Skip to main content
Praxikon
Agent check

Ruling

Lindenberg: a data protection authority is a controller towards the complainant and must grant access

Date
Status
final
Body
Hof van Justitie van de EU (Derde kamer), Joachim Lindenberg tegen Bayerisches Landesamt für Datenschutzaufsicht
Reference
C-205/25, ECLI:EU:C:2026:933

What it is about

Question: must a supervisory authority handling a complaint under Article 77 give the complainant access to his personal data in the complaint file, and may national law exclude all access to the authority's files? Ruling: in a complaint procedure the supervisory authority is also a controller (Article 4(7)) of the complainant's personal data and must in principle grant access and the information listed in Article 15. Article 15 only covers the person's own data, not the whole file. Article 23(1)(c), (h) and (i) precludes a national rule that denies the complainant all access to his data held by the authority; a restriction requires a balancing of the interests.

What this means in practice

A public body that supervises or handles complaints is also the controller of the complainant's data and must handle an access request in the normal way. A statutory exclusion without a case-by-case balancing does not stand; refuse only the part that genuinely affects the rights of others or the investigation, and give reasons. The right of access does not mean the whole file is disclosed.

The GDPR articles concerned

Source: EUR-Lex, arrest C-205/25 (voorlopige tekst)checked on 10 November 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 15

Guidelines

Enforcement and fines

Legislation in motion6 of 9