CJEU case C‑414/24 Datenschutzbehörde (Articulation des recours) – CJEU Judgment (Austria, 2025)

In 2017 (before the GDPR entered into force), a data subject requested an online physician search platform (the controller) to erase their data. The controller refused, and the data subject brought a claim before a civil court. The data subject requested the controller to erase their data again after the GDPR had entered into force. This request was refused, and the data subject filed a complaint with the Austrian DPA. The DPA dismissed the complaint, on the grounds that they had previously brought the same matter before a court. According to the DPA, filing parallel or consecutive claims with a supervisory authority and a court was incompatible with the remedial mechanism under the GDPR. At the time, the civil court had not reached a final decision. The data subject appealed the decision to the Federal Administrative Court (Bundesverwaltungsgericht, or BVwG), who dismissed the appeal. The BVwG stated that the one-year limitation period under Austrian law had passed, and therefore, the data subject did not have the right to file a complaint with the DPA. The fact that the GDPR had entered into force did not interrupt the limitation period. Both the data subject and the DPA appealed the decision of the Court to the Supreme Administrative Court (Verwaltungsgerichtshof, or VwGH). The VwGH disagreed with the reasoning of the BVwG; the limitation period only started after the controller rejected the data subject’s second erasure request, after the GDPR had entered into force. The VwGH stayed proceedings and requested a preliminary ruling from the CJEU. The question was based on the Case C-132/21, in which the CJEU held that the right to lodge a complaint with a supervisory authority (Articles 77(1) and 78(1) GDPR) may be exercised independently from the right to a judicial remedy against a controller or processor (Article 79(1) GDPR). The VwGH requested the CJEU to clarify the relationship between the remedies, and specifically, whether a DPA can reject a complaint