrative offense proceedings take place exclusively in the relationship between the state and the accused; thus, the complainant’s legal sphere could not have been affected by how the administrative offense guilt of other persons was assessed. [29] It follows from the foregoing that it is necessary to distinguish the data subject’s status in the handling of his or her complaint under Article 77 of the GDPR from his or her status in administrative proceedings conducted against another person. In the first case, the proceedings concern the assessment of an alleged infringement of the data subject’s rights and the adoption of appropriate measures against the controller. The decision by which the supervisory authority resolves such a complaint, by its very nature, directly concerns the data subject within the meaning of Article 78(1) of the GDPR and establishes the right to effective judicial protection. The complainant is its direct addressee in a substantive sense and, as such, has the right to judicial review (see the judgment of the Court of Justice in [case], in particular paragraphs 47–52). Recital 143 of the GDPR, cited above, links such judicial protection to the rejection or dismissal of a complaint. By contrast, the subject matter of administrative proceedings for an administrative offense brought against another person is exclusively the assessment of the accused’s liability for the offense and the possible imposition of a sanction. This concerns the aforementioned public-law relationship between the state and the accused. The data subject does not act as a party to such proceedings, unless national law grants him or her that status (pursuant to Section 68 of the Administrative Offenses Act, the parties are the accused, the injured party with respect to their claim for damages or the return of unjust enrichment, and, where applicable, the owner of the property that may be seized). Nor does it follow from Judgment No. 1 As 71/2024-53 does it follow that any subsequent administrative offense proceeding would constitute a decision on a complaint or that the complainant would be entitled to challenge its outcome as an act concerning him or her within the meaning of Article 78(1) of the GDPR. [30] Nor does the judgment cited by the complainant lead to a different conclusion. In that judgment, the Court of Justice held that a decision by a supervisory authority issued in response to a complaint by a data subject under Article 77 of the GDPR is a legally binding decision that concerns that complainant, and is therefore subject to judicial review in full jurisdiction (see, in particular, paragraphs 50, 53, and 70). However, this conclusion applies specifically to a situation where a data subject challenges a decision issued in response to his or her own complaint, not to a decision issued in separate administrative proceedings conducted against another person. The complainant’s assertion that “these are entirely identical factual situations” does not hold up. In the case under consideration at that time, the data subjects sought a review of the supervisory authority’s decision issued regarding their complaints pursuant to Article 77 of the GDPR, and after reviewing the merits of the complaints, the supervisory authority concluded that the processing of personal data challenged by them was lawful under the GDPR (para. 50). Thus, this was not a review of the outcome of administrative proceedings against a third party, as in the present case. [31] The Supreme Administrative Court reiterates that distinguishing between the resolution of a complaint and the discontinuation of administrative offense proceedings is absolutely crucial. The complainant sought, both in the action filed and in the cassation complaint, the annulment of the decision to discontinue the administrative offense proceedings. The Supreme Administrative Court further adds to the above that the Enlarged Panel, in its recent judgment dated May 6, 2026, Ref. No. 4 As 13/2025-41, Masox, regarding the admissibility of judicial review of a decision to discontinue administrative proceedings—with reference to the Žaves judgment—emphasized that the case law of administrative courts allows for judicial protection wherever it is reasonably conceivable that an individual’s rights have been affected by the actions of the public administration (whether in the form of an act, an omission, or a combination thereof), provided that the impact is not merely marginal. This principle means that judicial review of public administration actions is necessary only if it is reasonably conceivable that such actions actually encroach upon an individual’s legal sphere (para. 35). In the Masox judgment (including with regard to the specific grounds for dismissing the action), the Enlarged Chamber subsequently emphasized that a distinction must be made between two situations. The first involves actions by public authorities that can never affect the rights and obligations of any individual, and thus not even those of the petitioner. In the second case, such action may interfere with someone’s rights or obligations, but it certainly cannot do so in relation to the petitioner. It