CJEU – CJEU Judgment (European Union, 2026)

A data subject was a temporary agent working for the CJEU. In 2019, the data subject reported inappropriate conduct of a member of the General Court with whom they were working. The President of the General Court initiated proceedings, and an Advisory Committee issued an opinion that the member in question had breached provisions of the Code (the data subject was informed of this opinion). The data subject requested the relevant authority (“AHCC”) to open an administrative investigation and provide them with technical and financial assistance in potential proceedings before national judicial authorities. The authority opened an investigation and partially granted the request for assistance in September 2019. The data subject did not contest this decision, and filed a new request for assistance in 2021 on the grounds that new and substantial facts had arisen since the decision in 2019. The Appeals Panel considered this as a request for an internal appeal and declared it inadmissible. The Panel also dismissed the request on the merits, considering it unfounded. In 2019, the data subject also submitted an access request to the General Court and Presidents of the Court of Justice, in accordance with [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Article 17 of the EUDPR]. The data subject requested access to documents relating to the whistleblowing and assistance procedures they had initiated. Both parties rejected the data subject’s access request, on the grounds that it would likely infringe upon the rights and freedoms of others ([https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Article 17(4) and 25(1)(c), (g), and (h) EUDPR]). The data subject filed an internal appeal, which was rejected in 2020. The data subject filed a new access request in 2023. This request was rejected on the grounds that it had the same subject matter as the access request made in 2019. The data subject filed a case with the General Court to overturn the dismissal of the internal appeal. In addition, the data subject requested €200,000 in damages for the refusal to grant access and the refusal to transfer the documents to the relevant national courts. The court considered both the decision regarding the administrative investigation and the access request, however, this summary will focus on the access request. The court first noted that the right to access under the EUDPR is not absolute, and may be subject to restrictions (especially when they are necessary to protect the rights and freedoms of others). The restrictions under [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Articles 17 and 25 EUDPR] may be applied to whistlebowling procedures, meaning the CJEU may refuse to provide a data subject with a copy of their data where they contain information likely to infringe upon the rights and freedoms of others. However, the CJEU has a margin of discretion and must balance the right to access and third parties’ rights.See C-487/21 (Österreichische Datenschutzbehörde and CRIF), margins 43 and 44, https://infocuria.curia.europa.eu/tabs/affair?lang=en&searchTerm=%22C-487%2F21+%22 In this case, the court stated that the data subject’s right to access did not prevail over the rights and freedoms of others. This is because the persons heard during the proceedings were promised anonymity, and redacting their names was not enough to ensure that. In terms of damages, the court held that, in principle, the claim for damages is admissible insofar as it concerns the unlawfulness of refusing to grant access to the data subject’s personal data. The data subject did not have the right to claim damages for the refusal to disclose the documents to national courts, because they did not follow the proper procedure in accordance with the Staff Regulations. Nonetheless, the court stated that the data subject did not demonstrate that the CJEU had manifestly and gravely misused its margin of discretion in refusing the access request. Therefore, the court dismissed the claim for damages.