CJEU case C-185/25 Waldfelber – CJEU Judgment (Austria, 2026)

The headteacher of a primary school in Austria was in charge of organising mandatory continuing training programmes for teachers at the school. The training programmes were provided by a University, which supplied schools with organisational staff known as programme coordinators. The data subject was proposed by the University as the coordinator for an upcoming training programme at the school. After being informed of this proposal, the headteacher asked a teacher about the data subject’s reputation in a face-to-face conversation. The teacher expressed a negative opinion about the data subject. The headteacher then sent an email from his professional email address, using a school computer and a designated server, to an employee of the University. In the email, he requested that another programme coordinator be assigned. He referred to the information obtained from the third party, according to which the data subject allegedly opposed the public school system and was in constant dispute with the relevant education authority. When the data subject became aware of the email, he requested access under Article 15 GDPR. In particular, he asked for the identity of the third party who had provided the information, as well as a copy of the personal data concerning him processed in the email. The headteacher refused to provide this information. He argued that he had not possessed or stored personal data concerning the data subject and had merely expressed concerns about the proposed appointment. The data subject brought legal proceedings. The first instance court dismissed the claim, and the appeal court upheld that decision. The courts found that the headteacher had acted as an executive officer of the legal entity governing the school. They also held that the means of processing, including the professional email address, server and computer, had been prescribed to him. Therefore, they considered that he could not be treated as a controller under the GDPR. The appeal court also held that there was no obligation to keep a written record of the third party’s name and therefore no obligation to disclose it. The data subject appealed before the High Court, which stayed the proceedings and referred questions to the Court of Justice. The main issues discussed in the Advocate General’s Opinion were whether a natural person acting within a public body can personally qualify as a controller under Article 4(7) GDPR, the scope of the right to know the source of personal data under Article 15(1)(g) GDPR, whether a breach of the right of access can lead to compensation under Article 82 GDPR, and whether national law may channel liability away from an individual public officer and towards the relevant public body. The Advocate General (hereinafter, AG) first assessed whether the headteacher could personally qualify as a controller under Article 4(7) GDPR. The AG recalled that the concept of controller is broad, but that it requires a person or entity to determine the purposes and means of the processing. A person who processes personal data on behalf of another person or entity, and not for their own purposes, does not normally qualify as a controller. In the AG’s view, a headteacher who processed personal data in the exercise of his duties, using official tools made available by the school, and not in his own personal interest, did not personally determine the purposes and means of processing. Instead, he acted on behalf of the school or the public entity responsible for the school. The AG therefore proposed that Article 4(7) GDPR should be interpreted as meaning that a natural person who processes personal data in the exercise of their duties, as head of an organisation, and by means of tools made available and prescribed by that organisation, does not qualify as a controller. The AG added that a different conclusion could apply if the national court found that the headteacher had acted outside the scope of his duties or for his own purposes. In that case, he could potentially be treated as a controller or joint controller. Although this conclusion meant that the remaining questions did not need to be answered, the AG still addressed them in the alternative. On Article 15(1)(g) GDPR, the AG considered whether the data subject’s right to obtain information on the “source” of personal data required disclosure of the identity of the third party. The AG accepted that an opinion or assessment about a person can constitute personal data. However, where the opinion contained in the email can be attributed to the author of the email, the source of the personal data is the author, not every person who may have contributed to the formation of that opinion. Accordingly, the data subject would not automatically have a right to know the identity of the third party who had spoken to the author of the email. The position would be different if the email merely reproduced or cited the third party’s own views. In that case, the third party could be the source of the personal data. The AG also emphasised that the right of access under Article 15 GDPR must be balanced against the rights and freedoms of others. This includes the third party’s rights to privacy, confidentiality and freedom of expression. The fact that the third party could not have foreseen that their oral statements would later become subject to data processing was considered relevant to that balancing exercise. On Article 82 GDPR, the AG considered whether a breach of the right of access could give rise to compensation. The AG took the view that Article 82 GDPR is not limited to damage caused by unlawful processing operations. It can also cover damage caused by other infringements of the GDPR, including a breach of the obligation to provide access information under Article 15 GDPR. However, the data subject would still need to prove the usual conditions for compensation: an infringement of the GDPR, material or non-material damage, and a causal link between the infringement and the damage. Finally, the AG considered the national public-liability rules. Under Austrian law, an injured party cannot bring a damages claim directly against an executive officer acting in the sovereign execution of the law. Instead, liability is channelled to the relevant public legal entity. The AG considered that Article 82 GDPR does not preclude such national rules, provided that the data subject still has an effective claim for compensation against the public entity. The GDPR requires full and effective compensation for the damage suffered, but it does not necessarily require that the individual public officer be personally liable. No administrative fine or corrective measure was imposed, as the case concerned an AG Opinion in preliminary ruling proceedings.