Access to a complaint file: what the Lindenberg ruling means for your municipality

Picture this: you are the privacy officer of a Dutch municipality. A resident has reported nuisance from a business in his street and asked the municipality to take enforcement action. The municipality has spoken to the business and told the resident that measures were taken. The resident wants to know more and sends an access request: "Give me everything you hold about me in this file." Your colleagues say complaint files are internal. Can you refuse?

On 5 November 2026 the Court of Justice of the EU gave a clear answer in Lindenberg (C-205/25), although that case was about a data protection authority, not a municipality. The lessons apply to every organisation that handles complaints, reports or objections.

What the Court decided

Joachim Lindenberg, a journalist who blogs about data protection, had filed a complaint about a third party with the Bavarian data protection authority. The authority found infringements and told him so. Lindenberg then asked for access under Article 15 GDPR. The authority refused, relying on the Bavarian data protection act, which provides that there is no right to information or access to the files and records of the supervisory authority. The authority later did give access, without accepting any obligation. Lindenberg asked the court to declare the refusal unlawful.

The Court answered two questions (judgment of 5 November 2026, ECLI:EU:C:2026:933, provisional text):

1. A supervisory authority handling a complaint is the controller of the complainant's personal data and must in principle give access to that data and to the information listed in Article 15.
2. A national rule that denies the complainant any right of access to his personal data held by the supervisory authority is not allowed. None of the three Article 23(1) aims the Court examined justifies a total exclusion: protecting others (point (i)), the proper functioning and independence of the authority (point (h)) and public security (point (c)).

Lesson 1: the complaint file is covered by the GDPR

The authority argued that towards the complainant it acted only as a supervisor, not as a controller. The Court disagreed. Handling a complaint means recording, consulting, storing and using the complainant's data, and the purposes and means essentially follow from Union law (paragraphs 37 to 39). Otherwise the complainant would have none of the rights in Chapter III of the GDPR, and the principles of Article 5 and the security rules would not apply to that data (paragraph 41).

For a municipality this was already clear: it is the controller for the data in its complaint, report and objection files. The lesson is in what follows from it. A complaint file must also meet purpose limitation, accuracy, retention periods and security, and the complainant has all the rights the GDPR gives.

For your municipality: include complaints about the municipality itself (Chapter 9 of the Dutch General Administrative Law Act, Awb), reports and enforcement requests, and objections in the record of processing activities, with a retention period. An internal arrangement that "complaint files are not disclosed" is no ground to refuse access.

Lesson 2: access is about data, not the whole file

The Court says so expressly: Article 15 gives a right to one's own personal data and information about the processing, not to the administrative file or to all documents held by a public authority (paragraph 46).

What counts as the complainant's personal data is broad, though. Comments and assessments about a person are included: an examiner's comments on exam answers are personal data of the candidate (Nowak, C-434/16). The legal analysis in an internal memo is not itself personal data, but the data about the person in it are (YS and Others, C-141/12 and C-372/12). And the copy under Article 15(3) must be a faithful and intelligible reproduction of the data. That can mean providing extracts or even whole documents, but only where that is indispensable for the data subject to exercise his GDPR rights effectively (F.F., C-487/21).

For your municipality: the complainant gets his data: his complaint, the notes about him, the meeting records insofar as they concern him, and what the municipality passed on to others about his complaint. He does not automatically get the whole file.

Lesson 3: no blanket refusal, but balance and redact

A complaint file almost always contains other people's data: the business or neighbour complained about, staff, witnesses. Article 23(1)(i) GDPR allows the legislator to restrict the right of access to protect the rights of others, and under Article 15(4) the copy must not adversely affect their rights and freedoms. But that protection must not result in the complainant being refused all information (paragraphs 56 and 58, recital 63).

The Court shows the way: balance the interests and, where possible, provide the data in a way that does not harm others, for example by making third-party data illegible or anonymising it (paragraphs 58 and 59). A rule that refuses all access without that balancing is not allowed (paragraph 60).

In the Netherlands that restriction is laid down in Article 41 of the Dutch GDPR Implementation Act (UAVG); a municipality cannot rely on Article 23 directly. The controller may disapply the rights insofar as that is necessary and proportionate for one of the aims that are also in Article 23 GDPR, taking into account among other things the purposes of the processing, the categories of data and the risks for the data subject. So it is always a case-by-case assessment.

For your municipality: redact the name of the reporter or the staff member where needed, and record why. Never refuse the whole request because it also contains other people's data.

Lesson 4: workload is no reason, abuse must be shown

The authority feared that access requests would hamper its work. The Court accepts that the proper functioning and independence of a supervisory authority is a legitimate aim (paragraph 62), but a rule prohibiting all access is not proportionate to it (paragraph 64). Even if the administrative burden is considerable, the Member State must provide sufficient staff and resources (paragraph 65). For manifestly unfounded or excessive requests there is Article 12(5): charge a reasonable fee or refuse (paragraph 66). You must then demonstrate yourself that the request is manifestly unfounded or excessive (Article 12(5), last sentence). In another case, about complaints to a supervisory authority, the Court held that many complaints are not in themselves excessive: the authority must show an intention to abuse (Österreichische Datenschutzbehörde, C-416/23). That ruling was not about access requests, but the idea is useful.

