Skip to content

You are viewing the classic layout. Switch to the new layout

Case Law·CJEU·C-205/25EN
Export

C-205/25 - Bayerisches Landesamt fur Datenschutzaufsicht

Holding. Holding TBD.. First Question: .

StatusNot cited by any decision here yet

Judgment

Full text

Machine translation of the decision, via GDPRhub — not the official text.

Holding. Holding TBD.. First Question: . The court underlined the obligation under Article 57(1)(f) GDPR requiring DPA’s to handle complaints lodged pursuant to Article 77 GDPR. Apparent from this obligation is the fact that DPA’s with which a complaint is lodged must process the personal data of the data subject. Therefore, that data is recorded, consulted, stored and used by the DPA. Evidently, the powers afforded to DPA’s by EU law also implicitly affords them to determine the purposes and means of processing in regards to the handling of the complaint. The court establishes therefore that a DPA must be regarded as a controller of the personal data of the data subject within the meaning of Article 4(7) GDPR. The court further emphasised the broad definition of ‘controller’ the purpose to ensure the effective and complete protection of data subjects and the processing of their personal data. In that regard, if a DPA was not classified as a controller concerning the personal data proc

How it connects

Slovenian DPA: employer's ongoing redirection of absent employee's emails unlawful The DPA received a complaint by an employee against his former employer (data controller) regarding the handling of his work email during a period of prolonged absence. The data… 06111-65/2023/12 ·Slovenia ·IP-RS Nov 4, 2026 Supervisory Authorities Legitimate Interest Lawful Basis
Slovenian DPA: high school breached GDPR security by leaving results list exposed The DPA received a notification of a data breach at a high school, after which it started an investigation. During a high school graduation celebration, where every student was… 0612-35/2026/4 ·Slovenia ·IP-RS Nov 4, 2026 Supervisory Authorities Data Breaches Notification Obligation
€48,000 Italian DPA investigates Deutsche Bank and Poste Italiane over unlawful loan data The DPA received a complaint by an employee of Poste Italiane S.p.A. (the data subject) after Deutsche Bank denied the data subjects loan application, and subsequently published… Italy ·Garante ·Art. 4, 5, 13 +1 Oct 7, 2026 Supervisory Authorities Processors Controllers