Court case AN 14 K 19.01313 – Court Ruling (Germany, 2023)

The data subject lodged a complaint against a controller with the Bavarian DPA via email. The DPA never reacted to such an email. Therefore, the data subject brought an action against the DPA, lamenting that the latter did not take into consideration their original complaint within the legally established term of three months. Eventually, the DPA took action, examined the data subject’s complaint and rejected it for lack of any GDPR violation. The data subject accepted the merit of the decision and withdrew its principal legal action but also asked the DPA to bear the costs of the procedure. In the data subject’s view, the DPA’s lack of response still amounted to a failure to act for which the DPA was liable. The DPA refused to pay the costs arguing that the data subject’s email was not a complaint within the meaning of Articles 77 or 78 GDPR, as no GDPR violation by the controller was argued. Thus, the procedure continued exclusively with regard to the costs. The Administrative Court of Ansbach (Verwaltungsgericht Ansbach – VG Ansbach) upheld the data subject’s view. According to the court, the email sent to the DPA amounted to a complaint pursuant to Article 77 GDPR. The right to an effective remedy implies that the procedural requirements to file a complaint with a supervisory authority shall not be interpreted too strictly. The lack of response within the legally established term of three months in turn entailed a liability pursuant to Article 78(2) GDPR. The DPA did not show any compelling reason for which the decision was delayed. According to the court, informing a data subject pursuant to Article 78(2) GDPR is not a particularly high standard to meet. The court completely disregarded the outcome of the complaint on the merits. As the data subject had withdrawn its action, the main procedure was discontinued. However, the court ordered the DPA to bear the costs, applying a provision of German national law (§ 161(3) VwGO) by analogy.