French DPA – Court Ruling (France, 2025)

During a trial involving a data subject their medical report was presented to the court. The data subject lodged a request to the DPA on 7 June 2023. The DPA closed their request in a decision of the 24 October 2023. The DPA noticed that he must not substitute the data subject in the first exercise of their rights with the controller. What’s more, the DPA declared itself incompetent to examine the relevance of the personal information involved regarding to the dispute. The 22 December 2023, the data subject lodged a complaint to the CE. The CE rendered its decision on 27 January 2025. By rejecting the data subject’s complaint, the CE confirms the legality of the DPA’s decision to close the request of the data subject. The CE notices that without a first exercise of the rights with the controller, the data subject’s request to the DPA has no object so the DPA is founded in closing the request. The CE also points out that an administration has the obligation to invite the data subject to regularize their request if it is defective in form or procedure or if incomplete ([https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367402 Article L.114-5] and [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367404 Article L.114-6 French Code of relations between public and administration]). As the absence of an object is not a formal or procedural defect, the DPA does not have an obligation to invite the data subject to regularize their request, as Articles [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367402 L.114-5] and [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367404 L.114-6 of the French Code of relations between public and administration] are not applicable. Additionally, the CE reminds that the legal ground of a processing can be the exercise or the defense of a right in a court of law. The CE underlines that this legal ground is an exception to the exercise of rights to erasure (Article 17 GDPR) and opposition (Article 21 GDPR), and to the interdiction of health related data processing according to Article 9 GDPR. After recalling these legal provisions, the CE clarifies the distribution of roles between DPA and judges when personal information is produced in court proceedings. CE indicates that the DPA is not competent to consider the relevance of the processed information regarding the dispute, and confirms the judge’s exclusive role in appreciating evidences in terms of relevance or loyalty.