classified as belonging to the first group of cases orders to discontinue proceedings issued in proceedings initiated ex officio, the initiation of which no individual can compel by filing an action for protection against unlawful interference under the Žaves judgment. The Žaves judgment also explicitly included proceedings concerning the commission of an administrative offense (misdemeanor) among these proceedings, because the aggrieved party cannot seek the initiation of misdemeanor proceedings against a suspect; the aggrieved party or other persons other than the accused cannot challenge the findings of an administrative decision regarding guilt or sanctions, including a decision to discontinue proceedings for a misdemeanor (paragraph 84 of the Žaves judgment). The Masox judgment also ruled out the possibility that a person accused of a misdemeanor could file a lawsuit seeking the annulment of a ruling to discontinue misdemeanor proceedings (para. 49). The Masox judgment, in conjunction with the Žaves judgment, thus confirms the conclusions stated above. Since victims of an administrative offense cannot sue to compel the initiation of administrative proceedings, it follows that they do not have the right to sue to overturn a ruling dismissing such proceedings. [32] The Supreme Administrative Court adds that it is evident from the course of the administrative proceedings under review and the contents of the administrative file that the defendant dealt with the complainant’s complaint properly and diligently. On that basis, it first gathered a great deal of evidence and subsequently initiated administrative proceedings for an administrative offense. The initiation of these proceedings can be viewed as an act by the defendant acknowledging the grounds for the complaint; otherwise, it would not have initiated the proceedings at all. However, this should not be confused with the complainant’s right to have the accused found guilty of the administrative offense and to have an administrative penalty imposed on them, which he sought in his lawsuit challenging the order to discontinue the administrative offense proceedings. The defendant’s decision was not issued in the proceedings concerning the complainant’s complaint, but rather in the subsequent administrative offense proceedings, a distinction the Municipal Court correctly made. [33] Beyond the foregoing, the Supreme Administrative Court further notes that in these procedural situations—i.e., when previously initiated misdemeanor proceedings are subsequently discontinued because the act in question does not constitute a misdemeanor, the defendant must subsequently issue a “negative” decision on the complaint filed under the GDPR. In this way, the defendant informs the complainants (data subjects) why it did not find the complaint to be well-founded. Data subjects may challenge the resolution of the complaint by filing a lawsuit in administrative court. The outcome of the proceedings before the administrative courts will not be a determination of the guilt or innocence of the person previously accused of an administrative offense, nor will it be the dismissal of the administrative offense proceedings. The court will only review whether the defendant properly assessed the complaint filed. This procedure prevents data subjects from losing the possibility of judicial review of the resolution of a complaint filed under the GDPR by “transferring” the complaint proceedings to the administrative offense proceedings. [34] The Municipal Court therefore did not err in concluding that the complainant lacked standing under Section 65(1) of the Code of Administrative Procedure. The contested decision did not rule on the complainant’s rights or obligations, but rather on whether other persons had committed an administrative offense and whether they should be sanctioned for it. In this regard, the established case law of the Supreme Administrative Court, to which the Municipal Court referred, is fully applicable. The Municipal Court’s conclusion that the complainant lacks standing under Section 65(2) of the Code of Administrative Procedure is also correct. This is because he was not a party to the administrative offense proceedings. The fact that the administrative proceedings were initiated in response to the complainant’s complaint to the supervisory authority does not alter this conclusion. Nevertheless, the Supreme Administrative Court considers it necessary to correct point 17 of the reasoning in the contested order, in which the Municipal Court rather clumsily stated that “the complaint must be assessed solely as a basis for initiating proceedings.” [35] In its judgment, the Court of Justice ruled out the possibility that a complaint by a data subject under Article 77 of the GDPR could be viewed as a mere submission by the data subject to the supervisory authority, from which would arise only the supervisory authority’s obligation to inform the complainant of the outcome of their submission. The Supreme Administrative Court also rejected this interpretation in its judgment Ref. No. 1 As 71/2024-53, in which it concluded that, at least with regard to the rights and