French DPA – Court Ruling (France, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The French DPA's decision was upheld by a court, confirming that a person's request for data rights was closed correctly. The court stated that the person must first address their request to the company before involving the DPA. This ruling clarifies the process for individuals seeking to exercise their data rights.
What happened
A person's complaint about their data rights was dismissed because they did not first approach the company.
Who was affected
An individual whose medical report was involved in a legal dispute.
What the authority found
The court upheld the DPA's decision to close the individual's request, stating it lacked a proper basis.
Why this matters
This case highlights the importance of following the correct process when making data rights requests. Individuals must first engage with the company before escalating to authorities.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
During a trial involving a data subject their medical report was presented to the court. The data subject lodged a request to the DPA on 7 June 2023. The DPA closed their request in a decision of the 24 October 2023. The DPA noticed that he must not substitute the data subject in the first exercise of their rights with the controller. What’s more, the DPA declared itself incompetent to examine the relevance of the personal information involved regarding to the dispute. The 22 December 2023, the data subject lodged a complaint to the CE. The CE rendered its decision on 27 January 2025. By rejecting the data subject’s complaint, the CE confirms the legality of the DPA’s decision to close the request of the data subject. The CE notices that without a first exercise of the rights with the controller, the data subject’s request to the DPA has no object so the DPA is founded in closing the request. The CE also points out that an administration has the obligation to invite the data subject to regularize their request if it is defective in form or procedure or if incomplete ([https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367402 Article L.114-5] and [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367404 Article L.114-6 French Code of relations between public and administration]). As the absence of an object is not a formal or procedural defect, the DPA does not have an obligation to invite the data subject to regularize their request, as Articles [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367402 L.114-5] and [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367404 L.114-6 of the French Code of relations between public and administration] are not applicable. Additionally, the CE reminds that the legal ground of a processing can be the exercise or the defense of a right in a court of law. The CE underlines that this legal ground is an exception to the exercise of rights to erasure (Article 17 GDPR) and op
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for French DPA in FR
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. French DPA - France (2025). Retrieved from cookiefines.eu
Last updated: