CJEU case C-205/25 Bayerisches Landesamt für Datenschutzaufsicht – Advocate General Opinion (Germany, 2026)

A journalist (the data subject) filed several complaints with a DPA. In one of the complaints, the DPA informed the data subject that it had identified data protection violations and it would impose a fine in the event of future violations. The data subject requested further details, and submitted an access request under Articles 15(1) and (3) GDPR after not receiving a response. The DPA rejected the access request, on the grounds that the Bavarian Data Protection Act (BayDSG) did not provide for rights to access or information regarding files and records of supervisory authorities. The data subject filed a claim before the Bayerischen Verwaltungsgericht Ansbach (Bavarian Administrative Court in Ansbach), requesting the court to order the DPA to provide them all data related to the complaint proceedings. The DPA granted the data subject access to the file in 2024, however, it did not acknowledge the legal obligation to provide this information. Therefore, the data subject requested the court to declare that the refusal to provide access was unlawful. The court filed a request for a preliminary ruling before the CJEU, in order to clarify the role of the DPA in this case. The court had doubts on whether a supervisory authority may be considered a controller within the meaning of Article 4(7) GDPR when investigating a complaint. If yes, the court also had doubts on whether the blanket exclusion from access rights under national law is compatible with Article 23(1) GDPR. The court referred the following questions to the CJEU for a preliminary ruling: # Is Article 15 GDPR in conjunction with Article 4(7) GDPR to be interpreted as meaning that a DPA, which acts in the context of a complaint procedure initiated by a data subject at the same time a "controller" and is therefore obliged to provide information to the data subject on the basis of Article 15 GDPR? # In the event that the answer to question 1 is "yes": Is EU law, in particular Article 23 GDPR, be interpreted as precluding a national provision - such as [https://www.gesetze-bayern.de/Content/Document/BayDSG-20 Section 20(2) BayDSG] - according to which there is no general right of access or inspection of files and records of the DPA? == On classifying the DPA as a controller The AG first noted that the definition of controller does not preclude the possibility that a DPA may be considered a controller, as Article 4(7) GDPR is broad and includes public authorities. Similarly, the definition of supervisory authority under Article 4(21) GDPR does not preclude this. The AG also noted that under Article 77 GDPR, supervisory authorities are tasked with actively applying data protection rules, and are not limited to passively receiving complaints. This means that a DPA does not simply receive data, but must itself process data when investigating complaints. A DPA processes data when exercising its investigative and decision-making powers (Article 57(1) GDPR). Therefore, a DPA cannot be considered a mere recipient in accordance with Article 4(9) GDPR; the AG opined that DPAs have the authority to determine the purposes and means of processing, even if the tasks are mandated by law. Finally, the AG stated that data subjects’ rights (in particular access rights) would be limited if a DPA is not considered a controller. This is because data subject rights (Articles 12 to 22 GDPR) can only be exercised against a controller, and DPAs would be exempted from transparency and accountability requirements. On access requests As a controller, the DPA has the obligation to respect data subjects’ rights under the GDPR, in particular access rights. In this case, the AG stated that a complainant is generally also considered a data subject in proceedings initiated under Article 77 GDPR. Therefore, a data subject can request information from a DPA on whether personal data concerning them is being processed. In the affirmative case, the right to access includes all information provided for under Articles 15(1)(a) to (h) GDPR. This also includes data subjects’ right to receive a copy of their data (Article 15(3) GDPR); the AG emphasised the importance of transmitting this data in a full and clear manner. However, the AG also stated that the scope of this right remains strictly limited to the data of the data subject. Finally, the AG distinguished between the right to access (Article 15 GDPR) and procedural transparency during administrative proceedings of handling complaints (Article 77(2) GDPR). The AG clarified that the right to access under Article 15 GDPR does not provide the data subject with a general right of access to administrative files. The aim of Article 15 GDPR is to ensure individuals’ control over their personal data and allow them to exercise their other rights under the GDPR effectively. This, however, does not extend to a general right to inspect internal documents or access internal decision-making documents. == Article 23 GDPR allows EU or Member State law to restrict the right of access (among others), subject to conditions laid down in the Article. Specifically, the restriction must respect the essence of the fundamental rights and freedoms, must be necessary and proportionate, and safeguard one of the goals mentioned in the exhaustive list in Article 23(1) GDPR. In this case, [https://www.gesetze-bayern.de/Content/Document/BayDSG-20 Section 20 BayDSG] generally excluded any right to obtain information or access to a DPA. The AG noted that national law provisions did not refer to any of the objectives listed in Article 23 GDPR to justify the limitation, but merely states that it takes purpose limitation into consideration. The AG then assessed whether national law limiting the right to access is compatible with the GDPR. In terms of legitimate purpose, the AG opined that (in principle) [https://www.gesetze-bayern.de/Content/Document/BayDSG-20 Section 20 BayDSG] could rely on the protection of confidentiality of third parties’ personal data (Article 23(1)(i) GDPR) and ensuring the smooth functioning of supervisory authorities (Article 23(1)(h) GDPR). The AG opined that the justification of the protection of public security (Article 23(1)(c) GDPR) was not justified. Nonetheless, the AG opined that national provisions that generally exclude any right to access are incompatible with the GDPR, as they are not proportionate. The AG noted that the right of access is an essential aspect of the principle of transparency, and is closely connected to Article 8 of the EU Charter of Fundamental Rights (CFREU). In accordance with Article 52(1) CFREU, any restriction on a fundamental right must also respect the "essence" of the right.See judgments of April 8, 2014, Digital Rights Ireland et al. (C-293/12 and C-594/12, margin. 38), of October 6, 2015, Schrems (C-362/14, margin 94), of July 16, 2020, Facebook Ireland and Schrems (C-311/18, margin. 174), and of October 6, 2020, La Quadrature du Net et al. (C-511/18, C-512/18, and C-520/18, margin 121) The AG opined that a complete exclusion of the right of access was incompatible with the CFREU and the objective of the GDPR of ensuring a high level of data protection for natural persons. This applied even if the objective is to protect the rights and freedoms of third parties; in this case the DPA must balance the conflicting interests and must not use this objective to completely deny the right to access (in accordance with Recital 63 GDPR). Finally, the AG noted that [https://www.gesetze-bayern.de/Content/Document/BayDSG-20 Section 20 BayDSG] was a unique provision, as no other federal state provided for an complete exclusion of access. The AG opined that this was a further reason to consider [https://www.gesetze-bayern.de/Content/Document/BayDSG-20 Section 20 BayDSG] as unnecessary and disproportionate, as all other DPAs perform their duties without a general exclusion of the right of access. TBD.