For your municipality: complaining often does not make someone an abuser. Repeated access requests in quick succession can be excessive, though. If you want to refuse a request for that reason, substantiate it per request.

Lesson 5: public security requires a genuine and serious threat

Public security (Article 23(1)(c)) can also justify a restriction, but only where there is a genuine and sufficiently serious threat affecting a fundamental interest of society (paragraph 68). Nothing of the kind was shown in Lindenberg.

For your municipality: if a complaint or report concerns a safety matter, for example a report of threats or organised crime, you can withhold parts under Article 41 UAVG, for example to protect the reporter or a criminal investigation (points (i) and (d)), if you identify per case the specific risk that access would create. A general reference to "security" is not enough.

Lesson 6: your decision is an administrative decision

In the Netherlands, a written decision by an administrative body on an access request counts as a decision within the meaning of the General Administrative Law Act (Article 34 UAVG). The resident can therefore lodge an objection and an appeal. You decide without undue delay and at the latest within one month. For complex or numerous requests you may extend by two months, if you inform the person with reasons within the first month (Article 12(3) GDPR).

There are also other routes to documents, with their own rules. In an objection procedure the administrative body makes the notice of objection and all other documents relating to the case available to interested parties for at least a week before the hearing, unless secrecy is required for compelling reasons (Article 7:4(2) and (6) Awb). And anyone can request disclosure under the Dutch Open Government Act (Woo). The GDPR right of access is separate and does not disappear because another route exists.

Also for the Dutch Data Protection Authority

The ruling concerns a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens (AP). Someone who files a complaint with the AP therefore also has a right of access to his personal data in the complaint file at the AP, with the same balancing for data of the organisation or persons he complains about. The Court observes that it does not seem impossible for an authority to organise itself so that its own handling of complainants' data is independently supervised by another entity within the authority (paragraph 43).

What the AI Act adds, and what it does not

The AI Act does not change the right of access. The GDPR remains unaffected, with Article 4a and Article 59 as the only reservation (Article 2(7) AI Act).

The ruling does matter for municipalities that use AI for complaints and reports, for example a tool that sorts reports, assigns urgency or summarises conversations. What such a tool records about the complainant, such as a label, a summary or a score, can be personal data of the complainant, just like the examiner's comments in Nowak. It then falls within the right of access. So make sure you can retrieve that output per person. Under Article 15(1)(h) you must in any case explain the logic involved for automated decisions within the meaning of Article 22 GDPR.

A tool that sorts or summarises complaints is usually not a high-risk system. Take care with systems that evaluate emergency calls or dispatch emergency services, though: those are high-risk (Annex III, point 5(d)). But an AI system intended to evaluate whether residents are eligible for essential public assistance benefits and services, or to grant, reduce, revoke or reclaim them, is in principle high-risk (Annex III, point 5(a)), unless the exception in Article 6(3) applies; that exception never applies if the system profiles people. For Annex III systems the high-risk obligations apply from 2 December 2027. A system placed on the market or put into service before that date is only covered after a significant change in its design; providers and deployers of systems intended to be used by public authorities must comply by 2 August 2030 (Article 111(2)). With the high-risk obligations comes in practice the right to explanation in Article 86 for a decision with legal effects or similarly significant effects, insofar as Union law does not already provide such a right.

For a bank and a school

A bank handles customer complaints about, for example, a refused loan or a blocked account. If the customer asks for access, he gets his data in the complaint file, with the notes about him. Data of staff and third parties can be shielded after balancing. A restriction to protect a fraud investigation is possible, but case by case and substantiated (Article 41(1)(d) UAVG, the Dutch implementation of Article 23(1)(d) GDPR).

A school or university handles complaints from parents or students, sometimes about a teacher. The complainant gets his own data in the file. What is said about the teacher, the school balances, for example by redacting parts; refusing entirely is not allowed.

What to do now

1. Check whether your organisation has a rule or practice that complaint, report or objection files are not disclosed. Replace it with an assessment per request.
2. Record how you shield third-party data: who redacts, with which tool, and how you justify the choice.
3. Include complaint handling, reports and objections in the record of processing activities, with retention periods.
4. Make sure the output of AI tools used for complaints and reports can be retrieved per person.
5. Use Article 12(5) only with a justification per request, and keep it.
6. State in the decision on an access request that an objection is possible.

To check which obligations apply to your own processing under the GDPR and the AI Act, use the free case check. New EDPB guidance is listed under GDPR guidelines.

What remains open

• Provisional text. The judgment is on EUR-Lex as a provisional text. The final text may still change editorially.
• How far the balancing goes. The Court says balancing and redaction are required, but not how far an organisation must go when the complainant's data and another person's data are in the same sentence. We are not yet aware of a Dutch ruling applying the judgment.
• The proposal to amend Article 12(5). In November 2025 the European Commission proposed that an organisation may refuse an access request, or charge a fee, if someone abuses the right of access for purposes other than the protection of his data (COM(2025) 837). That proposal has not been adopted; until then the GDPR applies as the Court interprets it.