Court case 3 L 37/26.Z – Court Ruling (Germany, 2026)

The data subject lodged a complaint with the data protection authority of Saxony-Anhalt in August 2023, arguing that the procedure for selecting and electing the DPA violated the GDPR. The DPA found no GDPR infringement that could be pursued under Article 77 GDPR and rejected the complaint. The data subject appealed this DPA decision. He stated that the DPA had failed to properly examine the complaint on its merits and should therefore be required to reconsider it. The court of first instance dismissed the appeal as it considered the the DPA decision to be correct and could not find any GDPR infringement either. The data subject argued in his further appeal before the higher administrative court that Article 77 GDPR confers the data subject the right to a genuine substantive investigation of the complaint. He was of the opinion that the DPA had essentially refused to handle his complaint within the meaning of Article 78(2) GDPR and should be required to reconsider it. The court dismissed the appeal as unfounded. First, it pointed out that Article 57(1)(f) GDPR requires the DPA to investigate the subject matter of the complaint to the extent appropriate. The DPA therefore retains discretion concerning the scope of the investigation. In this case, the court found that the DPA had not simply ignored the complaint: it had conducted a legal assessment of the complaint and issued a reasoned decision. Second, the court held that the present case fell under Article 78(1) GDPR instead of Article 78(2) – the DPA had not failed to handle the complaint as it had issued a legally binding decision. Therefore, the court ultimately came to the conclusion that a DPA cannot be required to investigate the complaint again if the court reviewing the case can determine that no violation of the GDPR has occurred.