# CJEU - C-205/25 - Bayerisches Landesamt fur Datenschutzaufsicht - Type: Case Law - Source: CJEU - Identifier: C-205/25 - Date: 2026-11-11 - Original: https://gdprhub.eu/index.php?title=CJEU_-_C-205/25_-_Bayerisches_Landesamt_fur_Datenschutzaufsicht - Canonical: https://overview.legal/posts/608809 - Topics: Personal Data, Supervisory Authorities, Data Controller, Controllers ## Summary Holding. Holding TBD.. First Question: . The court underlined the obligation under Article 57(1)(f) GDPR requiring DPA’s to handle complaints lodged pursuant to Article 77 GDPR. Apparent from this obligation is the fact that DPA’s with which a complaint is lodged must process the personal data of the data subject. Therefore, that data is recorded, consulted, stored and used by the DPA. Evidently, the powers afforded to DPA’s by EU law also implicitly affords them to determine the purposes and me ## Full text Holding. Holding TBD.. First Question: . The court underlined the obligation under Article 57(1)(f) GDPR requiring DPA’s to handle complaints lodged pursuant to Article 77 GDPR. Apparent from this obligation is the fact that DPA’s with which a complaint is lodged must process the personal data of the data subject. Therefore, that data is recorded, consulted, stored and used by the DPA. Evidently, the powers afforded to DPA’s by EU law also implicitly affords them to determine the purposes and means of processing in regards to the handling of the complaint. The court establishes therefore that a DPA must be regarded as a controller of the personal data of the data subject within the meaning of Article 4(7) GDPR. The court further emphasised the broad definition of ‘controller’ the purpose to ensure the effective and complete protection of data subjects and the processing of their personal data. In that regard, if a DPA was not classified as a controller concerning the personal data proc ## Cited law provisions (51) ### GDPR — gdpr-art-4-par-1-en ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; ### GDPR — gdpr-art-4-par-2-en ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; ### GDPR — gdpr-art-4-par-7-en ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; ### GDPR — gdpr-art-4-par-21-en ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 51; ### GDPR — gdpr-art-12-par-5-en Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: ### GDPR — gdpr-art-15-par-1-en The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: ### GDPR — gdpr-art-15-par-3-en The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. ### GDPR — gdpr-art-17-par-2-en Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. ### GDPR — gdpr-art-22-par-1-en The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. ### GDPR — gdpr-art-22-par-4-en Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place. ### GDPR — gdpr-art-23-par-1-en Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: ### GDPR — gdpr-art-23-par-1-pnt-c-en public security; ### GDPR — gdpr-art-23-par-1-pnt-e-en other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security; ### GDPR — gdpr-art-23-par-1-pnt-h-en a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g); ### GDPR — gdpr-art-23-par-1-pnt-i-en the protection of the data subject or the rights and freedoms of others; ### GDPR — gdpr-art-42-par-7-en Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant requirements continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the requirements for the certification are not or are no longer met. ### GDPR — gdpr-art-51-par-1-en Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’). ### GDPR — gdpr-art-57-par-1-pnt-a-en monitor and enforce the application of this Regulation; ### GDPR — gdpr-art-57-par-1-pnt-f-en handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary; ### GDPR — gdpr-art-58-par-1-en Each supervisory authority shall have all of the following investigative powers: ### GDPR — gdpr-art-58-par-2-en Each supervisory authority shall have all of the following corrective powers: ### GDPR — gdpr-art-77-par-1-en Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. ### GDPR — gdpr-art-89-par-1-en Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. ### GDPR — gdpr-art-1-en Subject-matter and objectives ### GDPR — gdpr-art-4-en For the purposes of this Regulation: ### GDPR — gdpr-art-5-en Principles relating to processing of personal data ### GDPR — gdpr-art-12-en Transparent information, communication and modalities for the exercise of the rights of the data subject ### GDPR — gdpr-art-13-en Information to be provided where personal data are collected from the data subject ### GDPR — gdpr-art-14-en Information to be provided where personal data have not been obtained from the data subject ### GDPR — gdpr-art-15-en Right of access by the data subject ### GDPR — gdpr-art-16-en The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. ### GDPR — gdpr-art-17-en Right to erasure (‘right to be forgotten’) ### GDPR — gdpr-art-18-en Right to restriction of processing ### GDPR — gdpr-art-19-en The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. ### GDPR — gdpr-art-20-en Right to data portability ### GDPR — gdpr-art-21-en Right to object ### GDPR — gdpr-art-22-en Automated individual decision-making, including profiling ### GDPR — gdpr-art-23-en Restrictions ### GDPR — gdpr-art-34-en Communication of a personal data breach to the data subject ### GDPR — gdpr-art-42-en Certification ### GDPR — gdpr-art-43-en Certification bodies ### GDPR — gdpr-art-51-en Supervisory authority ### GDPR — gdpr-art-52-en Independence ### GDPR — gdpr-art-57-en Tasks ### GDPR — gdpr-art-58-en Powers ### GDPR — gdpr-art-77-en Right to lodge a complaint with a supervisory authority ### GDPR — gdpr-art-78-en Right to an effective judicial remedy against a supervisory authority ### GDPR — gdpr-art-79-en Right to an effective judicial remedy against a controller or processor ### GDPR — gdpr-art-80-en Representation of data subjects ### GDPR — gdpr-art-82-en Right to compensation and liability ### GDPR — gdpr-art-83-en General conditions for imposing administrative fines --- Generated by overview.legal · https://overview.legal/posts/608809 · 2026-11-14