obligations of the data subject, proceedings concerning a complaint under Article 77 of the GDPR must be classified as proceedings concerning a request under Title VI of the Administrative Procedure Code. A complaint by a data subject under Article 77 of the GDPR is thus not merely a petition within the meaning of Section 42 of the Administrative Procedure Code, but a procedural remedy for the protection of rights, regarding which the supervisory authority is obligated to issue a negative decision or, as the case may be, to inform the data subject of the progress in resolving the complaint and of its outcome (Article 77(2) of the GDPR). The complainant cannot therefore generally be regarded merely (in the words of the Municipal Court) as the filer of a complaint, but first and foremost as a person seeking the resolution of his or her complaint. However, this inaccuracy does not in and of itself render the dismissal of the action unlawful in the case at hand. It should be reiterated that the complainant sought the annulment of the decision to discontinue the administrative offense proceedings, but did not contest the failure to resolve the complaint or its resolution in violation of the law. Distinguishing between these procedures and the proceedings conducted by the defendant is essential. The absence of a separate decision on the complaint cannot, in and of itself, establish the complainants’ standing to challenge the decision to discontinue the misdemeanor proceedings. The Municipal Court’s key conclusion—that the complainants lack standing to file an action against the decision challenged in the lawsuit—therefore stands. [36] The Supreme Administrative Court concludes that the Municipal Court did not err in dismissing the action (see also the judgment of the Enlarged Panel of the Supreme Administrative Court in the Masox case). Nor can a violation of Article 36(1) of the Charter of Fundamental Rights and Freedoms and Article 47 of the Charter of Fundamental Rights of the European Union be inferred. The lack of standing to bring an action against a decision to discontinue administrative offense proceedings—the sole subject matter of which is the issue of the administrative criminal liability of third parties—does not interfere with the victims’ right of access to the courts. Moreover, the Constitutional Court has repeatedly held that even an injured party in criminal proceedings may invoke the right to an effective investigation only in exceptional cases, and that the right to an effective investigation of criminal activity does not guarantee a specific outcome of the proceedings (see, among others, the Constitutional Court’s ruling of April 10, 2024, Case No. I. ÚS 1958/23, No. 71/2024 Coll. of Constitutional Court Decisions). A right to a specific outcome of an investigation into an administrative offense cannot be inferred any the less. Regarding this objection, the Supreme Administrative Court notes, in addition to what has already been stated, that the defendant gathered a substantial amount of evidence both before and during the administrative proceedings, on the basis of which it assessed the guilt of the persons accused of the administrative offense. It cannot therefore be argued that the defendant failed to properly investigate a possible infringement of the complainant’s rights. [37] The municipal court’s ruling dismissing the action therefore stands. However, the Supreme Administrative Court must correct the grounds for dismissal, as the dismissal of the action pursuant to Section 46(1)(c) of the Code of Administrative Procedure was not appropriate. In the Masox judgment, the Enlarged Panel summarized that the regional court shall dismiss an action pursuant to Section 46(1)(c) of the Code of Administrative Procedure as an action filed by a person clearly lacking standing, if the order to discontinue administrative proceedings was issued in a proceeding in which it cannot be ruled out that such proceedings could have been initiated by an action for protection against unlawful interference, but the action against the order was filed by a person whose legal position could not have worsened as a result of the discontinuation of the administrative proceedings compared to the situation prior to their initiation, and at the same time, under the law, the termination of the administrative proceedings in any other manner was not an option, which would have been more favorable to the plaintiff from various perspectives or would have had a substantially different legal significance for him. It follows from the foregoing that the order to discontinue the proceedings now under review was issued in proceedings whose initiation no individual could have compelled by filing an action for protection against unlawful interference. For such cases, the Enlarged Panel has ruled that the regional court shall dismiss the action pursuant to Section 46(1)(d) in conjunction with Section 68(e) and Section 70(a) of the Code of Administrative Procedure. The Municipal Court therefore dismissed the complainant’s action in accordance with the law, albeit on an incorrect legal ground. The cassation complaint is therefore unfounded. (…)